The user gave their picture to Meta AI in Instagram previously, and Meta AI and Instagram have the same parent company, and the user also encountered the advertisement on Instagram. This is as first party as it gets, in my Hacker News submissions. Maybe not in legal language.