Beware of Generating AI Images Using Real People, NPC Warns
It could be a violation of the Data Privacy Act of 2012.
by Zoe Andin
Published on Aug 13, 2026
(SPOT.ph) From Studio Ghibli display pictures to event posters and memes, it seems like every day brings something new made with artificial intelligence (AI). But before you use your family, friends, and even public figures in a prompt, make sure you aren’t violating the Data Privacy Act of 2012 (DPA).
The National Privacy Commission (NPC) reminded the public in a notice that using AI tools to generate images and videos of real people is a form of processing personal data, regardless of its intended purpose. It also emphasized that photos and videos can count as biometric information that can identify a person.
“Like any processing of personal data, these acts must have a legitimate purpose and must conform with any of the criteria for lawful processing found under the DPA,” NPC said in the notice.
That means the usual rules on handling personal data still apply. Under Section 25 of the DPA, doing so without a lawful basis may amount to unauthorized processing. Sharing these materials may also violate the DPA, resulting in criminal, civil, and administrative penalties.
“[A] fabricated image or video is false personal data. AI-generated media that depicts a real person doing something the person never did, saying something the person never said, or being somewhere the person never was, is false information about that person.”
Unauthorized data in AI-generated content has been a growing problem for months. Most recently, Filipino DJ Cupcakes accused major broadsheet Manila Bulletin of using his likeness in an AI-generated promotion for its annual on-the-spot art competition.
There are some exceptions. The NPC said using personal data for satire, parody, commentary, artistic use, and reporting may be allowed—but only to the minimum extent necessary for that purpose.
Being a public figure doesn’t automatically make someone’s image fair game, either. The NPC said AI-generated media involving public officials, their family members, and minors are still covered by the DPA.
When evaluating complaints, the NPC will consider factors such as whether the person consented, what disclosures were made, and whether it is even necessary to use a person’s actual likeness in the first place.
Also read: WATCH: AI-Generated Zaldy Co Makes Surprise Appearance in This Wedding Video
What to do if your image has been used in AI without consent
According to Section 16(e) of the DPA, if your personal data is used illegally, you can ask for it to be blocked, removed, or deleted. This includes AI-generated content that uses your image. You or your representative can file a complaint with the NPC in person at the NPC Central Office, by courier to the same address (5th Floor, PICC Complex, Pasay City), or by email at complaints@privacy.gov.ph.
To file a complaint, you must submit either a notarized complaints-assisted form, along with evidence that your personal data was inaccurate, obtained illegally, or used without your permission.
The NPC can then investigate the complaint and order the person or company to fix the violation or stop using the data. Under the DPA, unauthorized processing of personal information can carry a fine of P500,000 to P2 million and one to three years in prison. For sensitive personal information, the fine can go up to P4 million, with three to six years in prison
While no Philippine laws have been enacted regulating the use of AI, it’s helpful to keep in mind how carelessly generating fake images and videos could land you in hot water.
Also read: EJK Victims’ Families Are Targeted in Manipulated Photo Amid ICC Hearing
Zoe thinks a lot but forgets just as much. Writing helps her deal with both problems. When she isn't writing, she spends time baking sweets, wandering around, or staring up at the moon.