AI deepnudes in Spain: what they are, when they are a crime and what victims can do

A deepnude is any image in which an artificial intelligence "undresses" the photo of a real person: the nude is fake, but the person is recognisable. In Spain, fabricating a deepnude of someone and sharing it without their consent is unlawful processing of personal data, which the Spanish Data Protection Agency (AEPD) has already sanctioned, and, depending on the case, a criminal offence: against moral integrity if the victim is an adult, and child pornography if the victim is a minor.

This guide does not describe or recommend any tool: it explains the legal consequences in Spain and what to do whether you are the victim or the person reported. Our criminal defence lawyers specialised in deepfakes and artificial intelligence act on both sides. For an offence-by-offence analysis, see also the criminal defence against sexual deepfakes.

What a deepnude is and why it matters that the photo shows a real person

A deepnude is what the EU Artificial Intelligence Act calls a deep fake (Art. 3(60)): the system takes a photo of a clothed person and generates a plausible nude body that keeps their face. The body is invented, but the result still identifies a specific person, and that triggers the whole legal regime:

• The image is personal data (Art. 4(1) GDPR). Sharing a fake nude of someone without their consent is processing that data without a lawful basis (Art. 6(1) GDPR).
• Fake does not mean harmless. The image attributes to the victim a nudity that never existed and exposes them to everyone who recognises them.
• With minors, the threshold is different. The Spanish Criminal Code (Código Penal, CP) treats as child pornography realistic images (imágenes realistas) of a minor engaged in sexually explicit conduct, or of a minor's sexual organs for primarily sexual purposes (Art. 189.1 CP), without requiring the image to be authentic. For the Public Prosecutor's Office, mere nudity is not enough: the image must focus on sexual conduct or on the minor's sexual organs, and a montage so crude that it reveals itself as a montage falls outside the definition (Circular 2/2015 of the Fiscalía General del Estado).

That is why the legal question is not which tool was used, but whose image it is, what was done with it and who it was sent to.

What to do (and what not to do) if you are a deepnude victim

If you discover that a fake nude of you, or of your son or daughter, is circulating, the order of the steps matters:

1. Preserve the evidence without spreading it. Take screenshots showing the image, the profile or number that sent it, the date and the URL, and keep the complete original message or email: in one of the published files, the AEPD closed the case because neither the email nor the image was provided. Forward it only to the police or your lawyer; if the victim is a minor, forwarding it may in itself be an offence.
2. Request removal as soon as possible from the platform and through the AEPD's Priority Channel (Canal prioritario), designed for the urgent removal of sexual or violent photos, videos or audio published online without consent.
3. File a complaint (denuncia) with the National Police, the Guardia Civil, the duty court (juzgado de guardia) or the Public Prosecutor's Office (see how to report a crime in Spain step by step). It is the route that can identify the perpetrator when the AEPD cannot. If the victim is a minor, the Public Prosecutor's Office must intervene (Art. 84.2 LOPDGDD), and the court can order websites spreading the material to be taken down or blocked (Art. 189.8 CP).
4. Lodge a claim with the AEPD and consider the civil route. Both are compatible with the criminal complaint. Organic Law 1/1982 (honour, privacy and one's own image) treats the reproduction or publication of a person's image as an unlawful intrusion (Art. 7.5) and lets the victim seek an order to stop it and compensation, including non-pecuniary damage (Art. 9).

What to avoid: contacting or naming on social media the person you suspect, and paying if someone demands money or more images in exchange for not spreading the montage; that demand is itself a possible offence of threats or extortion and should be reported.

Why the AEPD treats it as unlawful processing of personal data

For the AEPD, whoever decides to send the montage determines the purposes and means of that dissemination and acts as data controller (Art. 4(7) GDPR). No company or commercial purpose is needed: in file PS/00132/2025, the controller was a minor who had taken part in the dissemination through a messaging group. Without consent or any other lawful basis under Article 6(1) GDPR, the processing is unlawful: a very serious infringement under Spain's data protection act, with a three-year limitation period (Art. 72.1 LOPDGDD).

Two qualifications:

• Mass viral spread is not required. In file PS/00274/2024, a single message sent through an instant messaging app was enough for the Agency to treat the sender as data controller, even though they claimed to have deleted the image two hours later.
• Purely household use is treated differently. In its January 2026 note on third-party images in AI systems (in Spanish), the AEPD points out that many strictly personal or household uses, with no dissemination beyond that setting, fall outside data protection law. That does not make them harmless: if the image is of a minor, merely producing it can be an offence (Art. 189.1 CP).

The AEPD also marks the limits of its own role: where there are clear signs of a crime, the investigation is a matter for the police, the Public Prosecutor's Office and the courts.

What the AEPD has decided: a fine, a reprimand and closed files

The resolutions published on aepd.es, all anonymised, show how the Agency applies this approach:

Read together, the files show that the AEPD affirms the unlawfulness of the processing, adjusts its response to the age of the person responsible and to any criminal route already followed, and needs complete evidence and an identifiable perpetrator.

Which criminal offence creating or sharing a deepnude can be

Spanish criminal law has no specific deepfake or deepnude offence today: the organic bill that would have created one lapsed unpassed on 6 October 2026, when the Cortes Generales (Spain's Parliament) were dissolved. The criminal response is built from the offences in force, depending on who the victim is and what is done with the image:

Criminal fines follow the day-fine system, with a daily amount set according to the offender's means. Three further clarifications:

• Art. 197.7 CP does not, in principle, fit. It punishes disseminating images or recordings of the victim that the offender had obtained with their consent (con su anuencia) in a home or any other place out of the sight of third parties. A nude fabricated from an ordinary photo is not an image obtained in that way, so other offences have to be considered, such as degrading treatment under Art. 173.1 CP where the dissemination seriously undermines the victim's moral integrity. Disseminating a genuine intimate image obtained in those circumstances is a different matter: that is the case Art. 197.7 covers (see non-consensual distribution of intimate images).
• Forwarding can also lead to liability. With minors, Art. 189.1 CP punishes anyone who distributes or facilitates the dissemination of the material by any means, so forwarding a classmate's deepnude to a group chat is not harmless. With adults, Art. 173.1 CP requires the victim's moral integrity to be seriously undermined.
• The age-based aggravating circumstance has a limit. For the Public Prosecutor's Office, these montages do not actually use the minor but misuse their image, so the aggravating circumstance of using minors under 16 (Art. 189.2.a CP), which requires real minors, does not apply to virtual pornography. The one for material of notable importance (notoria importancia, Art. 189.2.e CP) can apply if the material is disseminated (Circular 2/2015 of the Fiscalía General del Estado).

If the deepnude is used to demand money or more images, see sextortion: criminal defence and digital forensics and, where the victim is a minor, the legal protocol for child sextortion. If the target is a well-known person, see also criminal liability for deepfakes of public figures.

If the perpetrator is a minor: their liability and their parents'

Three of the published files involve minors as perpetrators. The response depends on age:

• Under 14. No criminal liability can be demanded: the prosecutor refers the case to the public child protection authority (Art. 3 of Organic Law 5/2000 on the criminal responsibility of minors, LORPM). The AEPD can still act, as its reprimand to a 13-year-old boy in file PA/00023/2025 shows.
• Aged 14 to 17. They answer before the juvenile justice system under Organic Law 5/2000 (Art. 1 LORPM), with measures such as supervised probation (libertad vigilada), a ban on communicating with the victim or socio-educational tasks (Art. 7 LORPM). If the offence is less serious or minor (delito menos grave or leve), the prosecutor may discontinue the case when the minor reconciles with the victim or repairs the harm (Art. 19 LORPM); in one such case, the AEPD then closed its own proceedings (PS/00274/2024).
• The parents. In juvenile proceedings they are jointly and severally liable with the minor for compensation (Art. 61.3 LORPM), and in the administrative route it was the parents, as legal representatives, who received and paid the AEPD fine.

For families who receive a summons, we have prepared a guide for parents whose child is under investigation.

If you have been reported for creating or sharing a deepnude

These facts are not treated as a digital prank, but not every image or every message is a crime either. Before making any statement, review with a lawyer:

• Authorship: who generated the image and who sent it. Shared accounts, devices used by several people and anonymous profiles require proof that goes beyond suspicion.
• Whether the conduct fits the offence: whether the image really identifies the person, whether it left the private sphere and whether the harm reaches the seriousness that Art. 173.1 CP requires.
• Digital evidence: how the screenshots were obtained and whether the integrity of the files has been preserved; a computer forensic expert report is common (see deepfakes as evidence).
• Reparation: helping to remove the content and repairing the harm before the trial can give rise to the mitigating circumstance of Art. 21.5 CP and, if the perpetrator is a minor, open the way to conciliation.

In the meantime, do not contact the victim or the witnesses, do not comment on the facts on social media and do not send the image to anyone again.

What changes with the EU rules on AI

Three pieces of EU legislation already shape this area:

• Artificial Intelligence Act, Regulation (EU) 2024/1689. Since 2 August 2026, anyone who uses an AI system that generates deep fakes in the course of a professional activity must disclose that the content is artificial (Art. 50(4)).
• Regulation (EU) 2026/1744 (the digital omnibus on AI). It adds a new prohibited practice to the AI Act (new Article 5(1), point (ba), and Article 5(1a)): placing on the market, putting into service or using AI systems that generate realistic images of the intimate parts of an identifiable person, or of that person engaged in sexually explicit activities, without their consent, where that is the system's intended purpose or a foreseeable result in the absence of reasonable safeguards. The prohibition applies from 2 December 2026, with fines of up to €35 million or 7% of worldwide annual turnover (Art. 99(3)). The ban on use applies only where the deployer uses the system for the purpose of generating such material (Art. 5(1a)(b)), and the AI Act excludes from the definition of deployer use in the course of a personal non-professional activity (Art. 3(4)). An individual who makes or shares such a montage remains answerable, in any event, under the Criminal Code and, where there is dissemination, under the GDPR.
• Directive (EU) 2024/1385 (violence against women). It requires Member States to criminalise producing or manipulating, and then making accessible to the public, material that makes a person appear to be engaged in sexually explicit activities without their consent, where this is likely to cause them serious harm (Art. 5(1)(b)). Spain has until 14 June 2027 to transpose it; a directive does not by itself create an offence that the courts can apply.

Until a law expressly criminalising these montages is published, the response rests on the Criminal Code in force, Organic Law 1/1982 and the AEPD's sanctioning powers.

At Alonso Sala we advise both victims and people under investigation for sexual deepfakes and AI-generated nudes. Call +34 91 078 65 74.