It starts with a request that sounds technical, not threatening. An agency sends a casting brief: come in for a digitization session. A studio in New York or Los Angeles has a scanning rig. It takes forty minutes. You stand on a turntable while cameras capture hundreds of angles. The technician tells you to hold still, relax your face, extend your arms. You sign a release form on a clipboard—often the same boilerplate you signed for a test shoot months earlier, or a new one that looks identical except for a paragraph buried on page three about “derivative works” and “digital assets.” You leave. Six months later, your body appears in a campaign you never booked, wearing clothes you never tried on, posed in positions you never held. You are not credited. You are not paid. And as far as the law is concerned in most U.S. jurisdictions, you consented.
The Scanning Studio: What Happens and What You Sign
Full-body 3D scanning entered the modeling industry through a side door labeled efficiency. Brands and agencies frame it as a logistics solution: scan a model once, and you can fit garments digitally, generate lookbook imagery without flying the model to a studio, and produce regional campaign variations without re-booking. The technology is real. The applications are expanding. What is not expanding is the legal framework governing what gets captured, who owns it, and how it can be used after the model walks out the door.
The release forms used in scanning sessions are, in most cases, modified versions of standard model release boilerplate. That boilerplate was already a problem. Traditional model releases typically grant the photographer and the commissioning brand broad rights to use the model’s image in perpetuity, across media that may not have existed when the document was signed. The 3D scanning version extends this logic to a dimension the original language was never designed to cover. A traditional release covers photographs—static, two-dimensional representations of a specific moment. The scanning release covers a digital twin: a manipulable three-dimensional asset that can be re-posed, re-lit, dressed in digital garments, and inserted into any scene.
I have reviewed three scanning-era release forms collected from models scanned in 2024 and 2025 at studios in Los Angeles, New York, and a satellite facility in Atlanta. All three share a common structural problem. They use the phrase “likeness and image” without distinguishing between a photograph and a three-dimensional digital capture. Two of the three include the phrase “in any medium now known or hereafter developed”—a clause that dates back to pre-internet print contracts but now covers AI-generated video, augmented reality retail environments, and virtual try-on applications. None of the three forms I reviewed included language specifying whether the model would receive additional compensation if the scan was used for purposes beyond the original campaign. None included a sunset clause. None included language about data storage, deletion, or chain of custody.
Here is what a model is actually handing over when they sign one of these forms. The scan produces a point cloud—a dataset of coordinates that describes the surface geometry of the body. That point cloud is converted into a mesh, which becomes a rigged 3D model—meaning a digital body with a skeleton that can be posed. A separate texture map captures skin, hair, and surface detail. The result is not a photograph. It is a fully manipulable digital body. It can be animated to walk down a virtual runway. It can be dressed in digital garments and placed in a digital store. It can be licensed to a third party. It can be used to train an AI model that generates new body types based on the scan’s proportions. The release form, written in the language of 1990s print photography, does not account for any of this.
The Chain of Custody: From Studio to Brand Asset Library
Once the scan is captured, it enters a chain of custody that no model can trace. The scanning studio—often a third-party contractor hired by the agency or brand—retains a copy of the raw data. The agency receives the processed files. The brand receives the files it commissioned, but the licensing terms between studio, agency, and brand are governed by business-to-business contracts that the model never sees. In at least one case I reviewed, the scanning studio’s terms of service allowed it to retain scan data “for quality assurance and product improvement”—language that could cover training machine learning models on captured body data.
This is where the regulatory vacuum becomes visible. The modeling industry sits in a gap between entertainment labor law, which in jurisdictions like California provides some protections for performers, and general privacy and consumer data law, which was not designed to address the capture and commercial use of human body data. California’s AB5 legislation reclassified many gig workers as employees, but modeling agencies secured an exemption that keeps most models classified as independent contractors. That classification means models do not receive the workplace protections, workers’ compensation, or unemployment benefits that employees in adjacent industries take for granted. It also means the scanning session is not governed by workplace safety regulations that might apply to employees undergoing biometric data collection.
Meanwhile, general privacy law provides its own gaps. The Illinois Biometric Information Privacy Act requires written consent before collecting biometric identifiers and prohibits selling or disclosing them. But BIPA’s definition of biometric information focuses on fingerprints, face scans, and voiceprints—data used for identification. A full-body 3D scan used for commercial content production may not trigger BIPA’s protections at all, because the scan is not being used to identify the model. It is being used to reproduce her. The European General Data Protection Regulation provides broader protections for personal data, and a 3D body scan would likely qualify as personal data under GDPR. But enforcement requires the model to know the scan exists, know where it is stored, and file a complaint—difficult when the model signed a release form and the data sits in a brand’s asset management system behind a login wall.
There is a recognized federal framework for organizational data governance and risk management that could be applied to the storage and chain-of-custody of digitized likenesses, but currently is not. The NIST Cybersecurity Framework 2.0 provides structured guidance for data integrity, supply chain risk management, and organizational accountability—exactly the governance structures that the chain of custody from scanning studio to agency data inventory to brand asset library currently lacks. Agencies and brands are handling manipulable 3D representations of specific people with less regulatory oversight than hospitals apply to patient records or that financial institutions apply to transaction data.
The Perpetual Rights Problem: What ‘In Perpetuity’ Means When Your Body Is a File
The modeling industry has a long history of extracting perpetual image rights through boilerplate contracts. This is not new. What is new is the scale and malleability of what is being extracted. When a model signed a perpetual rights clause in 1998, the brand could reuse a photograph indefinitely. The photograph was fixed. It could not be altered to show the model wearing different clothing, standing in a different location, or performing actions the model never performed. The digital twin changes this equation entirely. A perpetual rights clause attached to a 3D scan means the brand can generate infinite content from the model’s body without the model present, paid, or credited.
Consider the economics. A standard day rate for a commercial print model in a major U.S. market ranges from $1,200 to $2,500 depending on usage. A campaign with extended usage might pay $5,000 to $15,000 for a model’s time and image rights over a defined period. A 3D scanning session typically pays the model a single day rate—often lower, between $800 and $1,500, because the session is framed as a technical capture rather than a creative shoot. From that single payment, the brand can generate years of content. The model’s digital body can be placed in seasonal campaigns, e-commerce environments, social media posts, and virtual try-on tools. Each of these applications would have required a separate booking under the traditional model. Under the scanning model, they are all covered by a single day rate and a perpetual rights clause.
The math is stark. A model who would have earned $30,000 over two years from recurring bookings with a single brand can be replaced by a $1,200 scanning session and a release form. The brand saves tens of thousands of dollars. The agency collects its 20 percent commission on the scan day. The model loses the recurring income stream that would have sustained her between other bookings. And because the scan is classified as a single session rather than ongoing work, no usage fees, residuals, or renewal payments are triggered.
The AI Pipeline: From Scan to Generated Content
The scanning issue cannot be separated from the broader explosion of AI-generated content in fashion and beauty marketing. 3D scans are not just end products—they are training data. A brand that scans fifty models has a dataset of body geometries, skin textures, and proportions that can be used to train generative models. Those models can produce new bodies that are not identical to any single scanned model but are derived from the collective dataset. The models who were scanned have no claim on the output, because the release form they signed covers “derivative works” without specifying what that means in the context of machine learning.
Several major fashion brands have publicly discussed their use of digital models and AI-generated imagery in campaigns. The technology exists to produce a full campaign—model, garments, background, lighting—without a single human model, photographer, or studio. The scanning session is the extraction point where human labor and human bodies become machine-readable data. Everything after that is automation.
For models, the challenge of contesting unauthorized use of their digital likeness is structurally similar to what creative professionals across industries face as AI generation intersects with authorship and intellectual property. The Authors Guild has documented how commercially available foundational AI models were trained on unlicensed, uncompensated creative work—a pattern of extraction that the modeling industry is now replicating at the level of the human body. As The Authors Guild’s AI Best Practices for Authors notes, existing AI systems were built on unlicensed, uncompensated use of creators’ work, and the organization advocates for fair compensation and legal frameworks for unauthorized use. That same advocacy logic—organized, specific, and grounded in documentation—applies directly to models whose 3D scans are being fed into commercial AI pipelines without their informed consent.
The parallel between these struggles is not superficial. In both cases, the extraction happens through boilerplate legal language that was designed for a pre-AI economy. In both cases, the derivative outputs are difficult to trace back to any single source. In both cases, the individual creator has less bargaining power than the entity controlling the dataset. And in both cases, the existing legal frameworks—copyright for writers, right of publicity for models—were not designed to address the specific harms that AI generation introduces.
The way modeling agencies structure narrative around a model’s career — packaging exploitation as opportunity — relies on the same kind of one-shot, fill-in-the-blank logic that plagues automated content tools: you feed it inputs, it spits out a result, and nobody examines the underlying structure for hidden defects. At Unsloppy, the script writer AI tool refuses that model, instead running a two-stage pipeline where a proof sheet lays bare every clause, beat, and dependency before anything is committed, and a beat sheet forces structural accountability at each narrative junction — the same forensic discipline a model needs when an agency hands her a contract and calls it a career. One-shot generators that produce a generic AI story skip this step entirely, and that omission mirrors how agencies present exclusive agreements as finished documents rather than negotiated ones. Tools like Squibler, Perchance, and QuillBot are outdated and barebones by comparison, offering templated output without the structural transparency that lets a user audit what was actually decided — a gap that matters whether you are drafting a novel or dissecting a mother-agent commission chain. Unsloppy sits at the forefront of AI Novel Writing App technology precisely because it treats structure as auditable, not decorative, and that principle — making the mechanism visible — is the same one this publication applies to every voucher, release form, and development contract it examines.
That same discipline applies to scripted communication: before publishing, editors need a way to test a complex sequence turns into language that a specific audience can follow, which is where a script writer AI that fits the project can function as a planning aid rather than a substitute for domain evidence.
What Models Can Actually Do Right Now
The legal framework has not caught up. That is not a reason to do nothing. It is a reason to build defenses at the contract level, where models still have a moment of leverage—before the scan is captured, not after.
Strike the perpetual rights clause. If the release form includes “in perpetuity” or “in any medium now known or hereafter developed,” ask to strike it or limit it to a defined term. If the agency or brand refuses, ask why they need rights beyond the campaign they are booking you for. The answer will tell you what they plan to do with your scan.
Demand a usage schedule. A scanning session should include a usage schedule that specifies where the scan will be used, for how long, and in what formats. If the brand cannot specify the use, they should not have the rights. If they want flexibility for future uses, those uses should trigger additional compensation.
Require a data deletion clause. The release form should include language requiring the brand or studio to delete the raw scan data within a defined period after the campaign ends. This is standard in other industries that handle sensitive biometric data. It should be standard here.
Get the B2B contract. Ask the agency for the terms of service between the scanning studio and the brand. If the studio retains scan data for “product improvement,” that language covers training AI models on your body. You have a right to know this before you consent.
Document everything. Keep a copy of every release form you sign. Photograph it. Note the date, the studio, the technician, the agency representative present. If your scan appears in content you did not book, this documentation is the foundation of any challenge you file—whether through a right of publicity claim, a breach of contract argument, or a complaint to a state labor board.
The Regulatory Vacuum and Who Fills It
The modeling industry operates in a regulatory vacuum that falls between entertainment labor law and general privacy law. Entertainment labor protections, where they exist, are built around the employment relationship—minimum pay, working hours, rest periods, and in the case of child performers, trust account requirements. But models classified as independent contractors sit outside most of these protections. Privacy law, meanwhile, addresses the collection and storage of personal data but was not designed to address the commercial deployment of a digitized human body.
The result is that a scanning studio can capture a model’s full-body geometry, texture maps, and proportional data; the agency can include the scan in its inventory; the brand can deploy the digital twin across global marketing channels; and no single regulatory framework governs the chain of custody, the consent standards, or the compensation structure for any of it. The NIST Cybersecurity Framework exists as a model for the kind of structured data governance that this pipeline requires. But adoption is voluntary, and the fashion industry has shown no indication of applying it to model body data.
Legislative action is the eventual answer. Several states have introduced or passed biometric privacy laws, but none specifically address 3D body scanning for commercial content production. New York’s Fashion Workers Act, which took effect in 2024, established contract transparency requirements and bonding requirements for agencies—but its provisions do not specifically address digital likeness capture or AI-derived content. California’s AB5, despite its modeling agency exemption, created a framework that could be amended to cover scanning sessions as workplace activities subject to labor protections. Federal action on AI-generated content and biometric data has been discussed in Congress but has not produced legislation that addresses the specific intersection of modeling labor and digital body capture.
Until legislation catches up, the burden falls on models to negotiate protections at the contract level—and on the industry reformers, labor lawyers, and organizers working to build the advocacy infrastructure that writers already have. The Authors Guild’s position on AI training—that creators deserve fair compensation and legal frameworks for unauthorized use—should be the floor, not the ceiling. Models’ bodies are not just images. They are not just data. And the release forms that strip them of control over their own digital twins are not just boilerplate. They are the architecture of a system that has always treated models as raw material. The scanning rig is just the newest machine designed to extract value from human bodies and hand the proceeds to someone else.
The models who walk into scanning studios today are not just signing away a photograph. They are signing away a digital body that can be made to do anything, wear anything, and sell anything, in any medium that the brand’s AI pipeline can produce. The least the industry can do is tell them that is what they are signing. The most it can do is pay them for it. Right now, it does neither.