Abstract

The rapid development of photo applications based on artificial intelligence (AI) raises urgent legal questions related to user privacy, data protection, and digital consent. FotoYu, an Indonesia-based platform that enables users to purchase candid public photos of themselves through facial recognition technology, serves as a unique case study to evaluate compliance with the national legal framework. This article analyzes FotoYu’s operational model based on Law Number 11 of 2008 concerning Electronic Information and Transactions (EIT Law) and Law Number 27 of 2022 concerning Personal Data Protection (PDP Law). The main legal issues raised include the classification of biometric data, the legal basis for data processing, and the limitations of using implied consent in public spaces.
Using a normative-juridical approach, this study critiques FotoYu’s reliance on facial recognition technology (through AI RoboYu) in the absence of a clear and explicit consent mechanism. A comparative perspective from the GDPR and the practice of facial recognition use in European Union jurisdictions provides normative insights for regulating similar technologies. This analysis concludes that although FotoYu’s operations fall within a legal grey area, stricter law enforcement and clearer regulatory guidelines are required to protect user rights and prevent misuse. Recommendations include stricter obligations for data controllers, explicit consent protocols, and specific sectoral regulations for AI-based platforms.