Meta Turned On a Deepfake Feature for Millions of Instagram Users. They Had to Turn It Off Themselves.

Key points

• Meta launched an AI feature in early July 2025 that let anyone generate images using public Instagram accounts' likenesses, and switched it on for all users automatically.
• After three days of public outcry, Meta pulled the feature back and admitted it "missed the mark".
• Privacy researchers say most users never change a default setting, meaning opt-out systems quietly enrol millions of people in tools they never chose.
• The European Union's GDPR privacy law requires companies to pre-select the most privacy-friendly option by default, a standard that does not exist in US federal law.
• Consumer advocates say the US now needs federal privacy legislation to stop companies from making these choices on behalf of their users.

Earlier this month, Meta, the company that owns Facebook and Instagram, quietly switched on a new AI feature across its platforms. Anyone could tag a public Instagram account and use Meta's AI chatbot to generate images of that person. A deepfake tool, in effect, the kind of software that creates fake images of real people, turned on by default for millions of accounts.

Users had to find the setting and switch it off themselves. Many had no idea it existed.

Creators moved fast. Videos explaining how to opt out went viral almost immediately. One from creator Sam Sooin Yang drew more than three million views. "They should have given you the option to opt in rather than opt out," Yang said. "I am really getting tired of these companies pushing this AI stuff on us when we don't want to use it."

Three days after launch, Meta reversed course. The company said in a statement that the feature "missed the mark" and switched it off.

That speed surprised even privacy advocates. Thorin Klosowski, a senior privacy activist at the Electronic Frontier Foundation, a digital rights group, called it "a clear and immediate pushback." He added: "Honestly, it was great to see how quickly that happened."

But the episode points to a wider pattern, not just a single misstep.

Google recently added an "Ask Gemini" bar, a prompt inviting users to chat with its AI assistant, directly inside Google Docs, the popular word-processing tool, without asking first. LinkedIn and Dropbox have made similar moves in recent years. Each time, users who notice have to go hunting through settings menus to undo a choice the company already made for them.

Why does it matter who picks the default?

Because almost nobody changes it. Woodrow Hartzog, a professor at Boston University's law school, puts it plainly: "People tend to stick with whatever the default option is. So if the default option is that you're enrolled, you're probably going to stay enrolled."

The European Union handles this differently. Its privacy law, known as the GDPR (General Data Protection Regulation), requires companies to build systems that collect only the data they genuinely need. If one option is more private than another, the more private one must be the default. Users choose to share more; they do not have to fight to share less.

The United States has no equivalent federal rule. Some states, California and Maryland among them, have passed their own protections, but the patchwork leaves most Americans dependent on company goodwill.

Ben Winters, director of AI and privacy at the Consumer Federation of America, a consumer advocacy organisation, says federal action is overdue. "It is the perfect recipe for something that needs federal government intervention. That's what legislatures and governments are there for: to protect people where they are unable to protect themselves."

For ordinary users, the practical upshot is straightforward. Check the privacy settings on any platform that recently added an AI feature. Look specifically for options labelled "enhanced", "personalised", or anything that references AI training or image generation. If you did not switch it on, it may still be on.