Creating an AI nude from a real photo: unlawful processing of personal data

The rise of apps that "undress" photographs using artificial intelligence has opened a legal front that reaches well beyond the right to one's own image. Spain's Data Protection Agency (AEPD) has consolidated a position whereby taking a real photo of a person, altering it with AI to show them nude and then sharing it is, in itself, processing of personal data subject to the General Data Protection Regulation. This is not an isolated statement in a single file, but a doctrine sustained across several resolutions, especially in cases involving minors.

That characterisation carries first-order practical consequences, because it turns conduct that many perceive as a technological "prank" into a punishable administrative infringement and, in parallel, a possible crime. For the victim it opens two avenues of response; for whoever creates or shares these images, it multiplies exposure. In this article we analyse the AEPD's doctrine, how it fits within the Criminal Code, and the European regulatory framework now taking shape around AI.

See also: the criminal defence against sexual deepfakes.

Why the AEPD calls it data processing

The starting point is that the image of a person who is identified or identifiable is personal data within the meaning of article 4.1 GDPR. A deepnude begins precisely with a recognisable real face onto which an AI-generated nude body is grafted; the result still identifies a specific individual, so both the raw material and the final product are personal data.

From there, the AEPD reasons that whoever decides to manipulate that image and disseminate it determines the purposes and the means of that activity and therefore acts as data controller under article 4.7 GDPR. No company or commercial purpose is required: it is enough to make the decision to process the data. And because that processing takes place without the affected person's consent and without any other lawful basis under article 6 GDPR, it is unlawful processing.

The conceptual consequence is decisive. The AEPD stresses that the problem is not only the viral spread of the images, but the unlawful processing of the image itself. In other words, the infringement is complete with the non-consensual manipulation, regardless of how many people end up seeing the result.

What has been decided: a fine in one case, dismissal in another

This doctrine is not theoretical. In a file linked to events in Almendralejo (Badajoz) in September 2023, where several adolescents generated and distributed fake nudes of female classmates who were minors, the AEPD imposed a 2,000-euro fine that was reduced to 1,200 euros following acknowledgement of responsibility and voluntary payment, with the corresponding statutory reductions. It is regarded as the first sanction by a data protection authority for sexual deepfakes.

In another file with similar facts among minors, the AEPD ordered dismissal without sanction. The reason was not that the conduct was lawful, but that the matter had already been addressed through the Juvenile Court via a conciliation agreement in which the responsible minor acknowledged the harm and apologised, an aim analogous to that pursued by an administrative sanction: to punish and to repair.

Read together, the two files are clear: the AEPD asserts its competence and the unlawfulness of the processing in every case, but tempers the sanctioning response where another punitive route has already served the deterrent and reparatory function, avoiding double punishment for the same facts.

The dual track: data protection and criminal law

A deepnude victim need not choose between one response or the other: they can report the matter to the AEPD so the administrative route operates and, in addition, pursue the criminal route. These are distinct channels, with distinct authorities and complementary aims. Data protection targets the unlawful processing; criminal law punishes the attack on protected interests such as moral integrity or privacy.

Where adults are involved, the conduct may fall within the offence against moral integrity under article 173 of the Criminal Code and the privacy offences under article 197 of the Criminal Code; where the image subjects the victim to gravely degrading treatment, it reinforces the moral-integrity reproach. Each case requires a specific analysis of intent, dissemination and harm.

Where the victim is a minor, the criminal reproach is markedly more severe: the material may amount to child pseudo-pornography under article 189 of the Criminal Code, which punishes the production, dissemination or possession of pornographic-looking images of minors, even where the image has been artificially generated or manipulated. For minor offenders, the response is channelled through the juvenile justice system and the Juvenile Court.

What it means for perpetrators and for victims

For anyone who creates or forwards these images, the key warning is that the conduct is neither harmless nor a mere digital prank. Sharing a deepnude in a messaging group already involves data processing and may add criminal reproach. The perpetrator being a minor does not exclude liability: it mitigates it and channels it through the juvenile justice system, but the conduct remains unlawful.

For the victim, the AEPD's doctrine is a valuable tool, because it allows a response even where dissemination has been limited: if the processing itself is unlawful, there is no need to prove mass viral spread. It is advisable to preserve evidence (dated screenshots, URLs, identification of the channel), request urgent removal of the content, and weigh the criminal complaint and the claim before the Agency at the same time.

In both scenarios, early advice is decisive. Coordinating the criminal strategy with the data-protection strategy avoids procedural errors, structures the response to the platforms, and allows the moral and reputational harm to be quantified correctly with a view to any compensation.

The AI Act and the regulation to come

The AEPD acts on the basis of rules already in force, the GDPR and Spanish data protection legislation, without having to wait for a specific AI statute. But the regulatory context is changing fast. The European Artificial Intelligence Regulation (AI Act) is already adopted and applies in phases, and it imposes transparency and labelling obligations on artificially generated or manipulated content.

In Spain, a bill on AI governance is also under parliamentary process, adapting that European regulation and contemplating an express ban on non-consensual sexual deepfakes with its own sanctioning regime. It is a text sent to Parliament that is not yet definitive law, so its content may change during the parliamentary process.

In parallel, the Government has announced a criminal-law reform to specifically typify the dissemination of sexual content generated or altered with AI without consent, also pending approval. Until these initiatives are finalised, the response continues to be built on the Criminal Code articles currently in force and on the AEPD's sanctioning powers.