Your Skin Scan Is Face Data: What 2026's AI and Privacy Rules Mean for Skin-Analysis Tools

When a shopper answers a skin quiz, you collect answers. When a shopper takes a skin scan, you collect a photo of their face, and every rule about face images starts to apply to your store, not only to the vendor behind the widget.

This post sets out what three sets of rules ask of a skin-analysis tool in late 2026, where the honest answer is still "counsel decides," and eight questions worth putting to any vendor, including us. It is a plain-language summary built from the rule texts and law-firm commentary named below. It is not legal advice.

Why a skin scan is not a quiz

A quiz answer such as "combination skin, mild breakouts" is far lower-risk text. A selfie is different in three ways. It is a face image, which the EU AI Act itself lists as an example of biometric data. It can be linked back to a person, even when the vendor never asks for a name. And it is easy to reuse: a scan taken to get a product suggestion can quietly become training data or marketing material unless someone decides otherwise on purpose.

Law-firm commentary on beauty technology keeps returning to that last point. Reed Smith, for example, gives the case of a virtual try-on that needs a face scan, where shoppers may not expect that scan to be reused for AI training or marketing. That is a secondary use problem, and it is the one to watch for in any skin-AI contract.

Three rule sets, three dates

EU AI Act, Article 50: the date that already passed

The Act's transparency duties apply from 2 August 2026. The Digital Omnibus agreement pushed the high-risk obligations back (to 2 December 2027 for standalone systems and 2 August 2028 for those built into regulated products), but law-firm alerts from Goodwin and Gibson Dunn both report that the Article 50 transparency duties were not moved.

Two parts matter to a skin tool. Article 50(1): a system meant to interact directly with people, a chatbot on a skincare store for example, must be designed so those people know it is AI, unless that is obvious to a reasonably well-informed person. Article 50(3): deployers of an emotion-recognition system or a biometric categorisation system must inform the people exposed to it. Under Article 50(5) the information has to be clear and given no later than the first interaction.

India: the DPDP dates to put in a calendar

India's Digital Personal Data Protection Rules were notified in November 2025 with a phased timeline of about 18 months. According to Mondaq's summary of the milestones, the consent-manager framework applies from 13 November 2026, and the main Data Fiduciary duties (notice, consent, security safeguards, breach notification, children's data and the person's rights) from 13 May 2027. The same summary stresses that the November date is not a requirement for every business to register as, or connect to, a consent manager.

For a brand selling to Indian shoppers, the practical reading is that the next six months are for checking whether your consent records and notices could stand up in May 2027, and whether your skin-AI vendor can supply what you would need. Face images are not named specially in the sources we found, so the general notice, consent and safeguards duties are the ones to plan around.

GDPR and the secondary-use trap

Under GDPR, biometric data counts as special-category data when it is processed to uniquely identify a person. A skin scan is normally not used to identify anyone, so it may fall outside that rule, but Mishcon's commentary on beauty technology says brands handling this kind of data need either explicit consent or another Article 9 condition, so explicit consent is the safe default where there is doubt. Whatever the legal basis, the purpose-limitation principle applies: if the shopper agreed to a skin read, using the photo to train a model or to target ads is a different purpose that needs its own decision.

Eight questions to ask any skin-AI vendor

1. Where is the photo stored, and in which country? Ask for the region, not "the cloud."
2. How long is it kept, and is the deletion automatic? A retention period that depends on someone remembering to delete is a retention period in name only.
3. Can a shopper have it deleted, and how? Ask who receives that request: you or the vendor.
4. Is the photo used to train models? If yes, ask for the separate consent step. If no, ask for that in the contract.
5. Does the shopper see a notice and give consent before the camera opens? A banner after the scan does not count.
6. Is any chatbot or assistant clearly labelled as AI? This is Article 50(1) in practice.
7. Who are the sub-processors, and what happens on a breach? Ask for notification times in writing.
8. What is claimed about accuracy, and on what evidence? Our Fitzpatrick scale explainer shows why "classifies skin type" is not an accuracy claim.

What we do, and where we are thin

Rather than score ourselves against the eight questions, here is what our own privacy policy says today. When a scan is sent with image storage on, which is how the Rupam dashboard, mobile app, Shopify widget and website embed send it, we store the original photo and the result images made from it in AWS S3 in Mumbai. Result images are deleted after 15 minutes on the Free and Starter plans, 7 days on Growth and 30 days on Professional. A scan sent without image storage is processed in memory and no photo is saved. From the analysis, we keep the overall skin score and the scan's reference number as scan history, plus a copy for up to one hour so a result can be handed over or repeated.