Criminal Liability for Deepfakes of Public Figures in Spain

Singers, actresses, presenters, footballers and politicians today make up the group most exposed to the mass fabrication of deepfakes. Studies indicate that over 95% of the deepfake content in circulation is pornographic and that 99% of the people depicted are women, mostly public figures. As criminal lawyers specialising in digital offences, we summarise the applicable offences, platform liability and the appropriate procedural strategy.

Casuistry: Types of Deepfake Against Public Figures

1. Non-consented pornographic deepfake: the generation of synthetic sexual content with the victim's face superimposed on a real body. The most frequent pattern.
2. Political or propaganda deepfake: a fake video or audio of a politician saying what they never said, for electoral manipulation or discredit.
3. Fraudulent commercial endorsement deepfake: advertisements with the synthetic image and voice of celebrities promoting cryptocurrency or pyramid scams.
4. Sextortion through deepfake: the threat of sharing a pornographic deepfake in exchange for money.

Applicable Criminal Offences

• Art. 197.7 CP — Non-consented sharing of intimate images: it punishes sharing, without authorisation, images or recordings that the offender obtained with the victim's consent in a home or any other place out of sight of third parties, where disclosure seriously harms their privacy. The provision was designed for real images and does not expressly mention AI-generated ones, so its application to a purely synthetic deepfake is debated; in practice it is usually pleaded together with insult and offences against moral integrity. Prison of 3 months to 1 year or a fine of 6 to 12 months.
• Arts. 205-206 CP — Slander: the false imputation of an offence through a deepfake. With publicity, prison of 6 months to 2 years.
• Arts. 208-210 CP — Insult: harm to dignity and reputation.
• Art. 401 CP — Usurpation of civil status: applicable to voice deepfakes that impersonate identity.
• Art. 248 CP — Fraud: a fraudulent endorsement with the celebrity's synthetic image.
• Art. 510 CP — Hate speech: a deepfake with racist or discriminatory content.

Sextortion Through Deepfake

The typical scheme consists of sending the victim a pornographic deepfake fabricated from public social-media photos and demanding a cryptocurrency payment. Here the following concur: insult and unlawful interference with honour (Arts. 205 et seq. CP and Organic Law 1/1982) for the fabricated sexual content — Art. 197.7 CP would only come into play if a real intimate image obtained with the victim's consent had been shared; Art. 169 CP (conditional threats) or Art. 243 CP (extortion) when money is demanded; and Art. 264 CP if there was prior computer intrusion to obtain material.

Platform Liability (DSA and AI Act)

The European framework changed radically in 2024-2026. Regulation (EU) 2022/2065, the Digital Services Act (DSA), imposes on online platforms accessible notice-and-action mechanisms, an internal complaints system, cooperation with trusted flaggers and fines of up to 6% of worldwide turnover for serious non-compliance. Regulation (EU) 2024/1689, the AI Act, requires the mandatory labelling of content generated or manipulated by AI representing real people or events (Art. 50).

Procedural Strategy: Civil and Criminal Combined

1. Urgent phase (first 48 hours): a notarial record of the published content, a takedown notice to the platform via the DSA.
2. Criminal complaint: filed with the competent investigating court, classifying the concurrence of offences and seeking interim measures (removal of content, prohibition of dissemination).
3. Civil claim for the protection of honour, privacy and image (Organic Law 1/1982): with a request for compensation.
4. Actions against the platform: an administrative claim for breach of the DSA and, where appropriate, a civil liability action if the platform kept the content after a proper notification.

State of the Regulation (June 2026)

Section updated on 12 June 2026. As of today, the Spanish Criminal Code (CP) contains no specific deepfake offence. On 26 May 2026 the Council of Ministers approved the draft Artificial Intelligence Act and sent it to Parliament: the bill would amend the CP to criminalise non-consented sexual deepfakes and toughen the penalties for online grooming, alongside administrative fines of up to 35 million euros. Until the parliamentary procedure is completed, it is not law in force: no prosecution can be based on those announced offences, and any reference to them must be made in the conditional.

Prosecution today rests on the existing offences: Art. 197.7 CP — whose fit with purely synthetic images is debated, since the provision requires images obtained with the victim's consent in a home or other private setting —, the offence against moral integrity (Art. 173 CP), insult and slander and, in fake commercial endorsements, fraud. In parallel, the EU AI Act's obligations for high-risk systems become fully applicable on 2 August 2026, and its Art. 50 requires the labelling of content generated or manipulated by AI, supervised in Spain by AESIA. That labelling will make it easier to prove before a court that a video is synthetic and will strengthen takedown actions.