On 23 February 2026 multiple data protection authorities worldwide jointly issued a statement on artificial intelligence-generated images and privacy protection. According to public information, the background is that some AI image and video generation systems produce realistic images and video content identifying specific individuals without their knowledge and consent, raising serious privacy and security risks.
What the statement points to
The core logic of the joint statement can be summarised in three points.
First, generated content identifying an individual is personal information processing. Even if the image is not a real photograph, as long as a specific individual can be identified, it falls within the scope of personal information protection law.
Second, informed consent is a basic precondition. Generating an identifiable likeness of a person without their consent may infringe personal information rights.
Third, responsibility does not stop at the generation stage. All parties providing, disseminating and using such content may bear corresponding responsibility.
Why “joint” matters
The joint issuance by multiple regulators reflects the cross-border nature of AI-generated content. An image-generation service typically serves global users, and rules in a single jurisdiction cannot effectively constrain it. The value of the joint statement is that it establishes “generation of content identifying an individual requires consent” as a common baseline across jurisdictions.
This also means companies can no longer avoid risk on the ground that “a country has no explicit rule”. See our multi-jurisdiction service and our note on the EU AI Act transparency rules taking effect.
Implications for image-generation companies
First, the authorisation chain for face and voice features needs rebuilding. If model training data or user-uploaded materials contain identifiable individuals, authorisation must cover the generation purpose. See our note on face-recognition filing and the fifteenth batch of deep-synthesis filings.
Second, “nudifier”-type features are already high-risk. The EU has taken an explicit prohibition stance on nudifier apps; see our note on the European Parliament’s position on the AI Act omnibus. In China, too, there have been rulings on face-swap infringement; see our note on the AI face-swap drama portrait-rights case.
Third, labelling and interception must both be in place. Labelling generated synthetic content is the baseline, and proactively intercepting high-risk requests is the plus. See enforcement of synthetic-content labelling.
Fourth, cross-border data flows need separate assessment. If the generation service involves outbound data, it should be judged by the outbound route; see the PI outbound certification measures and our cross-border data service.
Recommendations
Image and video generation companies can start immediately: review whether existing features carry a risk exposure of generating content identifying individuals; check the scope of authorisation for training data and user materials; establish interception and human-review mechanisms for high-risk prompts; and set out prohibited uses in user agreements.
The joint statement is not directly binding, but it signals the common direction of regulators across countries. For businesses relying on face and likeness generation, the compliance window is narrowing.
This article is based on the joint statement on artificial intelligence-generated images and privacy protection issued by multiple data protection authorities and public reporting. It is for general reference only and does not constitute legal advice.