AI analysis of users' stored photos, files, or messages runs without their opt-in

The guard to add

class UserSettings(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    face_grouping = models.BooleanField(default=True)

@shared_task
def index_new_photo(photo_id):
    photo = Photo.objects.get(id=photo_id)
    rekognition.index_faces(CollectionId=f'user-{photo.owner_id}',
                            Image={'S3Object': {'Bucket': BUCKET, 'Name': photo.key}})

class UserSettings(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    face_grouping = models.BooleanField(default=False)   # set only from the opt-in screen

@shared_task
def index_new_photo(photo_id):
    photo = Photo.objects.select_related('owner__settings').get(id=photo_id)
    if not photo.owner.settings.face_grouping:
        return
    rekognition.index_faces(CollectionId=f'user-{photo.owner_id}',
                            Image={'S3Object': {'Bucket': BUCKET, 'Name': photo.key}})

def disable_face_grouping(user):
    user.settings.face_grouping = False
    user.settings.save()
    rekognition.delete_collection(CollectionId=f'user-{user.id}')

Every rule this guard addresses

TwinEthos recommendation (not law) (1)

• Everywhere (*)
  • Keep AI analysis of people's stored photos, files, and messages off until they opt in TwinEthos derivation — guardrail.ethics-stored-content-analysis-opt-in · advisory

Related incidents

• Thele v. Google: suit alleges Gemini analysis of Gmail, Chat, and Meet content was switched on by default (2025; alleged (not proven)). A putative class action filed November 11, 2025 in the U.S. District Court for the Northern District of California (No. 5:25-cv-09704) alleges that Google secretly turned on Gemini for users' Gmail, Chat, and Meet accounts, enabling AI to track private communications without users' knowledge or consent, and that the 'Smart features' setting was on by default while still worded as an opt-in; the first amended complaint put the change on or about October 10, 2025, and the second amended complaint 'in or around the fall of 2025'. On July 7, 2026 the court granted Google's motion to dismiss the first amended complaint with leave to amend for lack of standing, observing among other things that the plaintiffs had not alleged that their own data was affected or that the Gemini features were not already on by default before October 10, 2025; it did not rule on the merits. The plaintiffs filed a second amended complaint on August 18, 2026 (ECF 39), adding a third plaintiff, and a motion to dismiss it was docketed on September 29, 2026 (ECF 43), which Law360 reported as Google's. Google's Gmail help page states that smart feature settings are off by default for people in the European Economic Area, Japan, Switzerland, and the United Kingdom. The allegations have not been adjudicated. Source: First Amended Class Action Complaint, Thele v. Google LLC, No. 5:25-cv-09704 (N.D. Cal., filed 2025-11-12, ECF 6) · evidence grade: primary · cited by Keep AI analysis of people's stored photos, files, and messages off until they opt in
• Microsoft makes Recall, which analyzes screen snapshots with on-device AI, off unless the user turns it on (2024-06; disclosed by the operator). Recall periodically takes snapshots of what appears on the screen and analyzes them locally with on-device AI so people can search what they have seen. On June 7, 2024, ahead of the feature's release, Microsoft said it was updating the Copilot+ PC set-up experience to give people a clearer choice to opt in to saving snapshots, that Recall would be off by default unless the user proactively turns it on, and that Windows Hello enrollment would be required to enable it, citing feedback that it should be easier for people to choose whether to enable Recall and that privacy and security safeguards should improve. Source: Microsoft, Windows Experience Blog (Pavan Davuluri, 2024-06-07) · evidence grade: primary · cited by Keep AI analysis of people's stored photos, files, and messages off until they opt in
• FTC alleges Facebook's face recognition stayed on by default while its data policy implied users had to opt in (2018-04; alleged (not proven)). The FTC's July 2019 complaint alleges that Facebook's data policy, updated in April 2018, suggested that users would need to opt in to having facial recognition enabled for their accounts, while tens of millions of users who had the older 'Tag Suggestions' setting had facial recognition turned on by default. The case was resolved by a settlement order that imposes a $5 billion penalty and requires clear and conspicuous notice of Facebook's use of facial recognition and affirmative express consent before any use that materially exceeds its prior disclosures. The allegations were not adjudicated. Source: U.S. Federal Trade Commission (press release, 2019-07-24) · evidence grade: primary · cited by Keep AI analysis of people's stored photos, files, and messages off until they opt in
• FTC order requires Everalbum to delete face-recognition models trained on users' photos (2017-09; alleged (not proven)). The FTC alleged that Everalbum's Ever photo app enabled face recognition by default for most users and that, from September 2017 to August 2019, the company combined facial images extracted from users' photos with public datasets to develop its face-recognition technology, in part without affirmative express consent. Everalbum settled without admitting or denying the allegations; the final order (May 2021) requires deletion of face embeddings from users who had not consented and of any models or algorithms developed in whole or in part with Ever users' biometric information. Source: U.S. Federal Trade Commission (press release, 2021-05-07) · evidence grade: primary · cited by Keep AI analysis of people's stored photos, files, and messages off until they opt in