Turkish Data Authority Warns of Facial Data Risks in AI Photo Apps
The Turkish Data Protection Authority issued a warning about privacy and biometric data risks in popular social media photo transformation apps like the 80s Challenge, noting that facial data collected by these applications could be misused or shared with third parties without clear consent.
What happened
The Turkish Data Protection Authority (KVKK) warned users on 11 September 2026 about privacy risks in social media photo transformation trends such as the #80lerchallenge, which use AI to convert user photographs into nostalgic images from different eras and styles.
The authority stated that facial images uploaded to these applications undergo algorithmic analysis to extract facial features, hair, expressions and similar visual characteristics, and may be processed as biometric data when the system performs technical operations to identify or authenticate a person.
Reported impact
The authority warned that the storage location of collected facial maps is unclear, and it is uncertain whether such data is shared with third parties or used to train AI models.
Users were cautioned that facial biometric data, once compromised, could lead to serious security problems and cannot be changed like other personal information.
Index analysis
KVKK characterized facial images as special category personal data requiring higher protection standards, including explicit processing purposes, data minimisation, technical security measures, and adherence to principles of transparency, accountability and data security in AI systems.
The authority noted that processing occurs either on users' devices or on remote servers depending on the application's technical infrastructure.
Governance controls
KVKK advised users to verify application permissions and privacy policies before uploading photographs, to avoid unfamiliar applications created solely for trends, and to check what data applications access and for what purposes.
The authority recommended users prefer established AI services such as Gemini or ChatGPT rather than third-party apps, and to carefully read privacy policies before granting data access.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.