Generative AI live: what holds up in a real brand activation

Why live is a hard environment

Six constraints that never show up in an office demo.

The practical conclusion: the winner is the model that delivers within the time your audience is willing to wait, with a rejection rate you can absorb, not the most impressive one.

The pipeline, step by step

Seven stages; if one fails, the whole experience falls over.

1. Capture. The guest's own phone camera (via QR) or a fixed camera with controlled light. Framing guides and a quality check before upload.
2. Consent. Before the photo, not after: purpose, display on a public screen, retention period and a separate box for brand communications. No acceptance, no capture.
3. Generation. One fixed, tested prompt per style, with brand references; guests pick from a few options instead of typing free text.
4. Moderation. Automated first (vendor filters plus your own), then human for anything going to a public screen. A rejection should return an alternative, not an error.
5. Display. Screen, mosaic or DOOH, with the AI-generated label visible from first exposure.
6. Print or share. Download, on-site print or email; logos, legal lines and prices are composited on top, never generated.
7. Deletion. The original selfie is deleted as soon as the result exists, and the result when the announced period ends. Keep proof of consent, not the face.

Which models to test for faces and styles

Options verified as of September 2026; none replaces your own test with real photos of your audience.

Two lessons from this table. First, the cheapest option (Nano Banana 2 Lite) takes no character references, which is exactly what a face swap needs; for identity-preserving transforms the real comparison is between Nano Banana 2, Pro and GPT Image 2.5. Second, models change fast. The original Nano Banana shuts down on October 2, 2026 and OpenAI closed the Sora API on September 24, so your pipeline must be able to switch vendors without rebuilding the experience.

For video, Veo 3.1 generates 4, 6 or 8-second clips and only allows adult people (allow_adult) in the EU, the UK, Switzerland and the Middle East and North Africa; Gemini Omni Flash cannot edit uploaded videos in the EEA, Switzerland or the UK and restricts images of minors there. Live, treat video as a deferred delivery by email, not an on-screen result.

Consent, biometric data and minors

A selfie is personal data. It becomes biometric data when processed through technical means that allow the person to be uniquely identified: GDPR recital 51 says exactly this about photographs. A face swap that extracts facial geometry or a face vector to transfer identity comes very close to that line, so our rule is to always treat it as biometric data.

European Union. GDPR Article 9 prohibits processing biometric data for the purpose of uniquely identifying a person, save for exceptions such as explicit consent (Article 9(2)(a)). Large-scale processing of these categories also requires a data protection impact assessment (Article 35). And if the experience infers emotions or categorises people by biometric traits, AI Act Article 50(3) requires informing them.

Colombia. Law 1581 of 2012 classifies biometric data as sensitive (Articles 5 and 6) and requires explicit authorization to process it, on top of prior, informed authorization you can prove (Article 9). The SIC's Circular 002 of 2024 asks for a privacy impact study before deploying high-risk AI, and fines reach 2,000 monthly minimum wages, with possible closure of operations involving sensitive data.

• Minors: our rule is to keep them out of face transforms unless a parent or legal guardian authorizes it on site. Some vendors already restrict this: Gemini Omni Flash limits images of minors in the EEA, Switzerland and the UK.
• Retention: announce short periods and enforce them with automatic deletion. Google, for example, deletes Veo videos from its servers after 2 days; your copies in galleries, CRM or screens are your responsibility.
• Transfers: if the AI vendor is outside Colombia or the EU, sign the transmission contract or the relevant clauses before the event, not after.

Brand safety and content labelling

Since August 2, 2026, AI Act Article 50 splits the work: providers must mark outputs in a machine-readable way, and whoever deploys a deepfake must disclose it. A realistic portrait of a real person, transformed and shown in public, can be a deepfake in the legal sense; if the work is evidently artistic or fictional, the duty is lighter but does not disappear.

The Commission's code of practice, finalised on June 10, 2026, spells out how: an icon or label perceivable at first exposure without any user action (for example, top right), at the start and at regular intervals in videos, and applicable offline too, meaning on your physical screens. For evidently creative works the icon may sit in notes or credits, but it must still be perceivable at first exposure. The EU published optional icons on September 24, 2026.

Technical provenance helps but is not enough on its own: images from Google's models carry SynthID and OpenAI Media Service is C2PA-certified, yet no out-of-home operator appears on the C2PA Conforming Products List as of September 2026. In France, the influencer law also requires the mention "Images virtuelles" on commercial content showing AI-generated faces or silhouettes.

What we have built at Slash

Six projects and what each one teaches about the live pipeline.

• L'Oréal Guardians: a generative AI face swap in Celebrate Consumer Care (pick a Guardian and your selfie becomes a brand avatar) and, as the centrepiece, a gigapixel Three.js mosaic where hundreds of avatars form the logo, navigable in 3D for demos and lobbies.
• Nigloland × Supersonic / L'Oréal: a Belle Époque photo souvenir in the park, with a QR journey, attraction map, in-scene selfie, email capture and AI composition in French and English, without a heavy booth.
• Peoplesnap: Slash Experience's white-label photobooth web app. The guest's phone is the activation: QR, selfie, AI editing (100+ parameters, moderation included), social sharing, print and mosaics on DOOH screens, with first-party capture into the CRM.
• Alain Afflelou · Magic Sunny: a virtual sunglasses try-on with four selfies, terms acceptance up front and a clear camera-permission screen before sharing or saving.
• Cartier · Trinity 100: a branded photobooth in premium malls, three photos for the ring's three bands, on-site print and data into the CRM; we rolled it out again in Bogotá, Panama and São Paulo.
• JCDecaux × Transmilenio: live data on more than 3,000 digital totems in Bogotá. Not generative AI, but it shows what DOOH at scale demands: an architecture that pushes content to thousands of screens with low latency.

The common pattern: the guest's phone as the entry point, consent and permissions before the camera, and a result that travels from the phone to a screen, a print or the CRM.

How to measure, and a checklist for your team

We don't publish generic conversion rates: they depend on the venue, the audience and the mechanic. Track the full funnel with your own events, from the first scan to the CRM, and compare against an activation without AI when you can.

• Participation: scans, consents, captures and approved results; the drop between steps shows where the flow breaks.
• Time: queue wait, time to result and dwell time in front of the screen.
• UGC: downloads, shares, prints and posts that mention the brand.
• CRM: sign-ups with marketing consent, separate from the photo consent.
• Quality and cost: moderation rejections, retries per image and cost per participant.

Checklist for planning an activation

1. Set the goal (data, reach or experience) and the metric that proves it.
2. Test two or three models with real photos: skin tones, ages, glasses and venue lighting.
3. Measure latency and rejections under peak conditions, not in the office.
4. Write the consent with your legal team: purpose, public screen, retention, minors and transfers.
5. Design moderation: automated filter, human review and a visual fallback.
6. Plan the AI label on screens and prints from first exposure.
7. Secure a dedicated network, a backup vendor and offline capture.
8. Schedule deletion and check after the event that it happened.