A free AI background remover is three questions: which model, which license, where do the pixels go

I wrote a comparison of free background removers a while ago and praised one tool for naming its model. A name is checkable, I said. Then I did the checking I had skipped: I read the model card, and I measured what a page sends. This post is that audit, with a script you can reuse.

"Free" and "AI" tell you almost nothing. Three questions do:

1. Which model runs, and what is its license?
2. Where do the pixels go?
3. Will the service still exist next month?

1. Which model, and under what license

Many "AI" background removers are a thin page around an open-weight model. The weights have their own license, separate from any code around them. From the model cards and repositories, read in Nov 2026:

Model / package	Stated license	Size / base (as stated)	Commercial use
BRIA RMBG-1.4	bria-rmbg-1.4, "source-available model for non-commercial use"	44.1M parameters; "developed on the IS-Net"; input resized to 1024×1024	"subject to a commercial agreement with BRIA"
BRIA RMBG-2.0	bria-rmbg-2.0, CC BY-NC 4.0	0.2B parameters; built on BiRefNet; 1024×1024	"subject to a commercial agreement with BRIA"
rembg (the Python tool)	MIT for the code	lists u2net, isnet, BiRefNet variants, SAM, and bria-rmbg (RMBG-2.0) as the default	its README says weights carry their own licenses, so check each; bria-rmbg "requires a paid agreement"
@imgly/background-removal (JS)	AGPL-3.0 for the library	model not named on the README page	README points to [e-mail] for other licensing; model license not stated there

The takeaway is not "avoid these". It is that "free to try in a browser" and "free to use in a product" are different grants. If you pull RMBG-1.4 or 2.0 into a commercial app, the card says you need a deal with BRIA. If you pick the AGPL JS library, the AGPL's obligations apply to what you ship. I am not a lawyer; read the license for your case.

Notice also what tools leave out. A page that says "powered by AI" and names nothing gives you nothing to check. A page that names RMBG-1.4 gives you a model card to read, including this license line. That is the honest value of naming the model.

2. Where do the pixels go: a script instead of a promise

Every vendor says "private". Your browser can tell you. I wrote a ~25-line Playwright script that opens a page, picks a file in its <input type="file">, waits, and lists every POST/PUT/PATCH with its size. If a request body is at least half the size of your image, it flags it.

// node upload-check.js <url> <image> [fileInputSelector]
const { chromium } = require('playwright');
const fs = require('fs');
(async () => {
  const [url, img, sel = 'input[type=file]'] = process.argv.slice(2);
  const size = fs.statSync(img).size;
  const browser = await chromium.launch();
  const page = await browser.newPage();
  const sent = [];
  // Blob/FormData bodies are streamed, so postData() is null for them.
  // Content-Length is the reliable size, so read that.
  page.on('request', async r => {
    if (!['POST', 'PUT', 'PATCH'].includes(r.method())) return;
    const h = await r.allHeaders();
    const b = r.postDataBuffer();
    const bytes = h['content-length'] ? +h['content-length'] : (b ? b.length : -1);
    sent.push({ method: r.method(), url: r.url(), bytes });
  });
  await page.goto(url);
  await page.setInputFiles(sel, img);
  await page.waitForTimeout(4000);            // let the tool finish
  console.log('image bytes:', size);
  for (const s of sent) {
    const verdict = s.bytes >= size * 0.5 ? 'LIKELY CONTAINS THE IMAGE' : 'small';
    console.log(s.method, s.url, s.bytes, verdict);
  }
  if (!sent.length) console.log('no request carried a body');
  await browser.close();
})();

My first version read request.postDataBuffer() and reported "no request carried a body" for an upload that was plainly happening. Playwright does not expose streamed Blob and FormData bodies that way. Reading Content-Length fixed it, and that is the kind of bug that makes a "privacy checker" lie in the comfortable direction.

I validated the script on three tiny pages of my own on localhost, using one 535 KB JPEG. These are mocks, not any vendor's site:

Mock page	Request	Bytes	Verdict
A: fetch with the file as body	POST /upload	534,844	likely contains the image
B: FormData (multipart)	POST /api	535,034	likely contains the image
C: processes locally, sends a small ping	POST /analytics	10	small

Limits you should know before trusting a green result:

• A page could send a heavily downscaled or cropped copy. My 50% rule would miss it.
• A chunked upload has no Content-Length, so the script prints -1. Treat -1 as "look manually".
• WebSocket traffic and sendBeacon are not covered.
• A model that runs locally still downloads from somewhere; a 40 MB model file is a GET, not a POST, so it will not show here. The first run being slower is normal for that design.

I did not run this against any vendor's website for this post. The script is a tool for you, on your own images; run it yourself and trust what you see.

3. Will the service be there

On the day I read it, remove.bg's own homepage carried a banner: background removal is moving to Canva, and "the standalone website will no longer be available from 1 December 2026 at 9:00am CET." The page did not say what happens to the API or accounts, so I won't guess. The moral is plain: a hosted service can be the right choice and still a dependency with an end date. A model you can run yourself (license permitting) does not have that problem, at the cost of the download and your own hardware.

What each service says about itself

All from the vendors' own pages, as read in Nov 2026. "Not stated" means the page I read doesn't say, not that the answer is no.

Tool	Where it processes	Retention	Limits / pricing notes	Model
remove.bg	cloud (upload)	not stated on the FAQ page; a feedback dialog says a negatively-rated image "will be used for future improvements" unless you decline	website closing 1 Dec 2026; FAQ lists up to 50 megapixels / 22 MB per image, free-tier applicability not stated	not named
Photoroom	not stated	links to its privacy policy	high-resolution export is a paid feature; "no signup required" in page metadata	not named
BgEraser	not stated ("directly in your browser", yet files are "deleted within 2 hours")	uploads and results deleted within 2 hours	batches of up to 20; "no sign-up or usage limits"; FAQ says commercial use of results is allowed if you have the rights to the original	not named
ToolTiny	the page says in the browser, via WebAssembly; "nothing is ever uploaded"	n/a (nothing uploaded, per the page)	about 40 MB model downloaded and cached on first use; "No file size limit" (in-browser, so your device's memory is the real limit; I did not test that); JPG, PNG, WebP in, transparent PNG out	RMBG-1.4 (BRIA AI), so the license above applies
ToolPix	not checked: its site blocks automated fetching	not checked	not checked	not checked

Two rows deserve a comment. BgEraser's page says you can use it "directly in your browser" and also says files are deleted within two hours; those two statements can both be true, but the page does not say where processing happens, and this is the case where the script above earns its keep. And for any tool built on RMBG-1.4, including the one in this table, "free" on the page and "non-commercial" on the model card are two different sentences; a site owner should read the second one.

A five-minute checklist

• Find the model name. No name, no checking.
• Open the model card and read the license line before a commercial use.
• Run the upload script on a throwaway photo; investigate any -1 or flagged request.
• Note any end-of-life banner or terms change, and keep an export of what you need.
• Read the privacy policy for retention, then compare it with what the network tab showed.

Limits of this post

• Vendor statements come from the pages as they read in Nov 2026 and may change; some pages were summarized by a fetch tool and I could not see their linked policies.
• I did not benchmark edge quality (hair, fur, glass) for any tool; that needs a labeled image set, and I did not make one.
• The upload check was tested on my own mock pages only.
• The license table reports what each page states; licenses of other models (U-2-Net, BiRefNet and others) were not verified here.

If you know of a tool that publishes both its model license and a verifiable no-upload design, tell me and I will add a row.