Purported Deepfake Technology Was Reportedly Used to Generate Naked Pictures of Underage Girls in Spanish Town

In Spain, an AI app was used to digitally alter photos of young girls, making them appear naked. This manipulation sparked an investigation after these images were circulated in Almendralejo, a town in the Extremadura region, raising serious concerns about digital privacy violations and the potential spread of these images on pornographic sites.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involved the targeted creation of humiliating sexual imagery of specific victims to harass them, with at least one case of attempted blackmail/extortion.

Additional risk subdomains

• 1.2 Exposure to toxic content: The AI system was used to generate and expose minors to highly toxic, non-consensual sexually explicit content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by the intentional actions of human users (the schoolboys) who chose to generate and distribute non-consensual deepfakes using a post-deployment AI application.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of an AI system to generate deepfakes, which falls under the Limited Risk category of the EU AI Act.

AI system and alleged parties

• AI system: ClothOff
• AI purpose: Deepfake Image Generation; Image Generation
• Behaviour type: Tool
• Alleged developer: Unknown image generator developers, Unknown deepfake technology developers
• Alleged deployer: Unnamed perpetrators in Almendralejo
• Alleged harmed parties: Unnamed victims in Almendralejo, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Minor
• Differential treatment: direct Minor, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Minor
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Negligible

Malicious content

Reported: The report explicitly describes toxic and malicious content created and spread directly by the incident.

Directly caused: Hyper-realistic fake naked images of over 30 underage girls were generated using the ClothOff app.

Indirectly caused: These images were circulated in WhatsApp and Telegram groups, exposing classmates and potentially others on adult platforms.

Inferred additional harm: The images may have been uploaded to pornographic websites or OnlyFans as feared by parents, expanding the reach.

Differential treatment

Reported: The report explicitly describes systematic differential treatment of individuals caused directly by the incident.

Directly caused: Over 30 female students were targeted specifically because of their gender, resulting in targeted harassment and humiliation.

Civil rights

Reported: The report explicitly describes violations of human and civil rights caused directly by the incident.

Directly caused: The moral integrity and privacy rights of over 30 minor girls were violated by the non-consensual generation of sexual imagery.

Privacy

Reported: The report explicitly describes privacy violations caused directly by the incident.

Directly caused: Photos of over 30 girls were taken from their public social media profiles without consent to generate nude images.

Psychological

Reported: The report explicitly describes severe psychological distress, anxiety, and trauma experienced by the victims and their families.

Directly caused: Over 30 minor girls experienced severe distress, anxiety, and social isolation, with some refusing to leave their houses due to the circulation of the images and comments from classmates.

Indirectly caused: The mothers and parents of the affected girls experienced significant distress, worry, and anxiety over the situation.

Inferred additional harm: Long-term psychological trauma, anxiety, and social withdrawal for the 30+ victims and their families.

Child sexual exploitation and abuse

Reported: The report explicitly describes a CSEA incident involving AI-generated CSAM cases.

Directly caused: AI-generated explicit sexual images of minors (aged 11-17) were created and distributed.

People affected

• Occurrences reported: 1
• People reportedly harmed: 30
• People reportedly exposed: 30

Potential causes

Management

• Prioritizing Fun Over Safety: App creators designed the tool to 'make people laugh' without safety controls.
• Reliance on User Policy Compliance: Management relied on users to follow guidelines rather than enforcing consent.

Technology

• Accessible Deepfake Generation: AI apps allow anyone to generate hyper-realistic nudes for a low cost.
• Bypassed App Safeguards: App safeguards were bypassed using a combination of different applications.
• Automated Stripping Tools: Automated services make undressing women extremely easy for non-experts.

Data Inputs

• Public Social Media Photos: Clothed photos were easily harvested from victims' Instagram profiles.

Human Factors

• Lack of Minor Digital Literacy: Teenagers treated the harmful deepfake creation as a joke.
• Malicious Extortion Intent: Some perpetrators used the fake images to blackmail victims for money.
• Inadequate Parental Oversight: Parents failed to monitor or restrict their children's smartphone usage.

Process and Methods

• Flawed Search Engine Ranking: Search engines indexed and highly ranked nudify apps, making them easy to find.
• Ineffective App Age Verification: The app lacked robust methods to verify age or consent of those depicted.
• Easy Messaging App Distribution: WhatsApp and Telegram groups allowed rapid dissemination of the fake images.

Regulatory Environment

• Legal Loopholes for AI Nudes: Current laws struggle to classify non-consensual AI nudes as child pornography.
• Age of Criminal Responsibility: Spanish law prevents prosecuting perpetrators who are under 14 years old.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple reputable news agencies provide highly consistent and detailed accounts of the incident, the specific AI app used, the demographics of the victims and perpetrators, and the resulting harms.
• Ambiguities identified: There is minor variation in the reported number of victims (ranging from over 20 to over 30) and the exact number of identified suspects (10 to 11).
• Alternative interpretations: None, the role of the AI app in generating the non-consensual imagery is clear and undisputed.

Local minors in Spain used a consumer AI application to generate and distribute non-consensual explicit images of classmates. While the incident caused severe psychological harm to the victims and initiated national discussions on legal reform regarding synthetic media, its national security implications remain minor and are addressed through domestic law enforcement and legislative channels.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Spain
• Alleged perpetrator: Local minors

Threat characteristics

• Imminence: Long-term. Represents an ongoing societal and regulatory challenge regarding consumer-accessible generative AI tools rather than an active national security crisis.
• Autonomy: Human-controlled. The AI system functioned strictly as a tool, executing image manipulation tasks based on direct human inputs and uploads.
• Novelty: Evolved capability. Demonstrates an evolved ease of access and democratization of deepfake generation tools, lowering the barrier to entry for harassment.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety through kinetic means were impacted by this incident.
• Information security: Negligible. No state-level disinformation campaigns, intelligence compromises, or classified model thefts were observed.
• Sovereignty: Negligible. State authority, electoral systems, and core government operations were not threatened or disrupted.
• Economic security: Negligible. There was no impact on strategic industries, financial systems, or national technological competitive advantages.
• Societal stability: Minor. Violated the privacy and civil rights of over 20 minor girls through non-consensual synthetic sexual imagery, prompting national debate on legal frameworks, but remained manageable within local law enforcement.