In the past two years, AI interactive camera devices have quietly become popular in major scenic spots, shopping malls and other public places, becoming a new traffic player in offline business scenarios. Not long ago, the Shanghai Huangpu District People's Procuratorate discovered during its duties that an AI interactive camera device in a park illegally saved tens of thousands of high-definition faces. What security risks are hidden in the seemingly convenient and novel AI camera device? How to determine whether similar devices are illegally collecting information?
AI camera is a device that combines artificial intelligence technology with real-time imaging functions. It uses intelligent algorithms to achieve scene recognition, image optimization and fun interaction. It is suitable for high-traffic scenes such as shopping malls and scenic spots. Its core value is to lower the threshold for professional photography, allowing ordinary users to obtain photos without complicated operations, while supporting a variety of creative gameplay to meet social sharing needs.
The reporter searched on the e-commerce platform and found that multiple manufacturers are selling similar AI camera devices, with prices ranging from 18,000 yuan to 30,000 yuan per unit. After tourists take photos, they can generate products such as newspapers, refrigerator magnets, and commemorative coins.
The reporter consulted several manufacturers as the operator of the scenic spot. The other party said that the device generally does not have user authorization. After taking a photo, the photo will be automatically stored. Another equipment operation company salesperson told reporters that the photos taken by their equipment will be automatically saved in the background, and equipment managers can also package and download the photos.
AI camera equipment hides hidden dangers of leaking facial information
An industry insider who is engaged in network security told reporters that judging whether such interactive photo-taking equipment poses privacy security risks depends on the first hand whether the user's explicit consent has been obtained when collecting facial information. As long as it is collected without personal consent, it must be collected illegally. Moreover, operators must inform users on relevant pages what the collected facial information is used for, storage time, etc. On the other hand, it depends on whether the device operator stores the user's facial information in the cloud for a long time. If the cloud does not have good security measures, the user's facial information may also be leaked.
Recently, the Shanghai Huangpu District People's Procuratorate received reports from volunteers that there was an AI interactive photo-taking device in a park that provided tourists with free photo-taking services with "future babies" and that sensitive personal information may have been illegally processed. Chen Wen, prosecutor of the hospital's Public Welfare Prosecution Office, said that this device uses an offline camera to capture faces and an online app to deeply synthesize the face. Throughout the entire process, it did not inform users or obtain separate consent, which actually violated relevant legal regulations.
The procuratorial organ immediately issued procuratorial recommendations to the competent administrative agencies, urging them to standardize the handling of personal information in the industry. Subsequently, companies added prompt notification pop-ups and AI logos to standardize personal information collection behavior. However, the problem is even more serious on the invisible storage side.
The forensic analysis report issued by the technical department of the procuratorate shows that the AI program embedded in the equipment involved has the function of taking photos and uploading them, and more than 10,000 photos taken were extracted from the relevant application folders. In these photos, there are also clear faces of passers-by. Chen Wen said that this service illegally stored a large amount of consumer facial information both locally and in the cloud. At the same time, it was discovered that the App used by consumers later bundled the service agreement with the privacy policy, and forced users to agree to the permanent storage of data, which obviously harmed the rights and interests of personal information.
According to reports, the user agreement and privacy policy provided by the equipment operating company not only did not clearly explain who was processing the information and how long it would be stored, but also secretly included overbearing clauses such as "permanent storage", "secondary use" and "unconditional appearance".
Chen Wen said that because the company itself has a strong willingness to rectify, a rectification agreement was reached through consultation, requiring the company to bear civil liability for deleting data, modifying privacy policies, adding logout functions, etc. to eliminate risks. At present, the information and pages stored in these local clouds have been rectified and improved.
AI interactive photography poses multiple privacy and security risks
Li Huaisheng, a professor at the School of Criminal Justice of China University of Political Science and Law, said that AI interactive camera devices have multiple privacy and security risks at the technical level. Users must check the box to agree to the blanket agreement before they can use it. This approach of ‘if you don’t agree, don’t let it’ is not the voluntary, explicit and separate consent required by the law. Facial information is sensitive personal information. Individual consent must be obtained before processing, following the minimum necessary principle. In principle, it is stored in the device and may not be uploaded to the Internet at will. The installation of facial recognition equipment in public places must be necessary to maintain public safety, and prominent signs must be set up. However, collection for the purpose of entertainment group photos obviously does not meet this condition.
In addition, significant signs should be added to images generated using deep synthesis technology. Violating companies must bear administrative and civil liabilities. In serious cases, they may also be guilty of criminal offenses such as infringement of citizens' personal information.
Users are reminded that the infringement of personal information is irreversible, and consumers should improve their awareness of personal information security protection.
