Synthetic media consent checklist: source, person, purpose, disclosure and removal

• List every photo, video, audio file, script and reference going in.
• For each one, record creator, owner, license, release and which adaptations are permitted.
• Identify every person recognizable by face, voice, body, mannerisms, name or context.
• Note age at capture and current legal capacity.
• Keep the copyright file and the likeness, privacy and data file separate.
• Reject scraped or leaked material with no documented basis.
• Note whether each file carries metadata or hidden identifiers, and whether it may enter a hosted model.
• Note any deletion or return requirement attached to the source files.
• Do not upload identity documents, unreleased masters or third-party images just because the tool accepts them.

Source and person checks

• List each photo, video, audio, script
• Verify creator, owner, license, release
• Identify every recognizable person
• Confirm age and legal capacity
• Separate copyright from likeness and privacy
• Reject scraped or leaked material

• Name who is granting each permission and how you verified they can.
• Describe the exact synthetic change in the words a viewer would use.
• Write down the product, message, scene, script, audience, channel, dates and territory.
• Describe the setting, the level of realism, the languages and the channels before any test render.
• Stop before making even a test if that description is broader than the person expects.
• Mark whether this is paid promotion, political communication, fundraising or sales.
• Flag intimate, medical, financial, biometric, criminal, employment, religious, grief, endorsement and child-related contexts.
• Record prohibited uses and prohibited variants.

• Record service, plan, model, version, region and account owner.
• Save the terms and privacy notice you actually read, with the date.
• Ask for the vendor's data processing addendum before you upload a recognizable face or voice, and keep the signed version with the production record.
• Check input and output retention, training use, human review, vendor access and deletion.
• Restrict who can open prompt and source files.
• Review negative prompts, reference strength and personalization settings.
• Test outputs for accidental resemblance to people who never consented.
• Refuse instructions that invent sensitive facts or put words in a real person's mouth.
• Record the account controls and the deletion limit on the plan you hold.
• Note any broad license grant over inputs or outputs.

• Show the person the final media, the caption, the landing page and the claims beside it.
• Record hashes of approved files and keep rejected versions.
• Confirm edits, crops, languages, aspect ratios and audio substitutions.
• Require fresh approval for new conduct, new words, a new product or a sensitive context.
• Set an approval expiration date.
• Tie that date to the release term, so an approval cannot outlive the contract it rests on.

• Write a direct label naming the generated or altered element.
• Place it before or with first exposure.
• Test small screens, muted playback, audio-only use, crops, reposts and translations.
• Avoid vague labels such as "enhanced" when a person says or does something synthetic.
• Explain paid or sponsored relationships in their own line.
• Keep the label attached to downloadable files where the format allows.
• Record the exact label wording and its placement for each channel.
• Add machine-readable marking where the EU AI Act, a platform or a licensing deal requires it, in addition to the visible label.

• Keep source IDs, releases, approved prompts, model details, operator, edit log, disclosure and distribution list.
• Minimize location, identity-document and biometric exposure.
• State whether affiliates, licensees or viewers may remix or download.
• Block training or model reuse unless it was separately approved and supported.
• Limit access to reusable voice, face and body assets.
• Rotate keys and revoke vendor access when the project ends.

• Name the person who can pause publication and paid media, and write the stop and removal route before the first release.
• Serve a DMCA §512 notice on the host's designated agentthe contact is listed in the US Copyright Office's Designated Agent Directory — for copies of media you own.
• For non-consensual intimate imagery, use the platform's NCII report flow and a Take It Down Act request; covered platforms must remove reported material within 48 hours of a valid request.
• Register the image with a hash registryStopNCII.org for adults, NCMEC's Take It Down for anyone under 18. Re-uploads are then matched and blocked automatically.
• Send search de-indexing requests, including Google's personal content removal request for non-consensual explicit imagery, and keep platform, host, search, licensee and vendor contacts in one place.
• Use withoutmyconsent.org, the Cyber Civil Rights Initiative's removal guide and help line, for intimate-image cases.
• Set response and escalation times, and write the retention period into the release — a defined campaign term, not "indefinitely".
• Preserve correction and takedown case numbers.
• Delete expired inputs, models, outputs and working files under the retention plan.