Consent is a machine, not a signature
Everyone pictures consent as a moment: a person says yes, a form is signed, the matter is settled. That is not what any of these three vendors built. They built machinery - a capture step, a matching step, a set of content prohibitions, a removal route, a retention rule and a deletion policy - and each vendor built each part differently. Tonight you read the machine, part by part, and find the parts that are missing at all three.
★ What you walk out with tonight. The eleven-row comparison of what each vendor actually does, quoted from their own pages. The single sharpest contrast in the whole category, which is that the strongest written right sits behind the weakest gate. And a written answer to the leaver question, which is the one thing you cannot buy from any of them.
The strongest written right, behind the weakest gate
9 min liveAll three vendors capture consent. They capture it very differently, and the differences are the lesson. If you take one image away from this course, take this one, because it is the reason "which vendor is safest" has no single answer.
LiveThe whole machinery, side by side6 min▶
Eleven rows, three vendors, read from their own policy pages rather than their marketing. Nothing here is inferred. Where a row says a thing is absent, that absence was checked for.
| What the machine does | HeyGen | Synthesia | D-ID |
|---|---|---|---|
| Consent video upload allowed | Yes, file or Google Drive link | No, live capture only | No, live capture only |
| Liveness challenge | Code sometimes | Passcode read aloud | Dynamic passcode |
| Voice match | Not stated | Face and voice properties | Face and voice, named third-party tool |
| Public-figure ban written down | Yes, explicit | Via publicity-rights clause | Absent |
| Under-18 depiction | Flat ban | Exploitation framing | Exploitation only |
| Political content | Banned outright | Gated by plan and consent | Not addressed |
| Medical claims | Not addressed | Gated for stock avatars | Explicitly banned |
| Depicted person can demand removal | Yes, named channel | Stock actors yes; custom via the customer | No mechanism published |
| Dedicated biometric notice | Yes, detailed | Inside the privacy policy | None |
| Leaver policy | None | Published and specific | None |
Run your eye down the HeyGen column. It has the most protections written down of the three: an explicit public-figure ban, a flat ban on depicting under-18s, an outright political ban, a detailed biometric notice, and a named channel for the depicted person. On paper it is the strictest vendor in the category.
Now look at the first row again. It is also the only one of the three that will accept a file you uploaded as the consent video. Every protection in that column sits behind a door that opens to a Google Drive link.
LiveThe removal right, quoted in full, because the second sentence is the one that matters4 min▶
HeyGen is the only one of the three that writes the removal right down. Here it is verbatim, from a moderation policy effective 25 July 2024:
Most people read the first sentence and stop. The second sentence is the operative one, and it points at you. The vendor undertakes to remove the likeness from its own services. Everything you published elsewhere - your website, your intranet, YouTube, a partner's onboarding portal, an embed in a slide deck someone downloaded - is your obligation to chase, by name, in a policy you have probably never opened.
The practical consequence. "We use HeyGen, and HeyGen honours removal requests" is not a plan. The clause makes the customer responsible for honouring the request wherever they published. So the real question is whether you have an inventory of where your avatar videos are, and a route to pull each of them. If you cannot list them, you cannot honour the clause you already agreed to.
Self-studyGated, banned, or not addressed - three different words with three different consequences4 min▶
The content rows in that table are worth reading slowly, because the vendors are not disagreeing about ethics. They are disagreeing about mechanism, and the mechanism decides what happens to you.
Synthesia gates political use rather than banning it. Using a stock avatar:
requires written consent from Synthesia, and for a custom avatar it is permitted "only on certain Services plans and with appropriate consent from the individual." That is a gate, not a wall. HeyGen simply bans political content outright. D-ID does not address it at all, which is the worst of the three positions to be relying on, because an unaddressed use is not a permitted use, it is an unresolved one.
D-ID uniquely bans medical claims outright. Its end user licence prohibits content that "provides medical advice and/or medical results interpretation", a clause neither competitor has. If you work in health, that single row may decide your vendor.
D-ID's ethics page is worth reading as a writing exercise. It is hedged throughout: "do our best", "work to ensure", "strive to ensure". Those are aspirational verbs. They create no obligation and no remedy. The EULA clause banning medical claims is contractual and enforceable. The ethics page is neither. When you are assessing a vendor, the question is never what the ethics page says, it is which document the sentence lives in.
The question nobody asks until it is too late
7 min liveSomebody consented. They worked here for two years. Their face fronts eleven onboarding videos and a compliance module. Today they resigned. What happens? Two of the three vendors publish nothing at all. The one that does publish an answer gives an answer almost nobody anticipates.
LiveTwo sentences from the same vendor, and you have to read them together5 min▶
Synthesia publishes what happens when a workspace member's account is deleted. Neither sentence below is alarming on its own. Together they are the whole problem.
So: the leaver's avatar does not transfer to the employer, but every video already made with their face does, and the links keep working.
Read that against what most organisations assume. They assume the opposite on both counts. They assume the company keeps the avatar, because the company paid for it. And they assume the videos become dormant, because the person is gone. Neither is true. You lose the asset you wanted to keep, and you keep the asset you needed a decision about.
And the person is not asked. Synthesia's off-boarding guidance adds that support will migrate a departed person's content on written authorisation from "the contract signee, a C-level executive, or the head of procurement". Three named roles, none of them the individual whose face is in the videos. Their consent opened the door. Their departure does not close it, and their signature is not required to move what they made.
LiveRevocation has a hard ceiling, even for the professionals3 min▶
If you assume the leaver problem is a quirk of employment, look at what happens with the professional stock actors, who have contracts, agents and an explicit opt-out route. When a Synthesia stock avatar or voice is retired:
Opting out stops future generation. It does not retract what already exists. That is the honest shape of every withdrawal right on offer here. It is forward-looking. It is not a recall.
Which means the sentence you say to someone before they consent has to be accurate about that. Not "you can withdraw at any time", which is what people hear and what makes them comfortable saying yes. The accurate sentence is: you can stop us making new ones, and everything already made stays made. If that sentence would change their answer, they were not properly consenting to begin with.
That is the only consent script any of the three vendors publishes, and it takes under ten seconds to read. Consent is not failing here for want of time. It is failing because most organisations never write the sentences at all.
Four questions the paperwork does not answer
4 min liveThese are not gaps in the research. They were looked for, at all three vendors, and they are not there. Name them explicitly, because a learner who is not told will assume the answers exist somewhere and that someone else has read them.
Self-studyThe four absences, one at a time4 min▶
- No vendor publishes a consent expiry or a re-consent cadence. D-ID states its consent recording can be reused for future avatars. One recording, unlimited future avatars, no re-affirmation at any point. A yes given in year one still authorises an avatar built in year four, and nobody is required to ask again.
- No vendor except Synthesia says what happens to already-published video when consent is revoked, and Synthesia's answer is that it stays up. Silence from the other two is not a softer answer. It is no answer, which in practice resolves the same way.
- D-ID publishes no biometric notice at all, despite running face and voice matching through a named third party. That is the one row in the whole comparison where a vendor is doing more biometric processing than its competitors and documenting less of it.
- HeyGen's moderation policy has not been revised since July 2024 and Synthesia's acceptable use policy not since February 2024. Both predate the EU AI Act transparency obligations that Synthesia's own current terms now reference. Treat every vendor policy as a dated snapshot and record the date you read it, because a policy is only evidence of what was true on the day you looked.
Self-studyA legal position stated as a fact, which is worth a slow read3 min▶
HeyGen's biometric privacy notice, updated 5 May 2026, contains this:
That is HeyGen's stated legal position. It is not settled law, and this course will not pretend otherwise. It is a coherent argument and it may well prevail. It is also enormously convenient for the party making it, because if it holds, then the moment a face has been absorbed into a trained model, the deletion right that applies to personal data stops applying to that copy of the face.
How to use this in a procurement conversation. Do not argue about whether the position is correct, because you will not settle that and neither will your counsel in the time available. Ask the narrower question instead: what does your deletion process actually delete, and what does it leave in the weights? The answer to that is factual, it is answerable, and it tells you what a deletion request from your leaver will actually achieve.
Write the clause no vendor will write for you
★ 18 min · everyone writesYou now know the four absences. This is where you close them, in your own paperwork, in language a departing employee could read and understand. Drag the wipe below to see the difference between a clause that sounds careful and a clause that actually decides something.
"The Company will handle any avatar or likeness materials appropriately following the end of your employment, in line with applicable data protection law and our vendor's policies."
Nobody can act on this. It names no outcome, no timeframe, no owner and no route. On the day the question is asked, it sends the reader back to the vendor policy, which is exactly where there is no answer.
"Within 10 working days of your last day, we will delete your avatar and request written deletion confirmation from the vendor. Videos already published stay published. Named owner: the Head of Internal Comms. You may request removal of any specific video at any time, to a named address, and we will answer within 10 working days."
Every sentence names an outcome, a clock and a person. It also admits the uncomfortable part out loud instead of leaving it to be discovered.
Write the expiry, because no vendor has one. Pick a number. Two years is defensible, three is common in the actor contracts you saw in session 1. Then write the re-consent trigger: a date, a role change, a rebrand, whichever fits. The point is not the number, it is that a consent with no end date is a consent nobody ever revisits.
Answer the published-video question in one sentence, honestly. If your answer is that published video stays up, write that. It is the truth at every vendor here, and a leaver who reads it on day one will be far less angry than one who discovers it on day four hundred.
Name the person, not the team. "The Company will" is how the first version of the clause got empty. Someone has a job title and receives the email. Write the title down.
Build the inventory now, while it is small. HeyGen's removal clause makes you responsible for pulling content "wherever you have published such depictions". You cannot pull what you cannot list. A spreadsheet of every avatar video, where it lives and who can unpublish it, is a twenty-minute job today and an impossible one in two years.
Record the date you read each vendor policy. Two of the three policies you relied on tonight were last revised in 2024. Put the read date in your own document, so that when it changes, you can tell what you actually assessed.
The framing that makes this clause easy to sell internally. This is not a legal-risk document, and pitching it that way gets it deprioritised. It is an off-boarding document. Every organisation already has one, it already has an owner, and it already covers laptops and building passes. A likeness is a company asset attached to a human being, and the reason nobody has added it is that no vendor has ever prompted anyone to.
Before session 3
35 min- Find your vendor's leaver answer, and time how long it takes. If you are on Synthesia you will find it. If you are on HeyGen or D-ID you will not, and the useful output of the exercise is knowing that in under ten minutes rather than on the day someone resigns.
- Write the expiry sentence. One sentence, with a number in it, saying when the consent you hold stops being valid and what triggers asking again. This is the absence that will bite latest and hurt most.
- Write the honest revocation sentence. Say out loud what withdrawal actually achieves: it stops new videos, it does not retract existing ones. If saying it plainly makes you uncomfortable, that discomfort is information about the arrangement, not about the sentence.
- Start the inventory. One row per published avatar video: where it is, who can unpublish it, whose face is in it. Even a partial list beats none, and it will never be shorter than it is today.
- Check one hedge. Open any vendor ethics page and mark every instance of "strive", "work to", "aim to" and "do our best". Then find one thing in the actual contract that creates an obligation. The gap between those two documents is the gap you are carrying.
Three questions
Clear all three and session 2 gets stamped in your passport.
1 · Which vendor writes the depicted person's removal right down verbatim, and how strong is that same vendor's capture gate?
That inversion is the sharpest contrast in the category. HeyGen has the most protections written down, including the removal right, the public-figure ban and a detailed biometric notice. It is also the only one that will take a file upload as the consent video, while Synthesia and D-ID both refuse uploads outright and require live webcam capture with a passcode read aloud.
2 · An employee on Synthesia resigns and their account is deleted. What actually happens to the avatar and to the videos?
Two sentences in Synthesia's own documentation, read together: videos move into a folder titled "moved content - user email" and "Share links and embeds for this content continue to work", but "Content migration only applies to videos and templates in My Videos. It does not include personal avatars." The employer loses the asset it wanted and keeps the one it needed a decision about. The migration is authorised by the contract signee, a C-level executive or the head of procurement, so the departing individual is not consulted.
3 · HeyGen's biometric notice states that biometric data irreversibly incorporated into model weights in a non-extractable form is no longer personal data under Article 4(1) GDPR. How should you treat that sentence?
It is a coherent argument and it may well prevail, but it has not been settled and it is extremely convenient for the party making it. Arguing the point is not a good use of a procurement meeting. Asking the narrower factual question is, because the answer tells you what a deletion request from your leaver will actually achieve.
What this session teaches, and where it came from
Every fact on this page, and its verification tier, is recorded in the course's source map., including a dated list of what is deliberately not stated.
Session 2 cheat sheet · pin this
Tonight the paperwork was the whole subject, and you now have a clause your vendor was never going to write. Session 3 puts a camera in front of you: what footage actually produces a usable avatar, why lip-sync fails in the specific way it does, and the four craft levers that take believability from 24 to 84 before you find the point where craft stops helping.