Every now and then, a new trend emerges on social media where users transform ordinary photographs into extraordinary images through the use of artificial intelligence (AI) tools. Just by uploading a selfie and typing a prompt, AI can make your photo look like a movie scene, turn you into a cartoon character, dress you in a different outfit, or make you appear as though you were photographed somewhere you have never been. For many Filipinos, these AI-generated images are simply another form of online entertainment or a passing social media trend.
But what happens when the face in the photograph is not yours?
The National Privacy Commission (NPC) recently reminded the public about using AI to edit one’s own image or using another real person’s face or likeness without a lawful basis. In its notice, the NPC stated that a person’s face and likeness constitute personal information under the Data Privacy Act of 2012 (DPA). In certain circumstances, photographs and videos may also constitute biometric information that directly identifies an individual.1 Using an AI tool to generate an image or video from a real person’s likeness, as well as posting or sharing the resulting material, constitutes processing of personal data.2 This is significant because the AI-generated image may be fictional, but the person depicted in it is real.
APPEAL OF AI SELF-EDITS
It should be noted, however, that there is a difference between using AI to edit one’s own image and using another person’s likeness without their knowledge or permission. While users may voluntarily consent to the processing of their own images by AI tools, the situation becomes more complicated when another person’s likeness is involved. The fact that one has access to another person’s photograph, or that the photograph is publicly available online, does not by itself mean that anyone is free to take it, upload it to an AI system, and create a new representation of that person for any purpose. The NPC has cautioned that the processing of a person’s likeness must have a legitimate purpose and satisfy a lawful criterion under the DPA.3
Consent is one such basis, but it is not the only one. Whether the use is lawful will depend on the circumstances of each case, including the purpose and manner of the processing.
FALSE PERSONAL DATA
The NPC’s notice also highlights another important point: an AI-generated image can constitute false personal data. An image showing a real person doing something they never did, saying something they never said, or being somewhere they never were, is considered as false information about that person.4 This matters because AI-generated images are becoming increasingly realistic. What was once obviously computer-generated can now look sufficiently authentic to be mistaken for an actual photograph. A fabricated image therefore could affect a person’s reputation, relationships, employment, or personal safety.
A person whose likeness has been misused may demand its removal by the person or entity that posted or circulated it and may file a complaint with the NPC. Upon acting on the complaint, and where warranted, the Commission may issue compliance or cease-and-desist orders during the investigation. Copies of these orders may also be furnished to online platforms and relevant government agencies for appropriate action. The NPC has likewise called on online platforms to maintain accessible mechanisms for reporting such content and to promptly remove material based on lawful demands.5
PENALTIES
The NPC’s warning also carries potentially serious consequences for those who unlawfully process another person’s personal data, such as using another person’s likeness to create AI-generated images without a lawful basis.
Under Section 25 of the DPA, unauthorized processing of personal information may be punished with imprisonment of one to three years and a fine of P500,000 to P2 million. If sensitive personal information is involved, the penalty increases to three to six years’ imprisonment and a fine of P500,000 to P4 million.6
The NPC’s notice offers a simple reminder: before using another person’s face in an AI tool, consider whether you have a lawful basis to do so. Having access to another person’s photograph does not, by itself, make it lawful to upload or process that photograph using AI. The possession of and the ability to create an image does not necessarily mean having the right to use another person’s likeness.
1 National Privacy Commission (NPC), “Notice to the Public: Use of Real Persons’ Likenesses in AI-Generated Images” (11 August 2026), citing Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA), Sec. 3(g), and NPC Advisory Opinion No. 2023-025. Available at: https://privacy.gov.ph/notice-to-the-public-use-of-real-persons-likenesses-in-ai-generated-images/
2 NPC, supra note 1.
3 DPA, Sec. 12.
4 NPC, supra note 1.
5 Id.
6 DPA, Sec. 25.
(This article is for informational and educational purposes only. It is not offered and does not constitute legal advice or legal opinion.)
Rowen D. Palma is an associate of the Intellectual Property Department and the Data Privacy & Security Group of the Angara Abello Concepcion Regala & Cruz Law Offices (ACCRALAW). He may be contacted through
(02) 8830-8000