Teenager in Palma de Mallorca Allegedly Generated and Distributed Deepfake Nudes of Five Classmates

A teenager in Palma de Mallorca, Spain allegedly generated deepfake nudes of five classmates, reportedly taking their images from social media and using AI to alter them without their consent. He is reported to have shared the altered images with others.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involved the targeted creation of humiliating and sexual synthetic imagery of specific victims for personal harassment, which aligns with sub-domain 4.3 under Boundary Rule B1.

Additional risk subdomains

• 1.2 Exposure to toxic content: The incident involved the generation and distribution of synthetic child sexual abuse material, exposing minors and their peers to highly toxic and illegal content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by a human actor who intentionally chose to use a deployed AI application to generate and distribute non-consensual sexual imagery of his classmates.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is an AI application used to generate deepfakes, which falls under the transparency obligations of Risk Level 3 for AI-generated content.

AI system and alleged parties

• AI system: unspecified AI application
• AI purpose: Deepfake Image Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unnamed adolescent male in Palma de Mallorca
• Alleged harmed parties: Unnamed victims in Palma de Mallorca

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Negligible

Malicious content

Reported: Yes, the reports describe the creation and distribution of realistic artificial nude images of five minor girls.

Directly caused: The perpetrator used an AI application to generate realistic nude images of five minor classmates and distributed them among other students.

Civil rights

Reported: Yes, the reports describe the violation of the minors' rights through the unauthorized sexualization of their images, which Spanish authorities classified as a crime of corruption of minors.

Directly caused: The rights of five minor girls to their own image, dignity, and protection from sexual exploitation were violated by the creation of synthetic child sexual abuse material.

Privacy

Reported: Yes, the reports mention that the perpetrator extracted photos from the victims' public social media profiles to generate the nudes.

Directly caused: The perpetrator violated the victims' privacy expectations by scraping their public photos to generate non-consensual sexual content.

Child sexual exploitation and abuse

Reported: Yes, the reports explicitly state that because the victims were minors, the police treated the creation of these realistic sexual images as the production of child pornography.

Directly caused: The perpetrator created and distributed synthetic child sexual abuse material involving five minor classmates.

People affected

• Occurrences reported: 1
• People reportedly harmed: 5
• People reportedly exposed: 5

Potential causes

Management

• Negligent App Developer Oversight: Developers failed to implement safety filters or age verification for the tool.
• Lack of Platform Policy Control: Platform managers failed to prevent scraping of minors' public photographs.

Technology

• Realistic AI Undressing App: The AI application generated highly realistic nude images from clothed photos.
• Lack of Safeguards in AI Tool: The AI software lacked built-in restrictions to block generating nude images.

Data Inputs

• Public Social Media Photos: Victims posted clothed photos publicly, allowing unauthorized downloading.
• Lack of Image Watermarking: Original photos lacked protection or watermarks to prevent AI manipulation.

Human Factors

• Malicious Intent by Minor: A classmate deliberately chose to generate and share non-consensual nudes.
• Peer Sharing Behavior: The minor distributed the generated deepfakes among a circle of friends.

Process and Methods

• Easy Access to Undressing Tools: No verification process was required to access and use the AI application.
• Inefficient Platform Moderation: Social media platforms allowed easy harvesting of user images by third parties.

Regulatory Environment

• Weak AI Safety Regulations: Lack of strict legal frameworks governing the deployment of undressing AI apps.
• Difficulties in Tool Enforcement: Regulatory bodies struggle to police or ban offshore AI manipulation tools.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple Spanish news outlets consistently describe the same set of facts regarding the arrest, the number of victims, the method used, and the legal classification of the crime.
• Ambiguities identified: The specific AI application or model used to generate the images is not named.
• Alternative interpretations: None, the facts of the case are clear and undisputed across all reports.

A 15-year-old student in Spain was arrested for generating and distributing non-consensual AI-generated nude images of classmates. This localized incident represents a minor national security impact, primarily affecting societal stability and human rights through the exploitation of minors, but was successfully resolved via standard law enforcement and legal frameworks.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Spain
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The immediate threat has been resolved with the perpetrator's arrest, but the underlying capability of generating non-consensual synthetic media remains an ongoing concern.
• Autonomy: Human-controlled. The AI tool was directly operated by a human user who selected inputs and initiated the generation process without autonomous decision-making by the system.
• Novelty: Established threat. The creation of non-consensual deepfake imagery is a known and established threat, although its execution by a minor targets a vulnerable demographic.

Impact by dimension

• Physical security: Negligible. The incident is a localized criminal matter involving school students and does not impact physical infrastructure, kinetic systems, or public safety.
• Information security: Negligible. No state-sponsored disinformation, intelligence compromise, or systematic information operations were detected in this localized incident.
• Sovereignty: Negligible. The incident has no bearing on state authority, electoral processes, or core government decision-making operations.
• Economic security: Negligible. No strategic technology theft, financial systems manipulation, or critical supply chain impacts occurred.
• Societal stability: Minor. While localized, the incident involved a severe violation of privacy and human rights of five minors through the creation of synthetic child sexual abuse material, managed under standard law enforcement procedures.