You upload a selfie, swipe through lipstick shades, pick a favorite and drop it in your cart. The try-on part takes seconds. Figuring out where that image of your face actually goes afterward can take a lot longer, and privacy law is still catching up with the virtual try-on tools now baked into beauty, eyewear and apparel shopping.
These features have spread fast as artificial intelligence has gotten better at mapping faces and bodies. Because online retailers operate across state and national borders, one try-on button can sit under overlapping privacy regimes in Illinois, the European Union and beyond.
How Illinois’ BIPA Law Applies to Virtual Try-On Tools
The Illinois Biometric Information Privacy Act, known as BIPA, is the statute that keeps coming up. It requires written consent before a company collects your biometric data. The face and fingerprint scans that unlock your phone are the everyday version of that data, and BIPA says you have to opt in before any of it is captured.
That rule is driving active litigation. An ongoing class action against MAC Cosmetics alleges the brand’s virtual try-on tool scanned users’ facial geometry to preview makeup looks without first getting written consent. MAC moved to dismiss in June 2026. The motion was denied, and the case is still open.
Estée Lauder faced a similar claim in 2024. According to Reuters, the suit accused the company of “failing to warn customers that their biometric information would be collected when they used tools on the companies’ websites that allow people to submit a photo or use a live camera feed to virtually ‘try on’ cosmetics.” A judge dismissed it because the plaintiff could not show Estée Lauder was able to identify customers from the scans.
What GDPR Requires in Europe
If you shop from Europe, the General Data Protection Regulation is your baseline. The EU law has been in force since 2018 and sets the ground rules for any company processing personal data.
Under GDPR, processing has to be lawful, fair and transparent to the person whose data is involved. Companies can collect only what is necessary for the purpose they disclosed, they must keep the data accurate, and they can hold personally identifying information only as long as that purpose requires. Security, integrity and confidentiality, often achieved through encryption, are also required. The company acting as data controller carries the burden of proving every one of those principles has been met.
How You Can Control Your Try-On Photos on ChatGPT and Google
Beyond the question of whether a company is allowed to collect your face, there is a separate question about what happens once it does. Two of the biggest names in generative AI shopping have published policies you can check yourself.
OpenAI says reference photos used for ChatGPT’s try-on feature are saved so shoppers can reuse them. “Your reference photos are saved for future try-ons, so you can reuse them without uploading them each time. You can change or remove your photos in Settings,” the company’s help page states. To manage those images, open Settings, select Personalization and then Reference photos, where each file can be replaced or deleted.
Google takes a similar approach with its own virtual try-on feature. “For convenience, your uploaded photo is saved so that you don’t have to upload it each time you want to try something on, but you can upload a new one or delete the existing photo at any time,” the company says.
Google goes further on the biometric question. “Google uses your uploaded photo to produce the generated try-on look. Google does not collect or store any biometric data during this experience, nor is your photo used for training purposes. Your photo is never shared with other Google products, services, or third-party affiliates.”
