Consent-first beauty tech: a practical checklist
· 5 min read
Camera-based beauty tools process images of people's faces. Under the GDPR and similar laws, that calls for care from the first design sketch, not a banner added at the end. This checklist is not legal advice; it is what we ask ourselves on every project, before your legal team's review.
Before the camera opens
Explain in plain words what the camera is used for, where the processing happens and what is kept. Ask for an explicit action to start. Never open the camera on page load.
During processing
Prefer on-device processing when the feature allows it, as with live try-on. When an image must be sent for analysis, send it once, over an encrypted connection, and do not retain it. Do not use customer images to train models without a separate, explicit consent.
After the result
Keep history only when the person asks for it. Give them an export and a delete button that actually work. Set a retention period and enforce it automatically. Keep a record of each consent.
Finally, document every sub-processor involved — hosting, analysis provider, email — and make the list available. Trust is built on details customers can check.