Singapore proposes mandatory notification when firms use personal data for AI training

If businesses are developing a text-to-speech feature, for instance, they should tell users that their voice recordings will be used to train the AI model. Businesses should also explain that the recordings help the model recognise speech patterns.

The AI-specific notifications should also provide detailed instructions to opt out of, or withdraw consent to, personal data being used for AI training.

For instance, a social media platform developing an AI model that generates text and images could update its privacy policy with this notification: “When you interact with our AI-enabled features, the text, images and audio that you submit may be used for product improvement purposes, including the training and running of our AI models. This will enable our AI-enabled features to generate more realistic images and speech patterns.”

The social media platform could also provide more details on a webpage, via an in-platform privacy update that users can read and acknowledge, or through an e-mail with a link to opt out of AI training.

It is not clear if users need to explicitly consent to AI training, or whether letting them opt out will suffice.

It is also not clear if mandatory AI-specific notifications apply to instances when personal data is anonymised prior to being used for AI training.

It is also not clear if organisations such as banks, insurers and social media platforms are allowed to decline services to consumers if they say no to AI training.

The proposed guidelines are among the key priorities of Denise Wong, who took over as PDPC’s fifth commissioner in April 2026.

The authority was set up in January 2013 to enforce Singapore’s data protection law, investigate complaints and data breaches, and educate organisations and individuals on their rights and obligations.

During an interview with The Straits Times on June 23, Wong spoke about the need to keep Singapore’s data protection framework relevant in the age of generative AI, especially with the growing use of AI-enabled devices that collect biometric data.

For example, AI-enabled smart glasses, smartwatches and palm-scanning payment systems collect facial features, fingerprints, voice recordings and palm vein patterns, exposing users to new risks.

In particular, AI smart glasses – including Ray-Ban Meta and Oakley Meta devices – have spooked the public as people may not know if they have been secretly recorded. In Britain, a BBC investigation in January 2026 found women had been secretly filmed using Ray-Ban Meta glasses and later harassed after the videos were posted online with personal details.

They have also stoked fears of high-tech cheating, as students can effortlessly record exams in secret without anyone realising they are being watched. In South Korea, two candidates were caught using AI-powered smart glasses to cheat in English-language proficiency examinations in May 2026, prompting the authorities to ban the devices from exam halls.

The PDPC is, thus, studying whether it needs to advise companies on what is meaningful consent for the use of such AI-enabled devices. “We are thinking whether we need to be more explicit in showing what are acceptable and non-acceptable situations for using such devices,” said Wong.