In many cases, yes — if you agreed to it in a terms-of-service document you never read.
Whether that's legal depends on where you live, what the terms actually say, and what kind of photo is involved. In the United States, the usual legal basis is contract: the terms you accepted when you signed up count as your permission.
In the European Union and the UK, companies generally need a specific legal basis under the General Data Protection Regulation (GDPR), and "you clicked agree" is not automatically enough. So the honest answer is: it can be legal, it often is legal, but "legal" and "fine with you" are two different questions.
The mechanism behind this is worth understanding, because it explains why the same photo can be treated differently by two companies. When you upload a photo to a platform, you usually grant that platform a broad licence to use, reproduce, and modify your content. That licence is the legal hook.
A company that wants to train an image model reads that clause, decides it covers training, and proceeds. A company that wants to be safer rewrites the clause to name AI training explicitly and then emails you about it. That is why you sometimes get a notification saying "we've updated our terms" — it is often not a legal formality but the company repositioning itself before a training run.
GDPR adds a second layer: personal data needs a lawful basis, plus transparency about what you're doing with it. A photo of your face is personal data. A photo of your face plus a name is personal data that is easy to link to you, which raises the stakes.
Copyright is a third layer, and it's messier — you own the copyright in a photo you took, but the licence you granted may let the platform do a lot with it anyway.
Here is a concrete example of how this plays out in practice. Say you use Adobe Photoshop, which our AI tool database lists at $20.99 per month for the standalone app, with a Photography Plan at $9.99 per month that bundles Lightroom and Photoshop. Adobe's Firefly generative features were built with training data the company has described as licensed and public-domain material, which is a deliberate choice to reduce legal exposure.
Compare that with a platform whose terms simply say you grant a worldwide, royalty-free licence to use your content "to operate and improve the services." That phrase is broad enough that a lawyer can argue it covers model training. Nothing about the photo changed.
The difference is entirely in the paperwork. This is also why the same user can be protected in Berlin and exposed in Texas: the contract clause is identical, but the GDPR sits on top of it in one jurisdiction and not the other.
Now the limits, because this is where most explanations get dishonest. First, I can't tell you whether any specific company is currently training on your photos — that depends on terms that change, and the only reliable source is the company's own current policy page. Second, "legal" is not a single global standard.
US law leans on contract and has relatively weak federal privacy rules for this; the EU and UK lean on GDPR; and other countries are still writing their rules. Third, deleting your account rarely deletes the model. Once a model has learned from your images, there is no practical way to unlearn them, which is why opt-outs usually apply to future training rather than past runs.
Fourth, opting out is often buried in settings, and some platforms only offer it to users in certain regions — a compliance choice, not a courtesy. A useful rule of thumb: if you would not want a photo used to train a commercial model, don't upload it to a free service whose business model is unclear.
Paying for a tool doesn't automatically protect you either, but paid tools tend to have clearer terms because they have more to lose.