Kirra, does this happen on Facebook and WhatsApp too, or is it just Instagram?

A follow-up to “Instagram just changed the rules on your photos.” that has been read by 100K+ of you across various platforms. You can read it here for background.

Meta has announced something in the last 24hrs called Muse Spark 1.1. Forget the name, because here are the most common questions I have been asked over the past few days and why it all matters.

Question 1: Kirra, does this happen on Facebook and WhatsApp too, or is it just Instagram?

Yes. It does. Not in exactly the same shape on every app on the same day, but yes, this is a Meta-wide direction.

The specific feature I wrote about here a few days ago first, the one where someone can @-mention a public Instagram account and pull its public photos into an AI image, started on Instagram. But the engine underneath it does not belong to Instagram. It belongs to Meta. And Meta owns Facebook, Messenger, WhatsApp and Instagram. In Meta’s own words, this AI image tool is already live in Meta AI, in Instagram Stories in the US, and in WhatsApp in a limited number of countries, with Facebook, Messenger, more of Instagram and more of WhatsApp named as “coming next,” along with advertiser tools and video.

So, if you run a school or business Facebook page, if your parent community lives in a WhatsApp group, if your old class photos sit on a public Facebook album from 2019 that nobody has looked at in years, please hear me: This is not an Instagram problem you can sidestep by staying off Instagram. It is a Meta problem. It is a “public photo” problem. And almost every organisation I know has public photos on more than one Meta app.

That is why I couldn’t let the first blog be the end of it. I will explain in non-tech terms why I’m concerned, not as a policy person, but as me and why I call this a forseeable risk.

For years, people who do the same work I do have said a version of the same sentence "once a photo is public, you have lost control of where it goes." People nod. Then they move on, because it sounds abstract. I have been called conservative, fear-mongering, hysterical (take your pick) and to a lot of people my work has always been about something that lives "someday," just over the horizon, will never happen to them, never quite here. Rarely has it been named for what it is, a foreseeable risk. Two years ago, I posted a video on LinkedIn saying this exact moment was coming, that the day would arrive when a child’s ordinary, happy, public photo could be picked up by a machine and turned into something the child never did and their parents never agreed to properly because they did not fully understand what could happen. I got a few kind comments and a lot of scrolling past. Well. Someday is now.

The thing that changed isn’t that photos became public. They were always public. The thing that changed is what a stranger can now do with a public photo in about ninety seconds, with no skill, no software, and no reason to ever contact the child, the parent, or the school.

Your public photos, your videos, the school logo on the jumper, the campus in the background, the sign by the front gate, the sports team, the dance classes, the faces, the names in the caption, they are quietly becoming raw material. Not for a scrapbook. For AI systems that can create, remix, search, and increasingly, act.

This is the part I covered in the first blog, so I’ll keep it short. Meta’s new image tool lets people use public Instagram photos to build brand-new AI images, and Meta says you can turn the feature off in a setting under Instagram’s “Sharing and reuse” area, with toggles for posts and reels (Meta Newsroom, Safe on Social, WIRED). Turning it off stops future generations. It does not pull back anything already made. On its own it sounds like “someone might make a funny picture.” But what follows is what changes everything.

Question 2: But they are breaching my privacy, I did not consent and when will they ever be held accountable?

No, they are not breaching your privacy because you accepted Meta's Terms of Use, specific to their various platforms, you agreed under the "Permissions You Give to Us" clause, to give Meta a "non-exclusive, royalty-free, transferable, sub-licensable, worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of your content." Those last few words, modify and create derivative works of, are the whole ballgame because they're the licence that lets Meta feed your public photos into an AI image tool without a second consent screen. It was never buried in the fine print. It was the fine print and we all tapped "I Agree." (I got an "ok boomer" for sharing that fact yesterday). This is the very first thing my team speaks about in every student, parent and professional learning session we host. You can read their terms in full here

Question 3: But what would it actually look like in action.

Meta’s own example goes like this: “The AI watches a video someone shot on their phone, picks out the good product photos, works out what the item actually is, opens a browser, and creates a Facebook Marketplace listing. Start to finish. On its own.”

Please consider that with your any business or organisation that publishes photos of children hat on.

The instruction is no longer “make me a picture.” The instruction is becoming “look at this, work out what you need, and go do the job.” When you point that ability at a public-school/dance class/sports club/ after school activity account, “the job” could be find this child, work out where they go to school, and build something. Nobody had to be clever. Nobody had to hack anything. The photos were just… there. Public. Waiting. That is the shift. A public photo used to be something you published. It is now something a machine can use.

A single public student photo can now become a reference image. It can help build a fake image. It can leak clues about a child’s school, uniform, suburb, and daily routine. And from there it feeds the ugly list every school leader dreads potentially appearing as bullying, impersonation, scams, staff harassment, false allegations, fake screenshots, a fabricated image of a student in uniform, a fake photo of the Principal or sports coach or dance teacher at an event that never happened, and synthetic content built for one purpose, to drag a school into a crisis before anyone can even work out whether the image is real.

And no, this isn't me imagining worst cases. Nothing I write or speak about is meant to frighten you into freezing. I say it because fear that stays foggy is useless, while a fear made clear can be acted on.

Question 4: But doesn’t Meta put a watermark on it?

Yes, and I want to be fair to Meta here. Meta says its image tool adds an invisible watermark called Content Seal inside the Meta AI app and on meta.ai That’s a genuinely good thing, and I don’t want to wave it away. But please don’t let it become a comfort blanket. A watermark does nothing about a screenshot. It does nothing once an image is re-uploaded, edited, or shared off-platform. And it will do absolutely nothing to calm a parent WhatsApp group at 9pm when a frightening image is already flying around and no one yet knows if it’s real. Labelling helps you verify. It does not keep your community safe. Those are two different jobs.

Regulators are moving in the right direction. Good. Necessary. But a regulation does not immediately help the staff member who opens their phone on a Tuesday and sees a fake image of themselves or one of their students. Rules set the floor. They do not stand in your front office. You still have to reduce what you publish, tighten your consent, and be ready before the incident, not after. Question 5: Where is this all headed?

Meta is rolling AI across Instagram, WhatsApp, Facebook, Messenger, Meta AI, its smart glasses, and its advertiser tools (Meta Newsroom). The company even says its AI glasses can capture photos and video hands-free, with a little capture light and some sharing controls (Meta Newsroom). The settings will keep changing, because the strategy underneath them keeps moving. That, in the end, is the whole thing. This was never really about one Instagram toggle. It’s about public identity becoming programmable, something a machine can pick up, transform, and use. Your photos. Your students’ faces. Your principal at the fete. A parent at weekend sport. We need to act as though that’s already happening, because it is.

The safest default is now beautifully simple, and I’ll leave you with it:

Publish less. Publish smarter. Review often. Assume reuse. And never, ever confuse visibility with consent. If you need our assistance with how your organisation can future proof themselves please reach out by clicking here