Deepfake Law in Spain
Spain regulates deepfakes through the EU AI Act and the 2024 Organic Law reform, which criminalized the creation of non-consensual sexual deepfakes — aligning Spain with the UK's aggressive position.
- Status
- enacted
- Jurisdiction
- Spain
- Effective
- Mar 2024
- Statute
- EU AI Act + Organic Law 10/1995 (amended 2024)
Spain's deepfake framework combines the EU AI Act with 2024 amendments to the Criminal Code (Organic Law 10/1995) that criminalized the creation of non-consensual sexual deepfake imagery — a notably strict position aligned with the UK.
Key provisions
Organic Law amendments (March 2024). Creating a non-consensual sexual deepfake of an identifiable person carries imprisonment of one to two years. Distribution carries higher penalties (up to five years in aggravated cases). The creation offense is notable — Spain is one of few jurisdictions where simply producing such content is criminal regardless of distribution.
EU AI Act. Directly applicable. Spain designated the AEPD (data protection authority) and a new AI supervisory body to jointly oversee enforcement.
Criminal Code — dignity and honor offenses. Deepfakes that defame identifiable persons fall under existing honor-crime provisions (Articles 205-216).
General Data Protection Regulation (LOPDGDD). Spanish implementation of GDPR treats biometric data (including voice and facial features) as special-category data. Non-consensual deepfakes generate standalone GDPR violations alongside criminal and AI Act exposure.
Enforcement context
The 2024 amendments were prompted partly by a high-profile case in Almendralejo, Extremadura, where teenagers generated non-consensual imagery of classmates using a clothing-removal app. The case highlighted that the pre-amendment framework inadequately covered minors creating synthetic imagery of peers.
Since the amendments:
- Multiple prosecutions have been initiated under the creation offense.
- The AEPD has issued guidance on AI-generated content and privacy rights.
- Civil damages under personality rights doctrines continue alongside criminal proceedings.
Practical implications
For organizations operating in Spain:
- AI service providers: consent verification for any voice-cloning or face-manipulation service offered in Spain. Shipping a non-consenting product may constitute facilitation.
- Platforms: takedown obligations strengthened under SREN-equivalent + AI Act + Criminal Code exposure.
- Individuals: creation of sexual deepfakes is criminal. Prosecutions have been pursued including cases involving minors.