Part of the AI Regulation News hub.
The Philippine National Privacy Commission says generating and sharing AI images of a real person is processing of personal data, and that a fabricated image is false personal data
Correction, October 1, 2026. This article removes unsupported conclusions about service of orders, the absence of enforcement actions and existing consent practices. It distinguishes the notice's wording from unverified conclusions about platform obligations and legal effect. The original publication date is unchanged.
The NPC describes generating and sharing synthetic media of identifiable people as personal-data processing. Its notice explains lawful-basis requirements, a complaint route and possible orders, without excluding remedies under other laws.
Bottom line: This public notice presents the Commission's reminders under the Data Privacy Act. It cites existing provisions, carries no circular number of its own and states no separate compliance date. We have not reviewed the underlying legislation or determined the notice's independent legal effect.
Who this affects: Marketing and communications leads who approve AI-generated imagery, HR and internal comms teams using staff faces, agency and PR counsel, media lawyers, and executives whose own likeness is a campaign asset. Anyone signing off on synthetic imagery of an identifiable person in the Philippines.
Issue date: 11 August 2026, timestamped 2:15 PM on the Commission site, with a last-edit stamp the same day. No comment deadline and no compliance date, because the notice sets none.
What changed: The Commission has now said in writing that using an AI tool to generate an image or video from a real person's face, and posting or sharing the result, are forms of processing under the DPA, and that a fabricated image or video is false personal data reachable by the section 16(e) right to demand blocking, removal or destruction.
Analysis: The notice describes a complaint to the Commission and investigations on complaint or on its own initiative. It says compliance or cease-and-desist orders may be issued where warranted. Those statements do not establish that a new forum has been created or that other remedies are displaced.
Primary sources: NOTICE TO THE PUBLIC: Use of Real Persons' Likenesses in AI-Generated Images (NPC, 11 August 2026)
- Instrument (EN)
- Notice to the Public: Use of Real Persons' Likenesses in AI-Generated Images
- Authority
- National Privacy Commission (NPC), Philippines
- Jurisdiction
- Philippines
- Status
- Published on the Commission website. No circular number, no docket number, no consultation stage attached.
- Bindingness
- A public notice explaining the Commission's position under cited existing law. This review does not independently establish the legal effect of the notice or the full requirements of the underlying provisions.
- Statutory hooks cited
- RA 10173 sections 3(g), 7, 12, 16(e) and 25; IRR sections 5 and 5(b); NPC Advisory Opinion 2023-025; NPC Advisory 2022-01
- Issue date / next deadline
- Issued 11 August 2026. No deadline set.
- Enforcement to date
- None cited in the notice. The Commission describes powers it may use, not cases it has brought.
- Primary source
- https://privacy.gov.ph/notice-to-the-public-use-of-real-persons-likenesses-in-ai-generated-images/
Informational analysis for working professionals, not legal advice. Confirm applicable obligations with qualified counsel.
What the notice actually says
The Commission opens with an observation, not a finding: it has seen more synthetic media circulating that depicts real, identifiable people. From there it makes the move that matters. A person's face and likeness are personal information under RA 10173, and in some cases photographic and videographic media may also be biometric information that directly identifies the individual. The Commission cites its own Advisory Opinion 2023-025 for that second point.
Then the operative sentence. Using AI tools to generate an image or video from a real person's face and likeness, and posting or sharing the result, are on the Commission's account forms of processing of personal data, whatever the nature or purpose of the resulting media. The notice also addresses purpose-based protections and lawful bases, so the processing characterisation alone does not decide whether a particular use is unlawful.
The notice says these acts must have a legitimate purpose and must conform to one of the criteria for lawful processing. It also does something useful for anyone who has been told consent is the only route: it says consent is the most recognizable criterion but the DPA provides other bases depending on the circumstances of each case.
False personal data, and why that phrase is the hinge
The Commission describes a fabricated image or video as false personal data. That includes AI-generated media showing a real person doing something they never did, saying something they never said or being somewhere they never were.
That framing plugs the harm into section 16(e), which the notice describes as giving a data subject the right to demand blocking, removal or destruction of personal data upon substantial proof that the data is false. The notice adds that this right may be enforced through a complaint before the Commission.
The notice requires substantial proof of falsity. It does not say an assertion alone is enough or make removal automatic for every unflattering synthetic image.
The speech carve-out is real but narrow
The Commission does not pretend the DPA overrides expression. It acknowledges that satire, parody, commentary and reporting on matters of public interest may fall under the constitutional right to freedom of speech, expression or the press, and that the DPA does not apply to processing for journalistic, artistic or literary purposes, citing IRR sections 5 and 5(b).
The limiting language follows immediately. Those protections attach to the purposes behind the use of a likeness only to the minimum extent suitable and necessary to achieve them. Whether a given piece of synthetic media qualifies depends on the circumstances of each instance, and the Commission lists three things it will look at: whether the image is presented as real, whether its synthetic character is disclosed, and whether the use of the person's actual photorealistic likeness is necessary for the purpose.
A communications team can use the necessity factor to ask whether the real person's face is needed or another image would serve the purpose. That is a practical suggestion, not a test stated in the notice.
The notice recognises public officials as data subjects whose privacy should be weighed against the right to information on matters of public concern. It also states that a fabricated image or video depicts no actual conduct and conveys no information about an official function.
Family members of public officials who do not themselves hold public office are private individuals with full DPA protection, and the Commission says it will treat complaints involving the likenesses of minors with utmost priority.
What a complaint can reach, and what platforms are told
The notice describes removal demands, complaints and Commission investigations. A person whose likeness has been misused may demand removal from whoever posted or circulated it, and may file a complaint with the Commission. The Commission may then investigate on the basis of the complaint or on its own initiative, and may issue compliance orders or cease-and-desist orders during the investigation where warranted. Section 7 of the DPA is the cited footing.
Copies of orders may be furnished to online platforms and relevant government agencies for appropriate action. The notice does not resolve service requirements, territorial jurisdiction or the legal effect of furnishing a copy to a particular platform.
The notice says platforms are expected to provide accessible reporting mechanisms and promptly remove content based on lawful demands made by affected persons, in accordance with applicable law and their policies. It sets no numerical removal deadline. The word "expected" does not by itself determine whether a platform has obligations under other applicable provisions.
The notice says creating synthetic media from a person's face and likeness without a lawful basis may amount to unauthorized processing under section 25. Depending on the extent of processing, other penal provisions may also apply, with criminal penalties and possible civil and administrative liabilities; the notice does not determine liability in a particular case.
The workflow change for anyone approving AI imagery
For imagery involving an identifiable person, assess the purpose, lawful basis and applicable protections described in the notice. This review has not established how particular organisations' approval checklists address those questions.
Review the actual terms and circumstances for staff, customer and public-figure imagery. Do not assume that a consent or release covers synthetic media without checking it. For the purpose-based protections discussed in the notice, relevant circumstances include presentation as real, disclosure of synthetic character and necessity of the photorealistic likeness.
Disclosure of synthetic character is one circumstance the Commission names. The notice does not specify that labelling alone provides a safe harbour.
The notice cites no particular enforcement action. That omission does not establish that none exists. This review did not conduct a systematic search of enforcement records or later developments.
What we did not verify
This update read the complete official NPC notice, including all six footnotes. The page is dated August 11, 2026 at 2:15 PM and carries a last-edit stamp for the same day. The pull quote matches the notice; practical suggestions are distinguished from its stated requirements.
We did not open the underlying materials the notice cites: RA 10173 and its Implementing Rules, NPC Advisory Opinion 2023-025 on biometric information, or NPC Advisory 2022-01 on requests for personal data of public officers. We took the section numbers and the footnote references as the notice states them and did not independently confirm the text of those provisions. We also did not check whether the notice was separately published in the Official Gazette or issued in any numbered series, and we found no circular or docket number on the page.
The notice does not establish that every AI image of a real person is unlawful; it expressly recognises lawful bases besides consent and discusses purpose-based protections. Its wording does not resolve a platform's complete legal duties, the adequacy of service of an order or the result in a particular case. Enforcement history and judicial treatment were not reviewed.
The notice calls for a lawful basis for processing identifiable people's likenesses and describes removal demands and complaints to the Commission. Assess the actual use, applicable protections and any demand received. The notice does not specify whether a generic release covers a particular use. The notice states that violations carry criminal penalties and possible civil and administrative liabilities without prejudice to remedies found in other laws.
Source File
https://privacy.gov.ph/notice-to-the-public-use-of-real-persons-likenesses-in-ai-generated-images/
Open the NPC notice at privacy.gov.ph and confirm three things. First, the date line reads August 11, 2026 2:15 PM and the notice itself is not assigned a circular or issuance number. Second, the third paragraph contains the sentence quoted below and ties it to section 16(e) and to a complaint before the Commission. Third, the platform sentence in the penultimate substantive paragraph uses "are expected to" and is qualified by "in accordance with applicable law and their own policies", without treating that sentence as a complete account of platform obligations.
The Commission emphasizes that a fabricated image or video is false personal data. ยท National Privacy Commission, Notice to the Public, 11 August 2026
FAQ
Is this a new law or regulation in the Philippines?
The page presents a public notice and reminders under the existing Data Privacy Act, rather than a newly enacted statute. It carries no circular number of its own. This review has not independently assessed its legal effect or the underlying provisions.
Does this mean every AI-generated image of a real person is unlawful?
No, and the notice says otherwise. It states that processing must have a legitimate purpose and meet one of the criteria for lawful processing, and that while consent is the most recognizable criterion, the DPA provides other bases depending on the circumstances. The risk it identifies is generating and circulating a likeness with no lawful basis at all.
Are platforms now required to take content down on request?
The notice says platforms are expected to provide accessible reporting mechanisms and promptly remove content based on lawful demands made by affected persons, in accordance with applicable law and their policies. It does not specify a numerical deadline or determine every platform obligation. Applicable law and the particular demand require separate review.
Has the NPC enforced this position against anyone?
The notice cites no particular enforcement action and describes powers the Commission may use. This review did not systematically check enforcement records, so the absence of an example in the notice should not be read as proof that no action exists. The notice also states priority for complaints involving the likenesses of minors.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.