YouTube Wants Your Face Scan. Its Privacy Policy Lets Google Train AI.

Close-up of a person with digital facial recognition grid lines projected onto their face in blue light — Photo via Unsplash

TL;DR: YouTube expanded its AI "likeness detection" tool to celebrities on April 21, 2026, the latest step in a rollout that started with creators in September 2025 and added politicians and journalists in March 2026. To use it, you hand Google your government ID and a face scan. YouTube generates a biometric "face template" stored on its servers and uses it to scan uploaded videos for deepfakes. YouTube says it will never use this biometric data to train AI. But Google's privacy policy says "public content, including biometric information, can be used to help train Google's AI models." Those two statements can't both be true forever. Major talent agencies CAA, UTA, and WME are already pushing clients to enroll. Nobody's talking about the biometric database this is quietly building inside Google.

Here's What You Give Google to Fight Deepfakes

The enrollment process is straightforward. You submit a government-issued ID and record a self-video of your face. YouTube converts that into a biometric "face template" (a numerical representation of your facial features) and stores it on Google's servers ^[1].

From there, the system works like Content ID for faces. YouTube scans uploaded videos against your face template. If it finds a match that appears AI-generated or manipulated, you get an alert. You can then request removal through YouTube's privacy complaint process ^[2].

Removals aren't automatic. YouTube says it evaluates context: parody, satire, and news commentary may survive a takedown request. The platform checks whether "an individual is uniquely identifiable based on their image or voice, full name, financial information, contact information" before acting ^[3].

Sounds reasonable. But zoom out and you're looking at a voluntary biometric enrollment program run by one of the world's largest advertising companies. And "voluntary" is doing a lot of heavy lifting.

Who's Already In

YouTube has been building this database in stages:

September 2025: YouTube Partner Program creators get first access ^[4]
March 2026: Expanded to government officials, journalists, and political candidates ^[2]
April 21, 2026: Celebrities, talent agencies, and management firms added ^[1]

That's a carefully constructed sequence. First the people who depend on YouTube for income. Then the people most likely to be targeted by political deepfakes in an election year. Now Hollywood.

Creative Artists Agency (CAA), United Talent Agency (UTA), and William Morris Endeavor (WME) are all backing the rollout and distributing enrollment to their client rosters ^[1]. CAA has already gone further: it built a separate database with AI developer Veritone storing clients' digital likenesses and voices, designed to control and monetize AI use of their faces ^[2].

The message to anyone in public life is clear: if you don't hand over your biometrics, you're on your own when deepfakes of you start circulating.

The Privacy Policy Says One Thing. YouTube Says Another.

Here's the part that matters.

YouTube has explicitly stated that it "never uses the biometrics and identity data it collects for the purpose of likeness protection to train its algorithms" ^[4].

Clear enough. Except Google's privacy policy says: "public content, including biometric information, can be used to help train Google's AI models and build products and features" ^[4].

CNBC reported this contradiction in December 2025. YouTube's response: it has "no plans to change the privacy policy" but is "considering ways to make the in-product language clearer" ^[4].

Translation: the verbal promise says no. The legal document says yes. And when those two conflict, the legal document wins. Every time.

YouTube could close this gap tomorrow by adding a binding contractual commitment that biometric enrollment data will never be used for AI training. It hasn't. Months after the contradiction was publicly reported, the privacy policy still contains the same language.

Google Is Building a Biometric Database. On Purpose.

Step back from the deepfake angle and consider what's actually being constructed here.

YouTube is collecting government-verified facial biometrics from creators, politicians, journalists, and now celebrities, linked to government IDs, stored on Google servers, with face templates that can match against any video uploaded to the platform.

That's a facial recognition database. A big one. Voluntarily populated by exactly the people whose identities are most valuable to identify, track, and verify.

Google already runs one of the world's largest photo libraries through Google Photos, which has long used facial recognition for grouping and search. Adding YouTube's likeness detection templates to Google's broader identity graph is a policy decision, not a technical challenge. It is the same reach toward face data that drove Meta back into facial recognition through its smart glasses.

Today this data scans for deepfakes. But databases have a way of finding new uses. Ask anyone who gave their DNA to a genealogy service that later got acquired, or anyone whose loyalty card data ended up with a data broker.

The Legislative Backdrop

YouTube and OpenAI both support the proposed NO FAKES Act, which would establish a federal right of publicity protecting individuals' voices and visual likenesses from unauthorized AI replicas ^[2].

That sounds like alignment between tech companies and creators. But the NO FAKES Act also provides a legal framework that could make tools like likeness detection the default enforcement mechanism, potentially requiring broader enrollment to exercise your rights.

If the law says you have a right to control your likeness, and the only practical way to exercise that right is through a platform-specific biometric tool, you haven't gained a right. You've gained a dependency. The tool ties identity protection to YouTube participation, with Google as the gatekeeper ^[3].

It Doesn't Work the Same Everywhere

In the US and EU, where biometric privacy laws like Illinois' BIPA and the GDPR exist, YouTube faces some constraints on how it handles this data. But the tool is rolling out globally.

In regions without strong privacy frameworks (including much of South Asia, Africa, and Latin America) the biometric data YouTube collects has fewer legal protections. Privacy researchers have flagged that "gaps in privacy and personality rights enforcement could limit the system's effectiveness" in these regions ^[3]. It could also mean the data is less protected.

The Fair Use Problem

There's another wrinkle. Likeness-based takedowns operate under privacy rules, not copyright. That means the fair use protections that shield parody, commentary, and criticism under copyright law don't automatically apply ^[3].

YouTube says it considers context before removing content. But once a powerful takedown tool exists, it gets used. Content ID was designed to protect copyright holders, but it also became a tool for suppressing criticism, striking competitor channels, and gaming the system. There's no reason to assume likeness detection will be different.

For political deepfakes specifically, the expansion to government officials and candidates in March 2026 creates a scenario where politicians could request removal of AI-generated content about them during election season. YouTube's judgment calls about what counts as "parody" become editorial decisions with political consequences.

What You Can Do

If you're considering enrolling: Read Google's actual privacy policy first, not just YouTube's marketing materials. Understand that your face template will be stored on Google's servers and matched against video content indefinitely.
If you're a creator: The deepfake threat is real. But weigh whether Google is the entity you want holding your biometric data. Look for the specific data retention and deletion policies before enrolling.
If you're not a public figure: This tool isn't available to you yet. But the infrastructure being built will shape how facial biometrics are collected and used across platforms for years to come.
Support biometric privacy laws: Illinois' BIPA remains the strongest state biometric privacy law. Push for similar legislation in your state. Federal biometric privacy protections remain almost nonexistent.

The Bottom Line

YouTube's deepfake problem is real. AI-generated face swaps are fueling scams, political misinformation, and non-consensual sexual content at scale. A detection tool that actually works would be genuinely useful.

But the solution YouTube built requires you to hand your biometric data to Google, a company whose own privacy policy reserves the right to use that data for AI training, regardless of what YouTube's communications team says in press interviews.

The question isn't whether deepfake detection is needed. It's whether the company that runs the world's largest video platform and one of the world's largest advertising businesses should also be the custodian of a growing, government-ID-verified facial biometric database. And whether "trust us" is an acceptable answer when the legal documents say something different.

Sources

Published: April 27, 2026