1. Digital twins as personal data: checking GDPR relevance
If a digital twin is generated from real image, video or 3D scan data, the GDPR is generally applicable. The depiction of an identifiable natural person constitutes personal data within the meaning of Article 4(1) GDPR. Particularly stringent requirements apply where biometric data within the meaning of Article 9(1) GDPR are extracted or processed – for example, for the purposes of facial recognition or AI training.
Such processing operations require a valid legal basis – in practice, this can generally only be achieved in a lawful manner through the explicit consent of the data subject pursuant to Article 9(2)(a) GDPR. Furthermore, the processing must comply with the principles of transparency, purpose limitation and proportionality. A company that, for example, digitises a model for a specific campaign and subsequently uses the resulting digital twin for a different purpose is acting in breach of the GDPR – with potentially significant legal consequences.
2. Right to one’s own image and general right of personality
In Germany, the Art Copyright Act (KunstUrhG) stipulates that images of a person may only be distributed or publicly displayed with the consent of the person depicted (Section 22 KunstUrhG). In the case of AI-generated digital twins, it is frequently contested whether an ‘image’ within the meaning of the Act exists at all – the decisive factor is whether a recognisable connection to the real person can be established.
In addition, affected individuals may take action against unwanted digital twins under the general right of personality (Section 823 of the German Civil Code (BGB) in conjunction with Articles 1 and 2 of the German Basic Law (GG)). This also applies to so-called ‘lookalikes’ or deepfakes, provided that the impression is created that the real person is behind the digital representation.
3. Fictional avatars: How close is too close?
An avatar that is merely ‘inspired’ by a real person does not automatically operate in a legal vacuum. The Federal Court of Justice (BGH) has established in its case law that even indirect commercial exploitation of a person’s identity – for example, by imitating their voice, appearance or silhouette – can constitute a violation of personality rights. Any company that models a digital twin resembling a celebrity and deploys it for advertising purposes must therefore anticipate claims for injunctive relief and damages.
4. International context: No global consensus
In the US, the ‘right of publicity’ grants individuals – particularly celebrities – control over the commercial use of their likeness. In California in particular, there is a growing body of case law addressing unauthorised digital twins. In the EU, the GDPR serves as the primary regulatory framework, supplemented by national provisions on the right to one’s own image and personality rights. Companies operating across jurisdictions must therefore adopt a multi-pronged compliance strategy and conduct location-specific legal assessments.
5. Legally compliant design: What companies can do
Companies working with digital twins should, in particular, implement the following measures:
- Obtain explicit, informed consent in advance – ideally in writing and specifying the particular purposes of use.
- Set out in a contract whether, to what extent and for how long a digital twin may be used – including provisions on usage rights, the right to make modifications and obligations to delete data.
- Employ technical design measures that minimise the identifiability of real individuals, for example through stylised or abstracted representations.
- Implement output filters to prevent abusive or infringing content.
- Actively monitor for infringements – particularly with regard to deepfake tools and unauthorised digital replications.
Conclusion
Digital twins of real people do not exist in a legal vacuum. Any entity that replicates faces, bodies or voices – even in stylised or AI-generated form – is entering legally sensitive territory. Companies should therefore ensure that their digital twin strategy is legally sound from the outset and treat consent, transparency and control not as an afterthought, but as a strategic imperative.
Key points in brief
- Digital twins may constitute personal data within the meaning of the GDPR and are therefore subject to its requirements.
- Even merely “similar” avatars can infringe personality rights.
- Explicit consent and clear contractual provisions provide the greatest degree of legal certainty.
