Imagine this: you walk into a contemporary art gallery and see a digitally rendered image of your face alongside an unsavory cast of industry compatriots, and as you get closer to your own face staring back at you like some kind of gallery mirror, you notice that the description placard has your full name on it and a little round orange sticker that seems to denote someone has paid money to enter their name into the artwork’s ownership ledger.

You might be disturbed, not only that your name and face have been used without consent, but that your inclusion in this gallery was crafted as a tacit nod to an “investment-driven” art world of which you want no part.

This speculative IRL example mirrors the emergence of “portrait piracy” in the non-fungible token (NFT) market: part identity theft, part exploitation imagery, part cryptocurrency side hustle. (NFTs are not tied to ownership of actual—digital or physical—artwork, but a receipt of the purchase of a record on a blockchain, like a notarized certificate of authenticity for digital collectables.)

Two NFT collections have demonstrated how artists seeking to monetize nonconsensual images are using them to lucrative ends. MetaDeckz and Cipher Punks were collections of unauthorized portraits and names (somewhat resembling sports trading cards) of prominent internet personalities (popular Twitch streamers and digital rights advocates, respectively) set to be offered as NFTs. In the case of the Twitch streamers, the NFT collection was based on hand-drawn sketches of video stills from streaming footage. While the Cipher Punks NFT drop was also of fan art, it turned out the collection included multiple people from the information security and digital rights spaces who had faced allegations of toxic behavior and/or gender-based abuse.

The idea that someone created a collection of marketable NFTs without having apparently done much research on the featured individuals or bothering to contact them is cringeworthy, but—even more concerning—these incidents also show how few safeguards there are in NFT marketplaces like OpenSea. Eventually, after individuals featured in the NFT drop raised objections, and after negative press stories began to circulate, both issuers apologized and took down their collection. Tellingly, it was the team behind the Cipher Punks NFT sale, and not the OpenSea marketplace, that took down the collection. Writing a Medium mea culpa post, the team took responsibility for the unauthorized images, saying “we apologize to each and every Cipher Punk for not taking consent and creating your NFTs.” But the incident remained a proof of concept for digital rights abuse and showed one of the ways the Web3 ecosystem could be used nonconsensually.

Archivists are already highlighting shortcomings of the new VC-backed Web3 ecosystem. The site web3isgoinggreat.com, for instance, humorously chronicles Web3 misfirings, such as the abuse and harassment faced by some beta testers on the new platform of one of Silicon Valley’s biggest companies. If abuse can happen in an ecosystem built around strong identity management, where interactions are based on anonymity, blockchains, and cryptocurrencies, it seems a new type of web architecture has been launched with very little recourse for victims of harassment and without regard for the harm it could bring about. Now imagine an NFT drop doxxing ex-partners, ex-colleagues, or sex workers; dead-naming prominent trans people; or shaming adult film stars by using both their stage names and real names. Someone could even mint sexual exploitation imagery of an ex-partner. Discussing worst-case scenarios and threat-mapping avenues of exploitation is vital because precedents of abuse in the digital realm abound.

The legal limits of digital imagery are heating up, and the Web3 ecosystem is challenging norms around reproduction and reproducibility. Global brands have seen NFTs issued for images of products they hold copyrights and trademarks on. This has led to two high-profile brands taking legal action against NFT minters: Hermès is suing an artist for selling an NFT based on one of the company's signature handbags and has accused the artist of “ripping off” its trademark, while Nike is suing a shoe reseller it has accused of trademark violation. These two examples show that brands may have recourse over unauthorized NFTs, but the case is not so clear for individuals who have had their portrait “pirated” as a digital asset.

The question of who “owns” the representation, reproduction, and rights of our physical likeness is complicated and depends on where you are, and even who you are. While there is a debate regarding ownership of the likeness of one’s full body, as in the case of a French doctor who prompted outcry by attempting to sell an NFT of an X-ray of a victim of the 2015 Bataclan theater siege without consent, we will focus on portraits for the time being.

Photographs are not copyrighted by default, but they gain IP protection once registered with an official copyright agency (like the US Copyright Office). If a photographer copyrights (or has a copyright application in progress) an image they took, in most cases the photographer holds the rights over that image, even if it is of you.

In recent years, this issue has received greater attention. Writing in The Cut, model Emily Ratajkowski chronicled her experience of being sued for posting her own image. Performers ranging from Ariana Granda to Dua Lipa to rapper Nas have faced legal action for posting paparazzi-snapped images of themselves on their own social media pages.

In 2021, the now adult who appeared on an iconic Nirvana album cover alleged that he had been a victim of child sexual exploitation imagery and sued for damages, saying his image had been taken without consent; his case was dismissed after defense lawyers claimed in court that the alleged victim was seeking fame.

Meanwhile, a rules change governing licensing rights for nonprofessional athletes in the US has made it possible for university sports stars to monetize their image. In Europe, the legal struggle over the “right to the protection of one’s image” has been a hot-button issue before the European Court of Human Rights for decades, though most cases have involved media portrayal of individuals, and no case law regarding digital assets like NFTs has yet emerged.

Given the lack of uniform legal, technological, social, or regulatory recourse for individuals, we need to do something, and quickly, to deal with the proliferation of unauthorized portraits. Here are a few forms of recourse that could counter the proliferation of portrait piracy.

Expand Personal Legal Protections

One solution is for people to use “publicity rights” to protect against misuse of their likeness. (The notion is sometimes dubbed ​​“personality rights” or “rights of persona.”) The International Trademark Association defines the right of publicity as IP protection that guards an individual against the commercial “misappropriation” of their likeness, name, photo/image, or any similarly identifying feature. Depending on the statutes, publicity rights may cover the commercialization of a person’s image, or even determine what privileges a rights holder or their estate may retain after death. While similar to trademarks and copyright in theory, publicity rights require the enactment of specific legislation and therefore do not have much power as a globally applicable solution in the short term. For now, the legal landscape for such rights is territorially dependent and still evolving.

In the US, there is no federal personality rights law, though states like California and New York have their own state laws. In California, a person must be “readily identifiable” in order to have personality rights that protect their image from being exploited. The New York law, which came into effect in 2021 (after advocacy by by the Screen Actors Guild) is only applicable to groups like public figures and certain professional performers.

So even in jurisdictions with some of the strongest legal protections, people need to be socially prominent to access legal recourse. Policymakers could, however, extend a right of publicity to all residents of a jurisdiction, basing new laws on the doctrine of personality rights so that anyone (not just prominent individuals and/or “public personalities”) could be covered under persona-IP protections.

Make compliance compatible around the world

When it comes to the law, where an offense occurs geographically often dictates available legal recourse. Jurisdiction-specific protections create a patchwork of legal protections to guard against an international phenomenon. But just because pirating a portrait is not a crime where someone lives doesn’t mean no harm will result.

By creating laws at different levels of governance across jurisdictions that are compatible, and even interoperable, lawmakers can make it easier for individuals, no matter who they are, to seek legal recourse if their likeness has been used in damaging ways. Both domestic and international regulatory compliance can be effective when legal norms are established and enforcement mechanisms have teeth. Multinational regulations like the GDPR have created uniform rules across Europe regarding data privacy, and laws like Germany’s NetzDB have forced platforms to adhere to specific content standards.

Technical regulation could also coincide with oversight by securities regulators and other entities. The US Securities and Exchange Commission is taking aim at digital assets, exploring how to bring them into the securities fold. China has banned cryptocurrency altogether, though token sales of NTFs—while largely rebranded as “digital collectables”—have not been banned outright as of yet. (The case of “digital collectables” within the Chinese market is interesting, as it shows that such an asset class can exist without being tied to cryptocurrencies.) In the UK, meanwhile, tax collectors have for the first time seized an NFT as part of a tax evasion case.

Regulatory solutions should be codified regionally and internationally through compatible language and legal definitions. Policy solutions like “online harms and safety” bills could be used to expand recourse to citizens and noncitizens alike.

Deduce governance lessons from social media platform regulation

OpenSea’s “fraudulent content” reporting form doesn’t cover copyright and trademark requests. For IP claims, the marketplace has a specific, offsite takedown request form. But while OpenSea has reached a critical mass within the digital collectables market now, once other NFT marketplaces gain steam, and perhaps even mint tokens on other non-Ethereum blockchains, the diffusion of the ecosystem could make it harder for an individual to claim personality rights.

Strengthening NFT market arbitration mechanisms, like making it easier for individuals to report persona-encroaching NFTs, could make it easier to flag abusive imagery (a route OpenSea has already pursued to counter spam). Nurturing coalitions of digital asset platforms to ensure that policies scale across NFT marketplaces could also reduce harm. Other solutions might include sharing collectively governed registries of blocklisted images between marketplaces (a tactic that has been used to combat sexual exploitation imagery across different social media platforms), standardizing processes to “tombstone” or delete NFTs across multiple issuing platforms, and exploring technical solutions to essentially “confiscate” and/or “impound” NFTs minted on any given blockchain that has clout within the larger ecosystem.

Better understand the technological ecosystem and which actors hold centralized power with the “decentralized” ecosystem

Despite claims of decentralization, there are still gatekeepers within the NFT ecosystem. One of the market’s first major disruptions was not due to hackers or nation-states, but rather a database error that took a large portion of the NFT market offline. A technical issue with OpenSea’s API created a widespread outage in January 2022 and impacted other services that relied on the major NFT marketplace. The database outage at OpenSea took the company’s image-loading API offline, which propagated across the ecosystem. This episode demonstrated that the Web3 ecosystem is interdependent, and not nearly as decentralized as billed, and that a database issue with a large actor like OpenSea can have a far-reaching impact.

A number of organizations are currently working on standards and protocols around issues like content authenticity, identity assurance, and cross-chain interoperability. They seek to define new NFT standards through industry standardization channels like the EIP process by which common APIs and smart contract templates on Ethereum are defined. This is not a silver bullet, as the protocols and low-level engineering behind NFTs are perhaps the most decentralized and market-driven aspect of the sector, but such standards can still have value. Adding strong identity and security features to these normative definitions would be a big step toward aligning the emerging marketplaces' interoperably around common patterns of freezability, blocklisting, authenticity, and licensing anchor points. “Our definition of what a non-fungible token is is still evolving, with multiple interesting variants gaining traction,” says Juan Caballero, standards coordinator at Centre Consortium, which works on standardization and tooling for the crypto sector. “For now, only specialists talk about NFT variants or extensions that have built-in features like licensing anchors, automatic royalty micropayments, non-transferability (AKA "soul-binding"), or decentralized storage. I'm optimistic that fit-for-purpose variants will someday replace today's general-purpose, low-security NFT, which I like to call NFT v0.9. In my opinion, we will look back on this period less as a gold rush than as a premature launch rushed by market factors.”

The flow of tokenized digital assets transcends borders; IP, money, and ownership all build toward a lucrative global network in which a new breed of blockchain-record-based digital collectables are valued at mind-numbing sums.

If a system is built without the capacity to revoke consent, has it not been hardcoded with the capacity to create victims without recourse? The lack of any semblance of local, national, or global arbitration capacity to disincentivize harmful social behavior threatening the most vulnerable doesn’t seem like something we can stand by and watch while those in power write ad hoc rules on the fly. I, for one, am not ready to sign away rights to my physical appearance so a stranger can put it online and sell it to the highest bidder. For someone to take away agency over our likenesses in a system that lacks recourse or reporting mechanisms seems reckless in the most charitable reading. Now is the time to have a societal-level discussion around a number of issues regarding the right to our own images. Portrait piracy is a violation that can lead to tangible harms and calls for an expanded discourse around the future of digital representations of the self—in life and in death. Should we really need to trademark our own face … or hold a copyright of our own photo, in order to stop others from profiting off our image?

• 📩 The latest on tech, science, and more: Get our newsletters!
• It’s like GPT-3 but for code—fun, fast, and full of flaws
• You (and the planet) really need a heat pump
• Can an online course help Big Tech find its soul?
• iPod modders give the music player new life
• NFTs don’t work the way you might think they do
• 👁️ Explore AI like never before with our new database
• 🏃🏽‍♀️ Want the best tools to get healthy? Check out our Gear team’s picks for the best fitness trackers, running gear (including shoes and socks), and best headphones