AI Harvesting Personal Data
A recent AI trend is the creation of personalised doll images. On the surface this is a fun spin off of AI although some of the images output have become popular memes being copied throughout the Internet. An interesting off-shoot is the creation and sharing of hand drawn doll images by people reacting against the prevalence of AI.
The general user needs to be aware of the consequences of uploading personal information onto engines such as an AI doll creator. The doll images themselves are displayed with selected ‘accessories’ and for these to be relevant the processor will need to be fed additional personal information. Also by agreeing to the processing the original owner is granting the AI engine some degree of lawful consent; bypassing some of the GDPR controls on an organisation’s use of personal data. Any data harvested will be stored and although it can be anonymised it could pop up again through some other output from the AI. Although this is unlikely to be malicious there could be unforeseen consequences.
In April 2025 The Huffington Post highlighted the particular problem of uploading images of children to AI engines. Together with the creation of dolls, popular AI tools include conversion of photos to cartoon characters or building up a representation of the child as an adult. Fortunately ChatGPT doesn’t allow photorealistic edits to images of children but once data is within an AI system it has access to that image including related details within such as a school uniform or data derived from the background.
There is an increased risk if images such as these dolls are shared on social media. This is highly likely as almost all doll creators will want to share their creations. Successful social engineering and phishing attacks depend on gaining information about the target. The dress and accessories displayed with the doll give solid clues as to the interests and hobbies that they are involved with.
AI is also a threat through the personal information that can be culled from seemingly harmless content and its ability to cross reference data from many sources and come to a (possibly wrong) conclusion. Culling location details from image backgrounds is a worrying development. If an individual can be linked to a location it is a major step towards building up a profile on them. TechCrunch explained how the OpenAI o3 and o4-mini models have improved abilities to ‘reason’ through uploaded images; a process that includes deciding where an image may have been created. A popular approach is to tell ChatGPT that it is playing GeoGuessr and asking it to output the location of an image. GeoGuessr is an online game where the user must identify locations from Google Street View images. The game is subscription paid with cash prizes and league rankings. These are incentives that drive users to do well at the game, pushing the use of automated assistants and increasing the capability of location finding AI because it is seeing increased use and getting more source data uploaded.
There is no easy way to put AI back in the box. The best users can do is to carefully consider what they upload and how it is shared. Within social media privacy settings should restrict the availability of personal information. The AI engines are less open in how they might use data but security enhancement will almost certainly be an option. With ChatGPT for example data controls can be set to disable it from using data input for subsequent ‘model training’
