Purported Deepfake Nude Images of Students Circulated Without Consent at Valencia Educational Institute

Purported deepfake nude images of female students were circulated without consent at an educational institute in Valencia, Spain. At least 16 minors reported that original photographs had been digitally manipulated so they appeared completely naked, with some images shared via social media accounts created in victims' names. The alleged creation and distribution of the images is being examined under Spanish laws related to the protection of minors.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The suspect used AI to create non-consensual sexual imagery targeting specific classmates for personal gain (sale) and targeted humiliation, which aligns with sub-domain 4.3 according to the boundary rules.

Additional risk subdomains

• 1.2 Exposure to toxic content: The AI-generated non-consensual pornographic images of minors were circulated on social media, exposing the victims and the public to toxic and sexually explicit content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by a human student intentionally using an AI tool to generate and distribute deepfake nude images of his classmates after the AI system was deployed.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of AI to generate deepfakes. According to the definitions, AI-generated content such as deepfakes poses a moderate risk and falls under Risk Level 3.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Image Generation; Deepfake Video Generation
• Behaviour type: Tool
• Alleged developer: Unknown image generator developers, Unknown deepfake technology developers
• Alleged deployer: Unnamed student, Unnamed male student in Valencia, Unnamed male student
• Alleged harmed parties: Unnamed students, Unnamed female students in Valencia, Unnamed female students

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Negligible

Malicious content

Reported: The report explicitly describes the creation and circulation of deepfake nude images of minors.

Directly caused: The suspect used AI to create deepfake nude images and videos of 16 female classmates, which were circulated on social media.

Inferred additional harm: It is likely that numerous social media users and school peers were exposed to this toxic and explicit content before it was removed.

Privacy

Reported: The report explicitly describes privacy violations involving the manipulation of the victims' original photos and the creation of social media accounts in their names.

Directly caused: The suspect manipulated original photos of 16 female classmates to make them appear naked and posted them on social media accounts started under their names.

Inferred additional harm: The victims' personal photos and identities were compromised and exploited without their consent.

Epistemic

Reported: The report explicitly describes epistemic harm in the form of fabricated naked images and videos resembling the victims.

Directly caused: AI-generated videos and faked photos resembling the victims completely naked were posted online, creating false representations of them.

Child sexual exploitation and abuse

Reported: The report explicitly describes a CSEA incident involving the creation and sale of deepfaked nude images of minors.

Directly caused: A 17-year-old is under investigation for using AI to deepfake nude images of 16 female classmates, who are minors, for sale.

People affected

• Occurrences reported: 1
• People reportedly harmed: 16
• People reportedly exposed: 16

Potential causes

Technology

• AI Deepfake Image Generation: AI tools enabled realistic manipulation of photos to show victims naked.

Data Inputs

• Original Classmate Photos: Real photos of classmates were used as input data for the AI model.

Human Factors

• Misuse of AI by Minor: A 17-year-old student chose to use AI to generate non-consensual pornography.

Process and Methods

• Creation of Fake Accounts: Fake accounts were used to distribute and sell the AI-generated images.

Regulatory Environment

• Lack of Passed AI Laws: The proposed law criminalizing AI deepfake pornography was not yet passed.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple reputable sources (NDTV, Independent, Reuters) consistently describe the same set of facts regarding the police investigation, the number of victims (16), the age of the suspect (17), and the nature of the AI use (creating deepfake nude images of classmates). There are no conflicting accounts.
• Ambiguities identified: The specific AI software or platform used to generate the deepfakes is not identified.

A Spanish teenager used AI tools to generate and distribute non-consensual nude deepfakes of 16 female classmates. While causing significant psychological harm and representing a growing societal challenge regarding AI-enabled harassment, the incident is a localized criminal matter with minor national security implications.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Spain
• Alleged perpetrator: 17-year-old student

Threat characteristics

• Imminence: Long-term. The active crisis is resolved as police are investigating, but it reflects an ongoing strategic concern regarding AI-enabled non-consensual imagery.
• Autonomy: Human-controlled. The AI system functioned strictly as a tool controlled by the human operator who selected targets and initiated the image generation.
• Novelty: Established threat. Similar deepfake incidents targeting school-aged minors have occurred previously, including a noted case in Extremadura in 2023.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety elements were targeted or affected in this localized incident.
• Information security: Negligible. The incident involves localized deepfakes targeting classmates, with no connection to national-level information warfare, state-sponsored disinformation, or intelligence compromise.
• Sovereignty: Negligible. There is no disruption or threat to Spanish state authority, electoral systems, or core government decision-making processes.
• Economic security: Negligible. No impact on strategic industries, critical supply chains, financial systems, or national technological advantages.
• Societal stability: Minor. While representing a severe violation of privacy and human rights of minors through AI-enabled CSEA, the impact is localized and manageable through standard domestic law enforcement and legal procedures.