Deepfakes & AI Crimes: Criminal Defense in the Digital Era

The offences committed through deepfakes and generative artificial intelligence integrate an emerging criminal category that the Spanish Criminal Code does not classify as an autonomous figure, but that is effectively prosecuted by reconducting it to several classical types depending on the specific conduct: offences against privacy and one's own image (Art. 197.7 CP) in non-consensual pornographic deepfake cases; offences against minors (Art. 189 CP) when the victim is under age; impersonation of civil status (Art. 401 CP) in digital-impersonation cases; computer fraud (Art. 248 CP) in CEO-fraud-type operations with cloned voice; insults and calumny (Arts. 205-210 CP) in defamatory deepfakes; and, where applicable, hate offences (Art. 510 CP). Consolidated Supreme Court doctrine on digital evidence and forensic expertise provides criteria applicable to AI-generated audiovisual material.

The typical modalities are diverse and rapidly sophisticate. Non-consensual pornographic deepfakes: overlay of a real person's face on sexual material, frequently linked to ex-partner revenge, sextortion or school cyberbullying. AI voice cloning for CEO fraud (AI vishing), calls impersonating family members in false emergencies (grandchild/virtual-kidnapping scam), or calls to banking institutions. The generation of pornographic images of minors via AI, even without a real victim, integrates the offence under Art. 189 CP after the reform. The manipulation of judicial evidence via deepfakes purporting to prove non-existent conversations or conducts. The use of AI to generate mass phishing, polymorphic malware and personalised social-engineering campaigns. And algorithmic discrimination in AI systems deployed without the safeguards required by the AI Act.

The penalties depend on the applicable type according to the specific conduct. Non-consensual pornographic deepfakes on adults (Art. 197.7 CP) carry prison from 3 months to 1 year or fine; when specific aggravating factors concur, they can reach more severe penalties. Deepfakes involving minors (Art. 189 CP) carry prison from 1 to 5 years, expandable to 9 years in qualified cases, together with registration in the Central Sex Offenders Register and lifetime ban on working in contact with minors. Fraud with cloned voice (Arts. 248-250 CP) carries 1 to 6 years' prison. Civil-status impersonation (Art. 401 CP) sanctions with 6 months to 3 years' prison. To custodial penalties is added the administrative liability for breach of the AI Act (EU Regulation 2024/1689), with fines up to EUR 35 million or 7% of annual global turnover.

The technical defence and private-prosecution strategy articulate several lines. When representing the victim, we execute specialised forensic computer expertise to certify the deepfake nature of the material and, in parallel, manage the urgent removal of content on social media and search engines through DMCA/GDPR claims and, where applicable, judicial precautionary measures. We request from the court removal orders, identification of originating IPs and precautionary blocking of accounts. When defending the investigated, we articulate the questioned authenticity of the material through forensic counter-expertise examining visual artefacts, metadata, temporal consistency, audio spectrogram and generative-model fingerprints; the absence of intent in artistic, parody or educational use cases covered by freedom of expression; and the challenge of the digital chain of custody when the material presented by the prosecution lacks hash, time-stamp or adequate expert traceability.

In current forensic practice we observe sustained growth in proceedings linked to deepfakes and generative AI. The EU Regulation 2024/1689 (AI Act) on artificial intelligence and Organic Law 1/2022 on the integral guarantee of sexual freedom have transformed the regulatory framework, requiring platforms to implement removal protocols for synthetic content. At Alonso Sala we tackle each file as a specialised technical-legal matter: we coordinate forensic computer experts, computer-vision experts and AI Act compliance consultants, with the urgency, discretion and scientific rigour these matters require.