The Philippine National Privacy Commission says generating and sharing AI images of a real person is processing of personal data, and that a fabricated image is false personal data

What the notice actually says

The Commission opens with an observation, not a finding: it has seen more synthetic media circulating that depicts real, identifiable people. From there it makes the move that matters. A person's face and likeness are personal information under RA 10173, and in some cases photographic and videographic media may also be biometric information that directly identifies the individual. The Commission cites its own Advisory Opinion 2023-025 for that second point.

Then the operative sentence. Using AI tools to generate an image or video from a real person's face and likeness, and posting or sharing the result, are on the Commission's account forms of processing of personal data, whatever the nature or purpose of the resulting media. That last clause does a lot of work. It refuses to carve out the flattering, the harmless, or the obviously fake.

If it is processing, the ordinary DPA machinery attaches. The notice says these acts must have a legitimate purpose and must conform to one of the criteria for lawful processing. It also does something useful for anyone who has been told consent is the only route: it says consent is the most recognizable criterion but the DPA provides other bases depending on the circumstances of each case.

False personal data, and why that phrase is the hinge

The Commission's characterisation is short and quotable: a fabricated image or video is false personal data. It then spells out what falsity means here. AI-generated media showing a real person doing something the person never did, saying something the person never said, or being somewhere the person never was, is false information about that person.

That framing plugs the harm into section 16(e), which the notice describes as giving a data subject the right to demand blocking, removal or destruction of personal data upon substantial proof that the data is false. The notice adds that this right may be enforced through a complaint before the Commission.

Note the qualifier the Commission kept in. Substantial proof is still required. The notice does not say an assertion of falsity is enough, and nothing in it converts every unflattering synthetic image into an automatic takedown.

The speech carve-out is real but narrow

The Commission does not pretend the DPA overrides expression. It acknowledges that satire, parody, commentary and reporting on matters of public interest may fall under the constitutional right to freedom of speech, expression or the press, and that the DPA does not apply to processing for journalistic, artistic or literary purposes, citing IRR sections 5 and 5(b).

The limiting language follows immediately. Those protections attach to the purposes behind the use of a likeness only to the minimum extent suitable and necessary to achieve them. Whether a given piece of synthetic media qualifies depends on the circumstances of each instance, and the Commission lists three things it will look at: whether the image is presented as real, whether its synthetic character is disclosed, and whether the use of the person's actual photorealistic likeness is necessary for the purpose.

For a communications team, that third factor is the practical one. It invites the question of whether you needed this real person's face at all, or whether a generic or licensed face would have served. That is an inference about how the factor will be applied in practice, not something the notice states.

On public officials the notice is blunt. They are data subjects; their privacy is weighed against the right to information on matters of public concern; but a fabricated image or video depicts no actual conduct and conveys no information about the discharge of any official function. Family members who hold no office are private individuals with full DPA protection, and the Commission says it will treat complaints involving the likenesses of minors with utmost priority.

What a complaint can reach, and what platforms are told

The remedy path in the notice runs in two steps. A person whose likeness has been misused may demand removal from whoever posted or circulated it, and may file a complaint with the Commission. The Commission may then investigate on the basis of the complaint or on its own initiative, and may issue compliance orders or cease-and-desist orders during the investigation where warranted. Section 7 of the DPA is the cited footing.

Copies of such orders may be furnished to online platforms and to relevant government agencies for appropriate action. That is the leverage: the order does not have to be served on a foreign platform to reach it, it can travel to the platform as a copy.

Platforms themselves get an expectation, not a mandate. The notice says online platforms are expected to provide accessible mechanisms for reporting such content and for promptly removing it based on lawful demands made by affected persons, in accordance with applicable law and their own policies. Read the modal verb. Expected, not required, and hedged by the platform's own policies. No timetable, no penalty, no notice-and-takedown regime is created here.

On the criminal end, the notice says use of a person's face and likeness to create synthetic media without any lawful basis may amount to unauthorized processing under section 25, and that depending on the extent of the processing it may also breach other penal provisions, carrying criminal penalties and possible civil and administrative liabilities. May amount to. The notice asserts exposure, not liability.

The workflow change for anyone approving AI imagery

If your organisation touches the Philippines and your creative pipeline generates images of identifiable people, the notice implies an approval question that most sign-off checklists do not currently ask: what is our lawful basis for this specific face. Not whether the image is defamatory, not whether it is on-brand. The basis.

Three categories are worth separating in your own process. Staff and executives, where you may already hold a consent or an employment-context basis but probably drafted it before generative tools existed. Clients and customers, where a testimonial release almost certainly did not contemplate synthesis. And public figures used in campaign or commentary material, where the Commission's three factors, presentation as real, disclosure of synthetic character, and necessity of the photorealistic likeness, are the ones it says it will weigh.

Disclosure of synthetic character is the cheapest of the three to fix, and it is the one the Commission names explicitly. That does not make labelling a defence. The notice presents it as one circumstance among several, not a safe harbour, and we are not going to dress it up as one.

There is no enforcement record to calibrate against. The Commission describes powers it may exercise and priorities it will apply; it cites no case it has brought under this reading. Anyone telling you how the NPC decides these matters is extrapolating, because there is nothing yet to extrapolate from.

What we did not verify

We opened and read the primary source in full: the NPC notice at privacy.gov.ph, including all six footnotes, dated 11 August 2026 with a site timestamp of 2:15 PM and a last-edit stamp of the same day. The pull quote in this piece was character-matched against that text. Every characterisation above is drawn from that page and nothing else.

We did not open the underlying materials the notice cites: RA 10173 and its Implementing Rules, NPC Advisory Opinion 2023-025 on biometric information, or NPC Advisory 2022-01 on requests for personal data of public officers. We took the section numbers and the footnote references as the notice states them and did not independently confirm the text of those provisions. We also did not check whether the notice was separately published in the Official Gazette or issued in any numbered series, and we found no circular or docket number on the page.

We refuse to claim the following. That this notice is a regulation, a circular or a new offence, because it presents itself as none of those. That any AI image of a real person is unlawful, because the notice expressly says other lawful bases besides consent may apply. That platforms are now legally obliged to run a takedown mechanism, because the word used is expected and the obligation is conditioned on applicable law and the platform's own policies. That the Commission has enforced this reading, because the notice cites no enforcement action and we found none. And we make no claim about how a Philippine court would treat this interpretation if it were tested.

Related briefings

• NPC advisory on data scraping as personal data processing
• Spain: AEPD treats deepfakes as unlawful processing
• Ireland: DPC inquiry into X and Grok sexualised images
• India: Delhi High Court likeness takedown order
• AI Regulation News hub