Whirlpool Reportedly Used AI-Altered Footage of North Carolina State Senator DeAndrea Salvador in Brazilian Advertisement

An advertising campaign created by DM9, a São Paulo–based subsidiary of Omnicom Group, for Whirlpool's Brazilian brand Consul reportedly used AI to alter footage from a 2018 TED Talk by North Carolina State Senator DeAndrea Salvador. The video reportedly modified her voice, statements, and slides to reference Brazilian energy data without her consent, appeared in an award-winning commercial, and later prompted a lawsuit alleging unauthorized use of her likeness and reputational harm.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The ad agency used generative AI to manipulate the Senator's public likeness and voice to create a fake endorsement for commercial gain, which fits the boundary rule for targeted manipulation and fake endorsements.

Additional risk subdomains

• 3.1 False or misleading information: The AI-manipulated ad generated and spread false statements about energy costs in São Paulo and fabricated a political figure's endorsement.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by the deliberate decision of humans at the advertising agency DM9 to use generative AI tools to manipulate the Senator's likeness for a commercial campaign.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The incident involves the creation of AI-generated content (a deepfake video), which falls under the transparency and disclosure obligations of Risk Level 3.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown voice cloning technology developers, Unknown deepfake technology developers
• Alleged deployer: Whirlpool, Omnicom Group, DM9, Consul
• Alleged harmed parties: General public of North Carolina, General public of Brazil, General public, Epistemic integrity, DeAndrea Salvador, Cannes Lions International Festival of Creativity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Psychological

Reported: The report explicitly describes psychological harm, noting that the Senator experienced severe emotional distress and felt deeply unsettled and violated.

Directly caused: Senator DeAndrea Salvador (1 person) suffered severe emotional distress, anxiety regarding her public perception, and felt violated upon discovering the unauthorized deepfake.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Lack of AI Oversight: Whirlpool and Omnicom failed to verify the origin of agency-provided media.
• Shadow AI Adoption: Employees used generative AI tools without management's knowledge.

Technology

• Generative AI Voice Cloning: AI was used to clone and change Salvador's voice to alter her statements.
• Deepfake Video Generation: AI altered TED talk slides and video visuals without author's permission.

Data Inputs

• Unauthorized Copyrighted Footage: DM9 used Salvador's 2018 TED Talk video without obtaining consent.
• Manipulated Broadcast Data: Altered footage from a CNN Brazil broadcast was used in the commercial.

Human Factors

• Unauthorised Employee AI Use: A small number of employees executed AI alterations without approval.
• Lack of Creative Integrity: Creators fabricated statements to make it appear she endorsed Whirlpool.

Process and Methods

• Inadequate Content Verification: Cannes Lions lacked verification to prevent material misrepresentation.
• Lack of Agency Disclosure: DM9 submitted the ad to Cannes without disclosing the use of AI.

Regulatory Environment

• Absence of Deepfake Regulations: Lack of active laws regulating commercial deepfakes and AI synthetic media.
• Failed Legislative Measures: NC bipartisan bill to regulate deepfakes failed to gain enough traction.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, consistent, and detailed accounts of the deepfake creation, the parties involved, the Senator's reaction, the legal actions, and the consequences at the Cannes Lions festival.
• Ambiguities identified: The specific AI models or software tools used to generate the video and voice are not identified.

A Brazilian advertising agency used generative AI to deepfake a US State Senator's voice and likeness for a commercial appliance campaign. While representing a serious case of unauthorized synthetic media and likeness theft resulting in a civil lawsuit, the incident has negligible implications for national security.

• Overall national security impact: Negligible
• Scope: Multiple nations
• Primary target: United States
• Other affected: Brazil
• Alleged perpetrator: DM9 advertising agency

Threat characteristics

• Imminence: Long-term. The incident is a resolved commercial dispute and lawsuit, presenting no immediate national security crisis.
• Autonomy: Human-controlled. The AI tools were directly operated by human creators at the advertising agency to manipulate the video and audio.
• Novelty: Established threat. The use of generative AI to create deepfakes and unauthorized synthetic media of public figures is a well-known and recurring issue.

Impact by dimension

• Physical security: Negligible. No physical systems, infrastructure, or human safety were threatened or impacted by this commercial advertising incident.
• Information security: Negligible. While the incident involved a deepfake of a state senator, it was for a commercial appliance advertisement rather than a coordinated state-sponsored disinformation or intelligence operation.
• Sovereignty: Negligible. The incident did not disrupt government decision-making, electoral systems, or state authority, remaining a civil and commercial dispute.
• Economic security: Negligible. No strategic technology theft, critical supply chain vulnerabilities, or financial system attacks occurred.
• Societal stability: Negligible. The incident was limited to the unauthorized use of one individual's likeness in a commercial, with no large-scale threats to societal stability or human rights.