Virtual Try-On, AI Fit, and the Law: The New Rules of Fashion Commerce

Remember the 2015 movie The Intern, where the CEO Jules Ostin, played by Anne Hathaway, runs a company called About the Fit. The idea was that you have to make the shopping experience extremely ideal for the customer who deserves the best fit.

Well, it is 2026 now. Technology has advanced by multiple folds, and so has the waste filling the landfills and the carbon emissions circulating in the air. At the same time, fashion companies are finding their money going to waste, all because of the doom question, will this fit? A simple return made out of uncertainty is costing the industry billions, eroding margins and sending shockwaves through supply chains. In the UK alone, fashion returns cost nearly £7 billion annually. They are not always driven by defects, but by subjectivity, fit, style, hesitation. And this is exactly where upcoming technology aims to fill the gap. AI is stepping in, with platforms like True Fit and ASOS’s virtual try-on systems, targeting the issue of bracketing behaviour, where consumers order multiple sizes with the intent to return most of them. But not everything that appears to glitter turns out to be gold. For these solutions to truly work, they must operate in compliance, compliance that protects the data the consumer body feeds into these datasets. The moment a user uploads an image or feeds their measurements into a system, the transaction shifts into becoming a dataset, one that enables data capture, behavioural modelling, and predictive control. This article recognises that while technologies like virtual try-on and AI fit promise efficiency, personalisation, and clear upsides, they operate on deeply sensitive consumer data that cannot be left unrecognised or unregulated.

EU Privacy Law and AI Fashion Tech Explained

With the upcoming data protection systems, the gospel truth remains, in its very nature, the same. The principles of personal data processing, which are lawfulness, transparency, purpose limitation, and data minimisation, be it under the Fair Information Practice Principles (FIPP) or the General Data Protection Regulation, particularly Articles 5 and 6. And with this already in place, the virtual try-on and AI fit systems operate directly within this scope, as they harbour within themselves a whole ecosystem of points where your data is collected, processed, stored, and further utilised. When they collect images, infer body structures, and generate behavioural profiles, it may surreptitiously go beyond what the user provides explicitly. This also brings into ambit profiling, which is explained under Article 4(4), where personal data is used to analyse or predict behaviour, preferences, and choices. More critically, Article 22 imposes restrictions on automated decision-making that has the potential to significantly affect individuals. When AI systems recommend what to buy, filter what is visible to the customer, or enable reduced hesitation at checkout through regulated curation from profiling, it goes beyond simply assisting the consumer, and in one way or another can be argued to shape their decision-making environment. It is against this downhill assumption of what could possibly go wrong that the design and policy architecture of each platform has to go beyond making consent, as per Article 7, a simple architectural checkbox, and instead explain exactly what happens when you do, in fact, check the consent box. Transparency has to exist in the experience, so that the consumer is well aware of how the system works, the extent of inference, retention, and reuse of their data, along with the right to amend and delete their data.

Several luxury brands have already faced data breaches that expose customer profiles, purchase histories, addresses, and personal identifiers, turning the price point of aspirational consumption into vulnerability. Under the GDPR, this triggers obligations under Articles 33 and 34, requiring breach notification to supervisory authorities and affected data subjects, namely the customers who have engaged with them. Now imagine if, in any case, your data stands in jeopardy simply because you decided to virtually try on a fit, and that data is now being used and further monetised. You, as a consumer, have certain enlisted remedies under Article 82, including the right to compensation for material and non-material damage. Yet it has to be stated that the practical burden remains uneven. The consumer must recognise harm, trace it back to the documented breach, and seek enforcement, while the company retains control over disclosure timelines behind the curtain, along with the technical explanations and remediation processes. Hence, upcoming fashion tech has to take into account not just the following of the letter of the law, but also real-time awareness to customers, translated into how these systems actually operate.

AI Fashion Tech and Indian Data Protection Law

With India enthusiastically jumping on the AI opportunities-laden bandwagon, the Digital Personal Data Protection Act, 2023 positions India at an inflection point. However, it still stands yet to be critically defined when we see how rapidly India is advancing and integrating AI into every operation. The DPDP Act establishes a foundational framework built on the above-discussed gospel truth. Sections 4, 5, and 6 of the Act set out lawful processing and consent requirements, while Section 9 introduces additional safeguards for children. Once again, on paper, the structure does exist. In practice, its application to AI-driven fashion systems remains underdeveloped, with the view that Indian law does not clearly classify such inferred or biometric-adjacent data when it comes to how AI technology processes body data and images. The Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, along with the 2026 amendments, acknowledge concerns such as bias in datasets for outputs to be produced and the use of synthetically AI-created watermarks. Yet, the systems have to be made ready for ensuring cognitive autonomy in the face of predictions, nudging, and personalisation at scale. India does not need a floodgate opening of new laws, but sharper laws. Beginning with a clear classification of biometric and inferred data within AI systems, especially those using images and body mapping. Second, enforceable standards for meaningful and truly informed consent, where disclosures are integrated in a simple and experiential manner. Third, the creation of explicit accountability frameworks for algorithmic decision-making, assigning responsibility across the AI value chain. And finally, the alignment that has to be established between data protection and intellectual property regimes, so that innovation does not outpace legal clarity. India is fortunate with its current timing advantage. It can design and enforce regulation before these systems become irreversible defaults and begin to collect mass data. Hence, the question can never be whether AI will shape the future of the fashion industry, but whether the law will shape AI before it shapes the consumer.

Sources

Legal and Regulatory Frameworks General Data Protection Regulation (EU) 2016/679 EU AI Act (proposed / adopted framework) Regulation (EC) No. 6/2002 on Community Designs Deity Shoes v Mundorama Confort, Court of Justice of the European Union Digital Personal Data Protection Act, 2023 Information Technology Act, 2000 Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (including 2026 amendments) Industry and Technology Sources True Fit, Agentic AI Fit Assistant and Retail Data Insights (based on ~20 years of fit and returns data) ASOS x AIUTA, Hybrid Virtual Try-On Launch and AI Visual Infrastructure Integration AIUTA, Virtual Try-On and AI Studio for Fashion Retail Market and Industry Data UK fashion returns data, estimated ~£7 billion annually (industry reports and retail analyses) Global e-commerce trends on returns and bracketing behaviour Online fashion purchase behaviour insights (approx. 48%+ purchases initiated online) Conceptual and Policy References Fair Information Practice Principles (FIPP) Data protection principles: lawfulness, transparency, purpose limitation, data minimisation Profiling and automated decision-making under GDPR (Articles 4(4), 22) Data breach obligations under GDPR (Articles 33, 34) Compensation and remedies under GDPR (Article 82) Cultural Reference The Intern, dir. Nancy Meyers (2015)