Ethics in AI Forensics: Why We Don't Keep Your Data

Why privacy matters when you check a photo

The rise of AI detection tools has created a new privacy problem. People use these tools for deeply personal and sensitive reasons: checking a potential cheating partner, verifying a legal document, analyzing a private family photo, or vetting a political candidate.

The industry standard, unfortunately, is 'Data Harvesting.' Many free tools state in their Terms of Service that they own a perpetual license to any image you upload, using it to train their next generation of models. At FauxLens, we reject this model.

How we handle your files

We built FauxLens on a 'Privacy by Design' framework, and you can read more about FauxLens and our principles. Here is the technical workflow of your data:

1. TLS Encryption: Your image travels to us over an encrypted connection (HTTPS), so others on the network can't read it.
2. Ephemeral Processing: The file is handed to a worker, analysed, and deleted as soon as the scan returns. It is never written to a database, never added to a backup, and never retained after the result is sent.
3. Analysis: The scan reads the file's Content Credentials and metadata, checks for invisible AI watermarks, and has a specialist detection model score the pixels, generating a report of the findings.
4. Immediate Purge: Once the report is sent back to your browser, the file is deleted. If our servers were seized 10 seconds later, there would be no copy of your file to find.

The 'Right to be Forgotten'

We comply strictly with GDPR (Europe) and CCPA (California) regulations, but we go a step further. You don't need to ask us to delete your file, because it was never saved in the first place. The one thing that can be kept is the result: a report you choose to share holds the verdict and evidence, not your file.

The False Positive Dilemma: Responsibility in Detection

We are also transparent about the limitations of technology. No AI detector is 100% perfect. A 'False Positive' (accusing a real image of being fake) can damage a reputation, while a 'False Negative' can enable fraud. To see this on a file of your own, you can verify a photo or video in a few seconds.

Our Ethical Stance:

• Confidence Scores, Not Absolutes: Every verdict comes with a confidence score and the evidence lines behind it, such as an AI credential found in the file, a watermark detected, or the detection model's reading, so you, the human, can make the final judgment. The confidence score reflects how strongly the evidence supports the verdict; it is not a calibrated probability.
• Context Matters: We advise users never to use FauxLens as the sole evidence in legal or disciplinary actions. It is a tool for flagging suspicion, not a judge and jury.

The Consent Debate in AI Detection

When is it appropriate to run an authenticity analysis on an image? The answer depends heavily on context, and honest practitioners must be willing to draw distinctions that are uncomfortable.

Consider three scenarios. First, you receive a video clip via messaging app and want to verify whether it has been synthetically altered before sharing it further. This is the clearest legitimate use case: you are analyzing media in your own possession, for the purpose of preventing the spread of disinformation.

Second, a public figure's photograph is circulating online alongside a contested narrative, and a journalist or researcher wants to assess whether it has been manipulated. This sits in well-established legal and ethical territory. Analysis of public media for purposes of accountability journalism or fact-checking carries strong ethical grounding.

Third, and most problematic: analyzing a private individual's photograph without their knowledge or consent, particularly in interpersonal contexts. This is where detection tools can become instruments of surveillance rather than verification.

FauxLens is designed for media verification, not surveillance. Our analysis looks at where an image came from and how its pixels were made: embedded Content Credentials and metadata, invisible AI watermarks, and a detection model's reading of the pixels. We assess the image, not the identity of the subject. We do not perform facial recognition, we do not match detected faces against any database, and we do not store biometric data of any kind.

Biometric Laws and What They Mean for Users

Biometric privacy law is one of the most rapidly evolving areas of data regulation. The Illinois Biometric Information Privacy Act (BIPA) requires informed written consent before any entity collects, stores, or uses a biometric identifier, a definition that explicitly includes facial geometry. BIPA violations carry statutory damages that have produced multi-million dollar class action settlements against major technology companies.

In Europe, GDPR Article 9 classifies biometric data processed for the purpose of uniquely identifying a natural person as a "special category" of personal data, subject to the most stringent protections in the regulation.

FauxLens's architecture places it outside the scope of these regulations in a meaningful and deliberate way. We analyze image files for provenance and signs of AI generation: embedded credentials and metadata, invisible AI watermarks, and a detection model's assessment of the pixels. We do not extract, infer, or store biometric templates or facial geometry. No biometric identifier is derived from your upload.

The Creator Rights Question

When a generative AI model produces an image, that model was trained on a corpus of existing visual work, much of it created by human artists, photographers, and illustrators who did not consent to that use. The resulting image sits in contested legal territory: courts in multiple jurisdictions are actively litigating whether AI-generated outputs constitute derivative works and what remedies exist for source creators.

The Coalition for Content Provenance and Authenticity (C2PA) represents the most structured industry response to this problem. C2PA is an open standard that stores a signed record of where a picture came from inside the image or video file (provenance metadata), so its history can be checked. FauxLens reads C2PA credentials when they are present, and its pixel-level detection covers the far more common case where provenance metadata is absent or has been stripped, which describes the majority of images currently in circulation.

Responsible Use Guidelines

• Never treat a single detection result as definitive proof. Detection scores are not certainties. A 0.94 confidence score means the evidence strongly supports the verdict; it is not a calibrated probability, and it does not prove that the image is AI-generated.
• Consider the consequences of a false positive before acting on a result. The higher the stakes, the higher your evidentiary threshold should be.
• Use detection as a first-pass filter, not a final verdict. A positive detection result should prompt further investigation, not substitute for it.
• Verify through multiple independent methods for high-stakes decisions. For legal, journalistic, or institutional contexts, corroborate detection results with metadata analysis, reverse image search, and source verification.
• Understand the limitations of detection against heavily post-processed images. Saving a picture again and again, or posting it to social media, can wear down the tiny clues detectors rely on. A low-confidence result on a heavily processed image may indicate that evidence has been obscured rather than that none was present.

Conclusion

We believe that truth should not come at the cost of privacy. You should be able to verify the authenticity of the world around you without becoming a data point in someone else's experiment.