Skip to content
A
Alonso Sala
CRIMINAL LAWYERS
ES
Legal Analysis

Deepfakes as Evidence in Spain: Digital Forensic Defence (2026)

calendar_todayMay 17, 2026

Last updated:

lightbulbKey Takeaways

  • check_circleDetection by artefacts, frequency and biometrics
  • check_circleDigital chain of custody with SHA-256
  • check_circleOffences: Arts. 197.7, 390, 205-210, 401, 248 CP
  • check_circleProcedural, expert and constitutional challenge

Deepfakes — videos, audio and images generated by artificial intelligence that impersonate a real person — have gone from a technical curiosity to a first-order legal problem. As criminal lawyers specialising in technology offences, we see more cases each month in which a deepfake appears as prosecution evidence or as the instrument of an offence. This guide explains how to detect a deepfake, how to challenge it procedurally and how to build a defence when generative AI fabricates evidence against you.

What Is a Deepfake and Why Does It Concern Criminal Law?

A deepfake is synthetic audiovisual content created through generative neural networks that replaces a person's face, voice or body with another's, with a verisimilitude almost indistinguishable to the human eye. For criminal law the problem is twofold: a deepfake can be the body of the offence (sextortion with fabricated images, identity impersonation, fraud with synthesised CEO audio), or it can be presented as falsified prosecution evidence — manipulated videos placing the suspect in a scene where they never were.

Technical Detection: How a Deepfake Is Identified

  1. Analysis of visual artefacts: generative models leave characteristic traces — imperfect edges around the face, anomalous blinking, incoherent lighting, shadows not respecting the light direction.
  2. Frequency-domain analysis: deepfakes show anomalous patterns in high frequencies (the generator's spectral signature) that do not appear in real cameras.
  3. Behavioural and physiological biometrics: methods such as Intel's FakeCatcher detect deepfakes by measuring facial blood flow; a real face reflects detectable heartbeats, a synthetic one does not.

Reference Forensic Tools

The IT expert acting before the courts must use audited, internationally recognised tools (Microsoft Video Authenticator, Sensity AI, Intel FakeCatcher, InVID-WeVerify for EXIF metadata and Error Level Analysis). No detector is infallible: correct forensic practice requires cross-checking at least two tools and complementing the result with the expert's manual analysis.

Digital Chain of Custody of the Audiovisual Material

When a deepfake enters criminal proceedings, the digital chain of custody becomes the core of the defence. Supreme Court case law requires proof of the file's integrity from its obtaining to its expert analysis: a cryptographic hash (SHA-256), a seizure record, a forensic image preserved as the original, access traceability and the use of write-blockers. Any break in the chain opens the door to challenging the evidence for breach of the right to a trial with all guarantees (Art. 24.2 of the Constitution).

How to Challenge a Deepfake as Prosecution Evidence

The challenge operates on three planes. Procedural challenge: requesting the original file (not recompressed copies from social media), the complete metadata and verification of the chain of custody. Expert challenge: appointing one's own expert to carry out a forensic analysis. Constitutional challenge: if the material was obtained breaching fundamental rights, nullity applies under Art. 11.1 of the Judiciary Act, with a reflex effect on derived evidence.

Defence When a Deepfake Accuses You

  1. Technical alibi: phone geolocation, card records and CCTV placing the suspect elsewhere.
  2. Forensic expert evidence: a report demonstrating the manipulation of the material.
  3. Analysis of the origin: a reverse search to identify the source material.
  4. Investigation of the complainant: do they have technical capacity? Is there an improper motive?
  5. Criminal counter-claim: a complaint for false accusation (Art. 456 CP) or slander (Art. 205 CP) against whoever generated the deepfake.

Criminal Offences Applicable to Creating and Sharing Deepfakes

  • Art. 197.7 CP — Non-consented sharing of intimate images: it punishes sharing images or recordings that the offender obtained with the victim's consent in a home or other private setting. The provision was designed for real images and does not expressly mention AI-generated ones, so its application to purely synthetic deepfakes is debated; in practice it is usually pleaded together with insult or offences against moral integrity.
  • Art. 390 CP — Document falsification: where the deepfake is used to prove facts before an administrative or judicial body.
  • Arts. 205-210 CP — Slander and insult: where the deepfake attributes the commission of an offence or harms dignity.
  • Art. 401 CP — Usurpation of civil status: applicable to voice deepfakes that impersonate identity.
  • Art. 248 CP — Fraud: a voice deepfake of the CEO ordering a transfer constitutes fraud.

State of the Regulation (June 2026)

Section updated on 12 June 2026. It is worth pinning down the regulatory position, because many summaries treat pending reforms as if they were already in force. As of June 2026 the Spanish Criminal Code (CP) contains no specific deepfake offence. On 26 May 2026 the Council of Ministers approved the draft Artificial Intelligence Act and sent it to Parliament: the bill would amend the CP to criminalise non-consented sexual deepfakes and toughen the penalties for online grooming, with administrative fines of up to 35 million euros for prohibited uses. It is a bill still in passage: until it is approved and enters into force, neither the prosecution nor the defence can rely on those offences.

What is prosecutable today still runs through Art. 197.7 CP — with the debate noted above on purely synthetic images, since the provision requires images obtained with the victim's consent in a home or other private setting —, the offence against moral integrity (Art. 173 CP), insult, slander and fraud. For forensic practice, the most relevant development is the EU AI Act: its obligations for high-risk systems become fully applicable on 2 August 2026, and its Art. 50 requires labelling content generated or manipulated by AI, under AESIA's supervision in Spain. That labelling (watermarks, provenance metadata) will give experts a new reference point when authenticating or challenging audiovisual material.

Accused with a deepfake, or a victim of one?

The forensic analysis of a deepfake requires immediate intervention. We work with IT experts specialising in generative AI.

📞 Call us: +34 91 078 65 74

terminal

gavelDo you need criminal defense in this area?

We are criminal defense lawyers specializing in cybercrime and technological criminal law. We act urgently to protect your rights.

View expertisearrow_forward

Related Articles

View allarrow_forward

Knowledge is power, but strategy is key.

What you read here is just the beginning. Transform information into active defense by contacting our team of experts.

call