Every AR try-on filter that maps a face is capturing biometric data — and most brands running creator campaigns still bury consent for that capture inside a generic influencer contract, if it appears at all. That’s the gap the Charlotte Tilbury settlement just made expensive. Consent language for biometric data capture is no longer a nice-to-have clause; it’s the difference between a viral AR campaign and a class action.
If your brand runs virtual try-on experiences through creator content — foundation shade matching, lip color filters, jewelry AR previews — you’re processing facial geometry data under laws that were written for fingerprint scanners and never updated for TikTok filters. The Charlotte Tilbury case just proved regulators and plaintiffs’ attorneys are done waiting for that update.
What Actually Happened With Charlotte Tilbury
Charlotte Tilbury Beauty settled a biometric privacy suit tied to its “Magic Mirror” virtual try-on tool, which used facial scanning to let customers preview makeup shades online. Plaintiffs argued the company collected and processed facial geometry — a biometric identifier under Illinois’ Biometric Information Privacy Act (BIPA) — without the written, informed consent the statute requires. No banner disclosure. No opt-in checkbox specific to biometric capture. Just a try-on feature that quietly scanned faces to render lipstick shades.
The settlement itself isn’t the headline. The headline is what it signals: BIPA plaintiffs’ firms have moved from tagging photo-storage apps and timeclock scanners to targeting beauty and fashion AR tools specifically. And creator campaigns are the biggest blind spot in that category, because brands treat the AR filter as a marketing asset, not a data collection event.
If your AR try-on experience maps a face, it’s a biometric data collection point under state law — regardless of whether a creator, a brand-owned app, or a third-party platform hosts it.
Why Creator Campaigns Are the Riskiest Delivery Channel
Here’s the operational problem nobody wants to say out loud: when a creator posts an AR try-on video using your branded filter, who’s collecting the biometric data — the platform, the creator, or the brand?
Legally, it can be all three. Practically, most brands have zero contractual language addressing it. The creator agreement covers usage rights, exclusivity, disclosure timing. It rarely mentions that the filter itself is scanning viewer faces when users try the effect themselves via TikTok’s or Instagram’s AR try-on tools.
This matters because BIPA-style statutes (and newer comprehensive privacy laws in states like Washington, Texas, and Colorado) don’t care about your org chart. They care about who “collects,” “captures,” or “possesses” the biometric identifier. A brand that commissions a face-mapping filter and pushes it through creator distribution is arguably the collector, even if a third-party AR vendor built the tech.
Add in the fact that most creator briefs are written by marketing teams with zero visibility into privacy statute obligations, and you get exactly what happened to Charlotte Tilbury: a consumer-facing feature that looks like harmless fun and functions like unconsented data harvesting.
The Three Points Where Consent Breaks Down
- Platform-level consent — TikTok and Meta’s own terms may cover their AR infrastructure, but they don’t automatically cover brand-specific data use, retention, or third-party sharing.
- Creator-level consent — Creators rarely disclose to their own audience that trying the filter triggers biometric capture, because nobody told them it does.
- Brand-level consent — The actual point-of-capture disclosure (the thing BIPA requires) often doesn’t exist in a form that satisfies “informed, written consent” standards.
Building Consent Language That Actually Holds Up
Generic privacy policy links don’t satisfy BIPA. The statute requires informed, specific, written consent before capture — not after, not buried in a terms-of-service scroll. Here’s what that means structurally for AR try-on campaigns.
First, separate biometric consent from general campaign consent entirely. Don’t fold facial data capture into your standard influencer agreement’s broad media release. Courts and regulators want to see that a user or creator specifically understood biometric capture was happening, distinct from image usage rights or content licensing.
Second, the consent language needs four specific elements to meet most state biometric statutes:
- Purpose specification — exactly what the AR tool captures (facial landmarks, geometry mapping) and why (shade matching, virtual fitting).
- Retention schedule — how long the biometric data is stored, and the deletion trigger (campaign end, account closure, a fixed period).
- Third-party disclosure — naming the AR vendor, platform, or ad-tech partner that processes the scan, since most brands license the actual try-on tech rather than build it.
- Revocation mechanism — a clear, low-friction way for the user to withdraw consent and trigger deletion, not a support ticket black hole.
Third, this consent capture needs to happen at the point of interaction, not upstream in a privacy policy. If a creator’s video links to a try-on experience, the consent prompt lives inside that experience, before scanning starts. That’s the “informed, written consent” bar BIPA sets, and it’s exactly the bar Charlotte Tilbury’s Magic Mirror allegedly missed.
Consent buried in a privacy policy is not consent under BIPA. It has to be a standalone, purpose-specific disclosure the user affirmatively accepts before the scan happens.
Rewriting the Creator Contract Layer
Legal teams tend to fix this at the consumer-facing level and stop there. That’s incomplete. The creator agreement itself needs new provisions, because creators are functionally distributing your data collection tool to their audience.
Specific clauses to add:
- Disclosure obligation — the creator must include a verbal or on-screen note that the try-on filter captures facial data, similar to how FTC disclosure requirements work for sponsored content (see our creator contract audit framework for how scripted disclosure language gets reviewed).
- Vendor flow-down — if the AR tech comes from a third-party vendor, the creator agreement should reference the same data-sharing terms you’d expect in a data-sharing rider for AI-matching tools.
- Indemnification split — define who bears liability if the AR feature is later found non-compliant, similar to the indemnification logic used in AI remix liability clauses.
- Audit rights — the brand retains the right to review the creator’s posted content for compliance with consent-disclosure requirements before and after publish.
None of this is exotic contract drafting. It’s the same discipline brands have already applied to AI disclosure and synthetic media risk — just extended to a category (AR filters) that marketing teams still think of as a fun engagement gimmick rather than a regulated data product.
Where This Intersects With AI Disclosure Rules
There’s a compounding risk here that most compliance teams miss: many AR try-on tools now use generative AI to render the “after” image, meaning you’re stacking biometric capture risk on top of AI-disclosure risk. If the filter uses a generative model to show a synthetic version of the user wearing a product, that potentially triggers the same disclosure logic covered in the FTC’s expanded rule on AI avatars. Two separate compliance obligations, one filter, and most brand teams are only tracking one of them.
The FTC has also signaled it’s watching how brands deploy AI-driven shopping and try-on tools generally — worth reviewing alongside guidance on AI shopping agent disclosure if your AR tool feeds into a purchase flow.
State Law Patchwork Makes This Worse, Not Better
BIPA gets the headlines because of its private right of action and statutory damages ($1,000–$5,000 per violation, which is how these settlements balloon fast). But Texas’s CUBI, Washington’s My Health My Data Act’s biometric provisions, and Colorado’s Privacy Act all impose overlapping, non-identical requirements. A national creator campaign running the same AR filter across states is effectively subject to the strictest applicable standard, because there’s no practical way to geofence consent language by user location in a creator-distributed video.
The safest operational posture: build to BIPA’s standard everywhere. It’s the highest bar currently in force, and it’s the one plaintiffs’ firms know how to litigate.
According to eMarketer, AR try-on adoption in beauty and fashion has grown steadily as brands chase lower return rates and higher purchase confidence — which means the addressable risk surface is only expanding. Meanwhile regulatory guidance from bodies like the FTC increasingly treats undisclosed data capture inside marketing tech as a deceptive practice issue, not just a state privacy matter.
A Quick Internal Audit Before Your Next AR Campaign
- Does the try-on tool capture facial geometry, landmarks, or a 3D face map? (Most do, even filters that seem “just visual.”)
- Is there a standalone consent screen before capture, separate from general terms of service?
- Does the creator brief disclose the biometric capture to the creator, not just the brand’s legal team?
- Is there a defined retention and deletion schedule, documented and enforceable against the AR vendor?
- Does the consent language name the specific state statutes it’s designed to satisfy, or is it generic boilerplate?
If you answered “no” or “not sure” to more than one of these, you have the same exposure Charlotte Tilbury had before its settlement.
The Takeaway
Treat every AR try-on feature in a creator campaign as a biometric data product first and a marketing asset second — draft point-of-capture consent language that names the purpose, retention, and revocation terms explicitly, and push that same disclosure obligation into the creator contract itself. Do this before your next AR campaign brief goes out, not after a demand letter arrives.
Frequently Asked Questions
Does the Charlotte Tilbury settlement apply outside Illinois?
The settlement itself centers on Illinois’ BIPA, but the underlying consent practices it exposed are relevant nationally. Texas, Washington, and Colorado all have biometric-adjacent statutes with similar informed-consent requirements, and plaintiffs’ firms are actively testing those laws against beauty and fashion AR tools.
Who is legally responsible for consent — the brand, the creator, or the AR platform vendor?
Potentially all three, depending on who “collects” or “possesses” the biometric data under the applicable statute. Brands that commission and distribute the AR experience through creator content generally can’t shift full liability to the platform or vendor without explicit contractual indemnification and data-sharing terms.
Is a general privacy policy disclosure enough to satisfy biometric consent laws?
No. Most biometric statutes, including BIPA, require informed, written consent specific to the biometric capture, obtained before the capture occurs. A privacy policy link buried in site footer or a broad terms-of-service acceptance typically doesn’t meet that standard.
Do AR filters that don’t store images still count as biometric data capture?
Often yes. Many statutes define biometric identifiers to include facial geometry or landmark mapping regardless of whether an image is stored. If the tool processes facial structure to render a try-on effect, that processing itself can trigger consent obligations even without image retention.
How does AI-generated try-on rendering add additional compliance risk?
If the AR tool uses generative AI to render a synthetic “after” image of the user, it can trigger separate AI-disclosure obligations on top of biometric consent requirements. Brands need to address both risks in the same campaign, not just one.
What’s the fastest fix for brands already running AR try-on creator campaigns?
Add a standalone, point-of-capture consent screen before the scan begins, update creator contracts to require on-screen disclosure of biometric capture, and confirm your AR vendor contract includes data retention and deletion terms you can actually enforce.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →