SocialGravity guides

How to check an AI likeness licence

Someone wants to run AI-generated content using a real person's face or voice. They say it is licensed. This is what to check before it ships.

1. Ask what the licence is

A signed contract binds the parties and records the terms. By itself, it may not establish that the file in front of you is the content or model covered by those terms.

A dashboard screenshot shows what a vendor's system says. It can be operationally useful, but it is still the counterparty reporting its own record.

An independently verifiable record lets your team check the signed terms, asset and output without needing the vendor to interpret the result.

2. Check the scope first

• Term. When does the licence start and end? What happens to content already published?
• Campaign and use. Does this exact campaign and claim fit the permission?
• Channels, territories and languages. Web or paid social does not automatically include TV, another country or another language.
• Signer. Did the person, or a rights holder authorized to act for them, sign?
• Exclusions. Does the licence exclude your category, claim or brand?
• Revocation and expiry. What stops immediately, what runs to term, and what must come down?

If those answers are not in the licence, cryptography cannot fill the gap.

3. Check that the evidence joins up

• Signature. A published public key should verify that the signed record has not changed.
• Agreement hash. The document you received should match the hash committed in the record.
• Asset hash and version. The licence should identify the exact face or voice asset it covers.
• Output link. A specific generated file should connect back to the applicable licence, rather than merely carrying a general synthetic-content label.
• External timestamp. An outside timestamp or public witness makes quiet back-dating harder.
• Honest failure states. A verifier must distinguish failed, passed and not-checkable claims. A tool that only shows green is decoration.

4. Run a real check

To learn what these checks can and cannot establish first, try the synthetic receipt walkthrough. It runs in your browser without an account and shows why an intact signature is not, by itself, proof of permission for your campaign.

Open the public licence record:

curl -s "https://id.socialgravity.ai/functions/v1/idl-verify?id=L55CQIONWR3"

Or run the open-source verifier locally against its pinned key:

deno run --allow-net https://raw.githubusercontent.com/socialgravity/receipts/main/verifier/verify.ts --license L55CQIONWR3

The verifier uses three outcomes. A check can pass, fail, or be reported as not checkable. That last state matters because a vendor assertion and third-party proof are not the same thing.

This licence covers SocialGravity's own founder and is not an arm's-length customer deal. Test records in the same register are permanently marked demo: true.

Source, specification and verifier: github.com/socialgravity/receipts.

Open the verifierStart a licensing request

This is not legal advice. Your counsel's questions beat this checklist.