/Passle/MediaLibrary/Images/2026-05-27-21-05-34-320-6a175c9ed53a49a947643ade.jpg)
Authors
Authors
On 9 September, a new Private Member’s Bill was introduced in Parliament aimed at online personas, or “digital twins”. The Personal Data (Digital Twins) Bill, introduced by Dame Chi Onwurah MP under the Ten Minute Rule, would regulate software and algorithms that use or hold personal data to model an individual’s preferences or behaviours. The Bill envisages digital twins taking a range of forms, from content creation algorithms and deepfakes to chatbots that reflect aspects of our personalities back at us. Impressively, the speech in support of the motion for leave to introduce the Bill also managed three references to the Pope.
Under the proposed Bill, explicit consent would be required before a digital twin could be created, otherwise prohibiting the processing of personal data for this purpose, with additional protections for children.
In her speech, Onwurah said that the Bill would require explicit consent before a digital twin could be created, effectively prohibiting the processing of personal data for that purpose without consent. It would also expressly protect children, who, she argued, cannot meaningfully consent to the creation or use of a digital twin, with parental consent unable to provide a substitute.
Most online services already build profiles to predict what users are likely to click, watch or buy. The UK GDPR treats this as profiling and already requires a lawful basis, transparency and appropriate safeguards, with additional protections for children and where solely automated decision-making produces legal or similarly significant effects.
Looking to the EU, the approach is more segmented:
- The Digital Services Act requires online platforms to explain the main parameters used by their recommender systems. Very large online platforms and very large online search engines must also offer at least one option for each recommender system that is not based on profiling.
- The EU AI Act, meanwhile, requires transparency where people interact directly with certain AI systems and requires the artificial nature of deep fakes and other AI-generated or manipulated content to be disclosed.
The EU approach therefore requires the digital twin to identify itself. The proposed UK Bill would ask whether it should have been created at all.
If the Bill’s definition extends to any algorithm that models an individual’s preferences or behaviour, an explicit consent requirement could reach well beyond recognisable digital replicas. Recommendation engines, targeted advertising, personalised feeds, fraud detection and other routine forms of profiling may all involve a model of the user in some sense. That would represent a significant departure from the existing data protection framework, under which consent is only one possible lawful basis and is not necessarily the appropriate one.
The full text of the Bill has not yet been published. Its second reading is scheduled for 13 November 2026, when some of these questions may become clearer. You can follow the Bill’s passage through Parliament here. The challenge will be drawing the boundary without turning every personalised service into a consent exercise.
Authors