“Your Identity is Your IP”: The Human Consent Registry, AI, and the Evolving Legal Framework for Personality Rights in India

By Vikrant Rana and Rachita Thakur

Introduction: When Identity Becomes Intellectual Property

On 24 June 2026, actor Cate Blanchett and director Steven Soderbergh addressed the European Parliament in Brussels to announce the launch of the Human Consent Registry, an initiative of RSL Media, the non-profit co-founded by Blanchett. The Registry provides any individual — not only public figures — with a mechanism to record whether their image, voice, and identity may be used by artificial intelligence systems, and if so, under what conditions.

The Registry offers three elections: unrestricted AI use; conditional AI use subject to specific parameters; or complete prohibition. The initiative is backed by over 800 signatories, including prominent figures from the global creative and entertainment industries. It follows an open letter published in January 2026 accusing several AI developers of systematic misappropriation of creative identities.

“Your identity is your IP in the age of AI, and every person deserves the right to decide how AI can or cannot use it.” — Cate Blanchett, European Parliament, June 2026

The statement — that identity is intellectual property — is both a political claim and a doctrinal proposition. For IP practitioners, it is a proposition that demands careful examination. The question is not merely rhetorical: it goes to the heart of whether existing legal frameworks — in India and globally — are adequate to protect individuals from the non-consensual exploitation of their likeness, persona, and voice in AI-generated content.

S.S. Rana & Co. has previously examined the landscape of celebrity and personality rights under Indian law in detail, including the foundational jurisprudence on passing off, the right to privacy, and the emerging right of publicity. Those analyses — referenced throughout this article — provide the doctrinal scaffolding for the present discussion. [See: “Personality Rights and the Bachchan Cases: A New Chapter in Indian Jurisprudence( https://ssrana.in/articles/personality-rights-and-the-bachchan-cases-a-new-chapter-in-indian-jurisprudence/)

The Human Consent Registry: Architecture and Legal Character

1. What the Registry Does

   The Human Consent Registry is, at its structural core, a consent-recording and preference-signalling mechanism. It is not a governmental database, a statutory register, or a body with enforcement powers. It is a civil-society initiative designed to establish a public record of individual preferences that AI developers, content platforms, and technology companies are — morally, if not yet legally — expected to honour.

   The three-tiered election structure (permitted, permitted with conditions, prohibited)[1] mirrors the architecture of data protection consent frameworks, most notably the EU General Data Protection Regulation (“GDPR”), which requires that processing of personal data be grounded in a lawful basis, with explicit consent required for special categories of data including biometric information.

   The Registry’s designers appear to have drawn deliberately on this model. However, a private registry and a statutory consent regime are fundamentally different instruments. The GDPR carries the coercive authority of the European state; the Human Consent Registry, as presently constituted, does not.

2. Legal Character: Soft Law with Hard Implications

   The Registry is best characterised as a soft-law instrument: it sets norms, establishes expectations, and creates a record — but it does not, of itself, create enforceable obligations on AI developers. Soft law instruments of this kind have a significant historical track record of prefiguring binding regulation. The OECD Guidelines on Multinational Enterprises, the UN Guiding Principles on Business and Human Rights, and India’s own Advertising Standards Council codes all preceded or informed binding legal frameworks.

   The legal significance of the Registry lies, therefore, not in its immediate enforceability but in its role as a norm-setting mechanism that may: (i) inform future legislation in multiple jurisdictions; (ii) be adopted contractually by AI developers seeking reputational legitimacy; (iii) serve as evidence of established community standards in tort or passing off litigation; and (iv) provide a factual foundation for regulatory action by data protection authorities under existing frameworks.

The Indian Legal Framework: Existing Protections and Their Limits

1. Personality Rights and Passing Off: The Foundational Doctrine

   Indian courts have, over the past two decades, developed a robust body of jurisprudence recognising that a person’s name, likeness, and reputation constitute protectable interests capable of founding an action in passing off. The locus classicus in this regard is ICC Development (International) Ltd. v. Arvee Enterprises (Delhi HC, 2003),[2] in which the Court recognised and declared that the right of publicity inheres only in human beings and cannot be claimed by event-organizing corporate entities.[3]

   Subsequently, in Titan Industries Ltd. v. Ramkumar Jewellers (Delhi HC, 2012),[4] the Court held that the right of publicity encompasses the right to control the commercial use of one’s identity, including name, image, likeness, or any other unequivocal identifiers. The unauthorised use of a celebrity’s image in advertising,  was held to constitute an actionable wrong.[5]

   In Shivaji Rao Gaikwad (Rajinikanth) v. Varsha Productions (Madras HC, 2015),[6] the Court granted an injunction restraining the use of a film title and associated references that would exploit the plaintiff’s persona, confirming that personality rights in India vest inherently in individual who have attained celebrity status. The unauthorized use of the actor’s persona for commercial exploitation constitutes an infringement of these rights.

   S.S. Rana & Co. has examined these developments in detail in its earlier publication “Personality rights from Amitabh Bachchan to Sushant Singh to Anil Kapoor – Indian and Global view point” https://ssrana.in/articles/personality-rights-from-amitabh-bachchan-to-sushant-singh-to-anil-kapoor-indian-global-view-point/ , , which traced the doctrinal evolution from classical passing off — grounded in misrepresentation as to trade origin — to the broader, identity-protective formulation now applied by Indian courts.

2. The Right to Privacy and Its Application to Biometric Identity

   The Supreme Court’s nine-judge bench decision in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017),[7] established that the right to privacy is a fundamental right under Article 21 of the Constitution of India. Critically for present purposes, the Court recognised informational privacy — the right to control information about oneself, including one’s image — as a component of this fundamental right.

   The application of this principle to AI-generated content is direct: the use of a person’s biometric data — facial geometry, voice print, gait pattern — to train an AI model, generate a deepfake, or synthesise a digital persona without consent engages the Article 21 right to privacy. The Human Consent Registry’s mechanism is, in this sense, constitutionally coherent: it seeks to provide the very consent that Article 21 jurisprudence recognises as foundational.
   India’s statutory and regulatory framework has also long recognised the sensitive nature of biometric information. Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, “biometric information” is classified as a category of Sensitive Personal Data or Information (SPDI). The Rules contemplate the protection of identifiers such as fingerprints, retina and iris scans, voice patterns, facial patterns, hand measurements, and DNA profiles, and impose heightened obligations on entities handling such information, including requirements relating to consent, data security, and restricted disclosure.

3. The Digital Personal Data Protection Act, 2023

   The Digital Personal Data Protection Act, 2023 (“DPDP Act”) provides the most directly applicable statutory framework for the Registry’s objectives in India. The DPDP Act requires that personal data — defined broadly to include any data by which an individual may be identified — be processed only on the basis of free, specific, informed, unconditional, and unambiguous consent, or on one of the other specified lawful bases. To the extent that AI systems rely upon identifiable personal information to generate synthetic representations of individuals, the DPDP Act may offer an additional layer of regulatory scrutiny alongside constitutional privacy protections.

   Biometric data — including facial images, voice recordings, and other unique biological identifiers — falls within the definition of personal data under the DPDP Act. AI training datasets that include such data therefore engage the Act’s consent requirements. The Human Consent Registry, if adopted as a recognised consent-management platform under the DPDP Act’s framework for “consent managers” (Section 6), could acquire a statutory foundation in the Indian context.

   The act is applicable to information which by itself or in combination of certain information is capable of identifying the individual but it does not provide for data which might be inspired by the personal information of another individual .  For example, an AI-generated avatar or synthetic voice that closely resembles an individual but is produced through model inference rather than direct reproduction may fall into a regulatory grey area. Such outputs may implicate personality rights or publicity rights without necessarily constituting the processing of personal data in the conventional sense.

   The consent manager framework under the DPDP Act — which envisages registered intermediaries facilitating and recording consent on behalf of data principals — is structurally analogous to the Registry’s architecture. A centralised mechanism capable of recording and communicating consent preferences could enhance transparency, accountability, and compliance across the AI value chain.

   S.S. Rana & Co.’s analysis of the DPDP Act’s consent architecture is detailed in our earlier note, “Effect of Digital Personal Data Pprotection Rules, 2025” (https://ssrana.in/articles/effect-of-digital-personal-data-protection-rules-2025-on-ai-regulation/) . ”.

   The requirement for specific consent may get colored when the data is already in public domain as the level of protection available to that is limited under the DPDP Act 2023. A grey area that encompasses the regulatory landscape is that the DPDP Law exempts “information that is publicly made available” by the Data Principal from its ambit.[8]  In practice, many AI developers rely upon publicly accessible photographs, videos, interviews, speeches, and social media content for training purposes. The extent to which consent remains necessary in such situations, particularly where publicly available material is subsequently used to generate realistic digital replicas, remains an evolving and potentially contentious issue. As a result, reliance on publicly available data may limit the practical effectiveness of consent-based protections in certain AI-related contexts.

   Moreover, the right of withdrawal of consent to the data once shared may be difficult to be enforced in the AI models already in operation. Under the DPDP ACT the data which is once processed the withdrawal of consent shall not apply such information in retrospect.

   These limitations reveal a broader tension between traditional data protection principles and the technological realities of generative AI. The DPDP Act provides an important statutory framework for regulating the collection and processing of personal and biometric data, and its consent-manager architecture offers a potentially useful foundation for initiatives such as the Human Consent Registry.

4. Artificial Intelligence Guidelines

   India has recently sought to address some of the governance challenges posed by artificial intelligence through the release of the India AI Governance Guidelines in February 2026.

   The Guidelines acknowledge the regulatory gaps relating to AI systems including issues of classification and liability across the AI value chain, application of data protection principles to AI development, misuse of generative AI and challenges around content authentication and provenance, use of copyrighted material in AI training, and sector-specific risks in sensitive domains.[9] At the same time, the DPDP Act adopts a balanced approach by recognising certain exemptions for the processing of personal data. In particular, an individual’s rights over personal data may be limited where such processing is undertaken for research, archiving, or statistical purposes, provided that the data is processed in accordance with applicable standards and is not used to make decisions specific to the concerned Data Principal. While these exemptions are intended to facilitate innovation, research, and public-interest uses of data, they also raise important questions regarding the extent to which AI developers may rely upon such exceptions when training or refining machine learning models using large-scale datasets.

   An illustration of India’s broader regulatory approach to responsible data sharing can be found in initiatives undertaken by sectoral regulators. For example, in 2024, the Securities and Exchange Board of India (SEBI) proposed a framework for the sharing of financial market data with research institutions. The proposal broadly contemplated the creation of two categories of information: data that may be disclosed or shared for research and innovation purposes, and data that must remain protected from public disclosure. A key principle underpinning the framework was that personal, sensitive, and confidential information should either be excluded from disclosure or be effectively anonymised before being shared. Such initiatives demonstrate an emerging regulatory consensus that innovation and data-driven research should be encouraged, but not at the cost of individual privacy and confidentiality.

5. Moral Rights Under the Copyright Act, 1957

   Section 57 of the Copyright Act, 1957 confers on authors the rights of paternity (to claim authorship) and integrity (to object to modification or distortion of a work that is prejudicial to honour or reputation). The landmark decision in Amar Nath Sehgal v. Union of India (Delhi HC, 2005),[10] held that moral rights are inalienable and survive assignment of copyright, and that destruction or mutilation of a work constitutes an actionable infringement of the author’s moral rights.

   The relevance of moral rights to the AI-identity question is this: where an AI system generates content that distorts or misappropriates a person’s identity in a manner prejudicial to their reputation — whether or not copyright subsists in the underlying work — the integrity right provides a potential avenue of challenge. S.S. Rana & Co. has examined the relationship between moral rights and identity in our publication, “When the wall speak no more Moral Rights, the Whale Mural, and the Amarnath Sehgal Case” – https://ssrana.in/articles/when-the-wall-speaks-no-more-moral-rights-the-whale-mural-and-the-amar-nath-sehgal-case/  which drew parallels with the US Visual Artists Rights Act (“VARA”) and the recent Wyland v. FIFA litigation concerning the destruction of a mural protected by VARA.

The Critical Gap: No Standalone Publicity Rights Statute in India

Despite the doctrinal richness of the above framework, a critical structural gap remains: India has no standalone statute recognising and protecting the right of publicity. The protections described above are derived from: constitutional principles (Article 21); tortious doctrines developed by courts in the absence of legislation (passing off, personality rights); the Copyright Act (moral rights, applicable to authors); and the DPDP Act (personal data processing, not identity exploitation per se).

This fragmented architecture creates several practical difficulties for individuals seeking to protect their identity from AI-mediated exploitation:

Reactive, not preventive: Existing remedies are largely reactive. An individual whose AI-generated likeness has been used without consent must institute proceedings after the fact, often facing the difficulty of identifying the responsible entity, establishing jurisdiction, and quantifying damage.

No registration mechanism: Unlike trade marks (which can be registered) or copyright (which subsists automatically in defined subject matter), personality rights are not registrable in India. There is no statutory equivalent of the Human Consent Registry — no public mechanism through which an individual can formally record their preferences and expect them to carry legal weight.

Cross-border enforcement: AI developers are frequently incorporated in foreign jurisdictions, train models on data processed across multiple countries, and deploy products globally. A tortious claim before an Indian court offers limited practical reach against a US-headquartered AI company whose servers are in Singapore.

The ‘public figure’ limitation: Indian jurisprudence on personality rights has been developed overwhelmingly in the context of celebrities. The Human Consent Registry, by contrast, is designed to be universally accessible. The extension of publicity rights protection to non-celebrity individuals — in the context of AI — remains legally untested in India.

International Comparisons: What India Can Learn

1. The United States: State-Level Publicity Rights and the ELVIS Act

   The United States protects the right of publicity at the state level, with California (Civil Code §§ 3344 and 3344.1), New York, and Tennessee having the most developed frameworks. Tennessee’s Ensuring Likeness Voice and Image Security Act (“ELVIS Act”), enacted in 2024, is notable for being the first state statute specifically designed to address AI-generated voice and likeness cloning, extending protection to any individual — not merely those with established commercial value in their identity.

   The ELVIS Act approach — a standalone statute, with a specific AI application, and coverage extending to all persons — represents a model worth considering for Indian legislative reform.

2. The European Union: GDPR, the AI Act, and Biometric Data

   The EU’s General Data Protection Regulation treats facial images and biometric data as special-category data requiring explicit consent for processing. The EU AI Act (2024) adds obligations for high-risk AI systems and specific prohibitions on real-time biometric identification in public spaces. Together, these instruments create a layered framework that goes significantly further than the current Indian position.

   The Human Consent Registry’s design closely tracks the GDPR’s consent architecture, suggesting that its creators envisage its greatest legal traction in EU jurisdictions — at least until other legislative frameworks catch up.

3. The ‘Do Not Call’ Analogy: Private Registries and Legislative Follow-Through

   The Human Consent Registry’s trajectory may follow the pattern of the US Do Not Call Registry, established under the Telephone Consumer Protection Act. What began as a consumer preference mechanism gained binding legal force through legislative and regulatory action. The lesson is that private, norm-setting registries can be the precursor to statutory regimes — provided the political and regulatory will exists to convert soft law into hard obligation.

Implications for Practice: What Clients Need to Know

1. For Rights-Holders: Individuals and Public Figures

   Individuals — whether or not they qualify as celebrities under existing jurisprudence — who are concerned about the non-consensual use of their identity by AI systems should consider the following steps under the current framework:

   Register on the Human Consent Registry: While not legally enforceable in India at present, registration creates an evidentiary record of explicit objection to AI use, which may be relevant in future litigation or regulatory proceedings. It also signals expectations to AI developers who may voluntarily honour such preferences.

   Assert rights under the DPDP Act: Where identifiable personal data (including facial images and voice recordings) is being processed by AI systems, data principals have the right under the DPDP Act to withdraw consent, request erasure, and file complaints with the Data Protection Board. These rights are immediately available and do not await legislative development.

   Document commercial value: In passing off or personality rights litigation, the commercial value of the identity in question is frequently a material consideration. Proactive documentation of endorsement history, licensing arrangements, and commercial associations strengthens the evidentiary foundation for any future claim.

2. For AI Developers and Technology Companies

   Consent frameworks for training data: AI developers processing biometric data of Indian data principals — even in the course of training models outside India — should review their consent frameworks for compliance with the DPDP Act. The Act’s extraterritorial application to processing that is “in connection with any activity related to offering goods or services to data principals within the territory of India” may engage their obligations.

   Voluntary adoption of the Registry: Proactive adoption of the Human Consent Registry’s framework — treating it as a standard of due diligence — may reduce litigation exposure and enhance reputational standing, particularly in the EU and US markets where regulatory scrutiny is more advanced.

The Legislative Imperative: What India Needs

The Human Consent Registry crystallises a regulatory gap that India’s legislative framework has not yet addressed. We submit that the following legislative developments are necessary and, given the pace of AI deployment, urgent: the

People-first (human-centric) approach

The Indian Approach to Ai is based on seven principles which largely rests on putting people first as the foundation of any model

A standalone Right of Publicity Act: Modelled on the ELVIS Act and California’s framework, such legislation should recognise personality rights as a form of intellectual property, protect all individuals (not only celebrities), provide specific remedies for AI-generated misappropriation, and create a registration mechanism with legal effect.

DPDP Act Rules — consent manager operationalisation:  The consent manager framework in a manner that can  accommodate private consent registries such as the Human Consent Registry, providing them with statutory grounding and enforceability.

AI-specific legislation: India’s current AI governance approach remains advisory and principle-based. Binding obligations on AI developers regarding identity data — including consent requirements, transparency obligations, and audit trails for training datasets — are necessary to create a coherent enforcement environment.

Conclusion

The Human Consent Registry is, as a matter of present Indian law, a significant soft-law instrument rather than an immediately enforceable legal mechanism. Its import, however, should not be underestimated. It articulates a norm — that identity is a form of intellectual property requiring consent for AI use — that is constitutionally coherent under Indian law, consistent with the DPDP Act’s consent architecture, and aligned with the direction of international regulatory development.

The doctrinal building blocks for a robust Indian framework exist: the constitutional right to privacy established in Puttaswamy; the personality rights jurisprudence developed through ICC Development, Titan Industries, and Rajinikanth; the moral rights framework anchored in Amar Nath Sehgal; and the statutory consent regime under the DPDP Act. What is absent is the legislative synthesis that would convert these dispersed protections into a coherent, accessible, and enforceable framework.

The question Cate Blanchett posed to the European Parliament — who controls your identity in the age of AI? — is equally urgent in India. The answer, under current Indian law, is: inadequately protected. The Human Consent Registry invites Indian policymakers, practitioners, and the judiciary to accelerate the answer.

[1] https://registry.rslmedia.org/

[2] 2003 SCC OnLine Del 2 : (2003) 26 PTC 245

[3] https://indiankanoon.org/doc/358048/

[4] CS(OS) No.2662/2011

[5] https://indiankanoon.org/doc/181125261/

[6] Civil Suit No.598 of 2014

[7] AIR 2018 SC (SUPP) 1841

[8] Section 3(c)(2) of the Digital Personal Data Protection Act, 2023.

[9] https://www.pib.gov.in/PressReleasePage.aspx?PRID=2228315&reg=48&lang=2

[10] 117(2005)DLT717