Facts
According to press reports, in September 2023 photos of girls in the Spanish town of Almendralejo were manipulated with AI to place their faces on nude bodies and circulated on social media. The AEPD’s decision notes, relying on published information, that they had reportedly also been posted on internet portals. The AEPD opened a preliminary investigation on 20 September 2023, and one of the persons concerned lodged a complaint on 2 October 2023. Using information from the public prosecutor, the AEPD identified people who had taken part in spreading the images through a messaging group. According to the press, the Badajoz Juvenile Court found 15 minors responsible and imposed a year’s supervised probation. On 17 March 2025 the AEPD opened sanction proceedings against one of them.
Question
The question was whether disseminating AI-manipulated photographs amounts to processing of personal data under the General Data Protection Regulation (GDPR). That depended first on whether manipulated images showing identifiable faces are personal data. Second, the AEPD had to decide whether someone who shares such images in a messaging group acts as a controller. Finally, it considered whether any legal basis in Article 6(1) GDPR applied, and what weight to give to the fact that the processing concerned people entitled to enhanced protection.
Decision
The AEPD held that an image that identifies a person, or makes them identifiable, is personal data, and that disseminating photographs manipulated with AI is processing within Article 4(2) GDPR. The person who shared the images in the messaging group determined the purposes and means of that activity and was therefore a controller. None of the legal bases in Article 6(1) applied, and a fine of €2,000 was proposed under Article 83(5). On 5 April 2025 the controller’s legal representative paid the fine, which counted as an acknowledgement of responsibility. Two cumulative 20 percent reductions brought the amount down to €1,200. The AEPD declared the infringement, closed the proceedings, and the resolution became final in the administrative channel.
Why it matters
The decision treats the spread of AI-generated sexual images as a data protection matter as well as a criminal one. The AEPD treated AI-manipulated images that make people identifiable as personal data, and treated a participant in spreading them through a messaging group as a controller. Press reports described it as one of the first fines imposed by a data protection authority for spreading such images. It shows that the GDPR can reach individual users who circulate this kind of content.
Related stages
According to the press, the AEPD also fined at least one other minor involved, and that person’s lawyer challenged the sanction, arguing that the same conduct could not be punished both by the juvenile court and through administrative proceedings. In the file summarised here, by contrast, the fine was paid and administrative remedies were waived.