'My face was everywhere — and I never agreed to it': São Paulo residents speak out on duplicate image theft

Edilene Souza runs a fabric stall in the Bom Retiro garment district, where she has worked six days a week for eleven years. Last March, a customer walked in holding a phone screen showing Souza's face on a clothing advertisement for a store she had never heard of, selling blouses at R$89 apiece on a Mercado Livre storefront registered in Curitiba. She had not authorised the image. She did not know how it was obtained. Nobody from the platform had contacted her.

Souza is not alone. Across São Paulo, a growing number of residents are discovering that photographs taken from their Instagram profiles, WhatsApp groups or neighbourhood Facebook pages have been scraped, duplicated and repurposed by third-party sellers, marketing agencies and, increasingly, by automated systems that use the images to train or populate AI-generated advertising content. The problem has a bureaucratic name — unauthorised duplicate image use — but for the people living it, the experience is visceral and disorienting.

A problem without a clear address

The Programa de Defesa do Consumidor, known as Procon-SP, which operates out of offices on Rua Barra Funda in the Campos Elíseos area, registered a measurable uptick in image-related complaints during the first quarter of 2026, according to the agency's published quarterly bulletin released in May. The bulletin did not break out a specific count for duplicate image cases as a standalone category, grouping them instead under broader digital privacy violations, but consumer advocates at Instituto Alana — a São Paulo-based child rights and digital rights organisation headquartered in Pinheiros — have been tracking the issue separately and say the complaints they receive informally have roughly doubled since late 2024.

Brazil's Lei Geral de Proteção de Dados, the LGPD, which came into full enforcement force in August 2021, nominally covers unauthorised use of personal images as a form of personal data. The Autoridade Nacional de Proteção de Dados, the ANPD, is the federal body responsible for enforcement. Filing a complaint requires navigating an online portal, submitting documentation of the infringement, and waiting — sometimes months — for a response. For a market vendor in Bom Retiro or a delivery worker in Sapopemba, that process is practically inaccessible.

Rodrigo Mendes, a freelance graphic designer who works out of a shared studio on Rua dos Pinheiros, spent four weeks trying to get a duplicate of his professional headshot removed from a fintech company's LinkedIn campaign last year. The image had been lifted from his Behance portfolio. He filed with Procon-SP in November 2025 and, as of this week, had received one automated acknowledgment email.

Community networks filling the gap

In the absence of fast institutional remedies, residents have begun organising their own responses. A WhatsApp group called Imagem Roubada SP, started by a collective of photographers based in Vila Madalena, now has more than 1,400 members who share screenshots of infringing accounts, coordinate mass-reporting campaigns on Instagram and TikTok, and circulate step-by-step guides in Portuguese for filing ANPD complaints. The group is informal, has no legal standing, and its coordinators are volunteers.

The Centro de Estudos sobre Novas Tecnologias, Trabalho e Empresa — Cenetec — at the Pontifícia Universidade Católica de São Paulo on Rua Monte Alegre in Perdizes has been studying the intersection of platform labour and image rights since 2023. Researchers there have documented cases involving gig workers whose faces appeared in promotional materials for apps they drove for, without written consent ever being obtained.

For anyone who discovers their image duplicated without permission, consumer rights lawyers in São Paulo advise three immediate steps: screenshot and archive every instance of the infringing use with timestamps, file a formal complaint through the ANPD portal at gov.br/anpd, and simultaneously notify Procon-SP, which can mediate with platforms registered to operate in Brazil. Civil claims under the LGPD can seek both removal and compensation, though cases typically take twelve to eighteen months to reach resolution in the Tribunal de Justiça de São Paulo on Praça da Sé. The law exists. The machinery, residents say, moves slowly.