Meta launched, then quietly killed, a feature inside its Muse Image AI model that let any user generate AI images by tagging public Instagram accounts, pulling that account’s content as a visual reference without the owner’s consent. The opt-out existed but required users to find it buried in settings, which is precisely the design pattern regulators have been targeting as a consent violation. Within days of the Muse Image backlash<\/a>, Meta pulled the feature entirely and acknowledged it “missed the mark.”<\/p>\n If your organization runs public-facing accounts on Instagram for brand, recruiting, or executive communications, your employees’ likenesses and your brand assets were briefly fair game for AI image generation by anyone on the platform. The feature is off now, but the architecture that enabled it hasn’t changed. Any enterprise that hasn’t audited which employee and executive accounts are set to public on Meta properties is one feature relaunch away from this exposure repeating.<\/p>\n The deeper issue here is what you might call consent-by-default inversion, where a platform ships a high-risk capability with opt-out rather than opt-in, betting that most users won’t find the off switch before criticism forces a rollback. This is not a new pattern. It’s the same design playbook Meta used with facial recognition on Facebook, and it works until it doesn’t. The National Center on Sexual Exploitation flagged sextortion risk within hours of launch, which means the threat modeling was either absent or ignored internally. For CISOs, the relevant signal is that Meta’s product team shipped something its own trust and safety apparatus presumably reviewed, and still got this wrong. That gap matters when your employees or executives are the content.<\/p>\n The decision this should reframe is your vendor AI governance checklist. Most enterprise agreements with platforms like Meta cover data processing for ads, not what happens when the platform’s generative AI features consume your public content as training or reference material. Opt-out clauses buried in consumer-facing settings don’t satisfy most enterprise risk standards, and they certainly won’t satisfy an EU regulator applying the AI Act’s biometric data provisions. The question isn’t whether to trust Meta specifically; it’s whether your current vendor review process even asks what a platform does with public-account content when it ships new AI features.<\/p>\nWhat this means for your business<\/h2>\n