Every 108 seconds, the Internet Watch Foundation receives a report concerning child sexual abuse material. AI-generated content is growing at a rate of more than 1000% per year. And your platform, your AI tool, or your influencer campaign may be part of this chain — even if you are unaware of it.
Sharenting — the practice of parents posting images of their children on social media — is no longer merely a private decision. It has become a source of legal, reputational, and operational risk for technology companies, platforms, marketing agencies, and every organization that processes images or works with content creators. The rise of AI-generated CSAM (child sexual abuse material generated by artificial intelligence) and deep nude tools is changing the scale of the threat. And three EU regulations — the GDPR, the AI Act, and the DSA — impose obligations on companies that most founders are not even aware of.
In this article, you will find an analysis of the legal risks associated with children’s images online, an overview of current and upcoming regulations, and specific steps your company should take now.
Key concepts and legal framework
Before we move on to business risks, let us clarify the terminology and regulations that will appear later in this article.
| Concept | Meaning |
|---|---|
| Sharenting | The posting of children’s images by parents or guardians on social media and the internet |
| Deep nude | The use of AI to generate realistic nude or intimate images of a person based on their photograph — without their consent |
| CSAM | Child Sexual Abuse Material |
| AI-generated CSAM | CSAM created or manipulated using artificial intelligence tools |
| Biometric data | Personal data resulting from specific technical processing relating to a person’s physical characteristics and enabling their identification — e.g. a facial image (Article 4(14) of the GDPR) |
| GPAI | General-Purpose AI model — e.g. generative models capable of creating images or text |
Three overlapping regulations:
- GDPR (applicable since 25 May 2018) — protects personal data, including children’s biometric data. Article 8 requires the consent of a parent/guardian to process the data of a child under the age of 16 in relation to digital services. Article 9 prohibits the processing of biometric data without an explicit legal basis.
- AI Act (Regulation 2024/1689, phased implementation from 2024 to 2027) — regulates artificial intelligence systems. The prohibitions under Article 5 (prohibited AI practices) have applied since 2 February 2025. From August 2026, there will be an obligation to label synthetic content (Article 50).
- DSA (Digital Services Act) — imposes content moderation obligations on platforms, including CSAM as the primary category of systemic risk for very large platforms.
In addition, there are Polish laws: Article 202 of the Criminal Code (pornography involving minors — punishable by 2 to 12 years’ imprisonment), Article 81 of the Copyright Act (protection of a person’s image), and Article 98 of the Family and Guardianship Code (representation of a child by their parents).
The scale of the problem: why a child’s image online is now a threat
Data from 2024 reveals a scale that demands the attention of every technology company CEO.
| Metric | Value | Source |
|---|---|---|
| CSAM reports submitted to the Internet Watch Foundation (2024) | More than 400,000 | IWF |
| Year-on-year growth in AI-generated CSAM | More than 1000% | IWF |
| Suspected CSAM records reported to Inhope (2024) | Almost 2.5 million (an increase of more than 200% year on year) | Inhope |
| Increase in CSAM reports to NASK/Dyżurnet (2024) | Approx. 400% | NASK |
| CSAM files seized by the Polish Police | More than 2.5 million | Police |
| AI-generated CSAM publicly available online | 99% | IWF |
| Parents who have shared at least one “inappropriate” photo of their child | More than 67% | Scientific research |
| Parents in Poland posting images of their children online | 40–50% | NASK |
These figures translate directly into business risk. Photos of children posted by parents — often in high resolution — become source material for AI tools. A child’s face constitutes biometric data within the meaning of Article 9 of the GDPR. High-quality photographs may be used to bypass biometric security measures or train generative models.
The Polish Data Protection Authority actively responds to these threats. In June 2024, the supervisory authority referred to the public prosecutor the case of a teenage deep nude from a school near Warsaw — students had used an AI tool to generate a nude image of a female classmate. A similar case occurred in Bydgoszcz.
Legal risks for companies: who is liable and for what
Sharenting and deep nudes are not just a problem for parents. Below are specific risk scenarios for companies.
UGC platforms and SaaS solutions with content upload functionality
If you operate a platform where users can upload photos or generate content, your company may unknowingly be storing AI-generated CSAM. The consequences include:
- Criminal liability — Article 202 § 4b of the Criminal Code criminalizes the storage of pornographic content depicting a created or manipulated image of a minor participating in a sexual act. Penalty: 2 to 12 years’ imprisonment.
- Administrative liability — infringement of the GDPR involving a child’s biometric data: a fine of up to EUR 20 million or 4% of annual turnover.
- Reputational risk — a single CSAM case on a platform can destroy a brand. The cost is difficult to estimate, but it is many times higher than the cost of prevention.
The DSA does not impose a general obligation on platforms to proactively monitor content. The model is reactive — notice and action. However, very large platforms (with more than 45 million users in the EU) must conduct an annual systemic risk assessment, including risks associated with CSAM.
For smaller platforms, the lack of a proactive detection obligation does not mean there is no liability. If you receive a report and fail to act promptly, you lose the protection afforded by the “safe harbor” principle.
Companies developing generative AI tools
If you are building an AI tool for photo editing, content generation, or image processing, you must implement safety guardrails that prevent the generation of intimate content using images of real people, with particular attention to minors.
The AI Act and deep nudes — the legal position:
- Article 5 of the AI Act (since 2 February 2025) does not explicitly prohibit the provision of generative tools capable of creating deep nudes. Prohibition No. 2 (exploitation of children’s vulnerabilities) may apply if a system is deliberately designed for harmful uses targeting minors — but it concerns how the tool is used, not merely the provision of a general-purpose tool.
- Article 50 of the AI Act (from August 2026) requires synthetic content to be marked in a machine-readable format — using watermarks, metadata, or cryptographic methods. Failure to implement these mechanisms exposes the provider to penalties.
- Penalties for violating the prohibitions under Article 5: up to EUR 35 million or 7% of global turnover (whichever is higher).
Liability for AI depends on the company’s role in the value chain. It is not only the manufacturer of an AI system that is liable — a company using a generative AI tool is responsible for how it is used, including whether the system generates content that infringes third-party rights.
Employer branding and corporate events
A company organizes a family picnic, Children’s Day celebration, or another event attended by employees’ children. Photos are posted on the company’s social media profile. Without the formal, written consent of both parents/guardians and a GDPR privacy notice, this constitutes an infringement.
| Element | Legal requirement | Legal basis |
|---|---|---|
| Consent to publish a child’s image | Written consent of both parents/legal guardians | Articles 97–98 of the Family and Guardianship Code, Article 81 of the Copyright Act |
| GDPR privacy notice | Mandatory — information on the purpose, scope, and duration of processing | Article 13 of the GDPR |
| Ability to withdraw consent | It must be “as easy to withdraw as to give” | Article 7(3) of the GDPR |
| A child’s face as biometric data | Potentially — where the photograph undergoes specific technical processing that enables identification | Article 4(14) and Article 9 of the GDPR |
The judgment of the Warsaw Court of Appeal of 4 July 2018 (V ACa 484/17) confirms that publishing a child’s image requires the consent of the parents as legal representatives. Verbal consent is insufficient — in the event of a dispute, the company will be unable to prove that it was obtained.
Working with influencers
An influencer working with your e-commerce brand documents her child’s life starting with the ultrasound scan. Your brand becomes indirectly associated with sharenting practices. The reputational risk transfers to the company.
If an influencer features a child’s image in sponsored content and your agreement does not regulate this issue, you have no control over how the minor’s image is used in connection with your brand.
Article 202 of the Criminal Code and AI-generated deep nudes: what Polish law says
This issue raises many questions among technology company founders. The answer depends on whether the victim is a minor.
Minors — generating a deep nude is a criminal offence even without distribution.
Article 202 § 4b of the Criminal Code criminalizes the “production” of pornographic content depicting a created or manipulated image of a minor participating in a sexual act. The term “produces” includes creating content using AI algorithms. The provision does not require an intent to distribute — merely generating and saving the material to a drive satisfies the elements of the offence. The level of realism is irrelevant — both a crude photomontage and a hyperrealistic deepfake are subject to criminal penalties.
Adults — generating a deep nude without distributing it is not a criminal offence.
Under the current provisions of the Criminal Code, there is no provision criminalizing the mere generation of a deep nude of an adult without distributing it. Article 191a of the Criminal Code requires the victim to have actually been naked — with a deep nude, the victim was not actually naked. Article 190a § 2 of the Criminal Code (identity theft) requires “impersonation” in dealings with third parties. Article 212 of the Criminal Code (defamation) and Article 216 of the Criminal Code (insult) require dissemination.
Important: EU Directive 2024/1385 (violence against women) requires Poland to criminalize the creation and sharing of “deep porn” involving adults by June 2027.
Pre-legislative work is underway in Poland — the Ministry of Justice established a working group (announcement of 10 February 2026, Safer Internet Day), and in March 2026 the Extraordinary Committee on Amendments to Codifications held a meeting. No draft amendment to the Criminal Code has yet been published.
Platform obligations: requirements under the DSA and Polish law
Poland’s implementation of the DSA (the amendment to the Act on Providing Services by Electronic Means adopted on 21 November 2025) appointed the President of the Office of Electronic Communications as the Digital Services Coordinator.
Order procedure:
| Element | Details |
|---|---|
| Scope | 27 categories of offences, including the dissemination of CSAM |
| Who issues the order | President of the Office of Electronic Communications or Chairperson of the National Broadcasting Council |
| Time limit for implementation (Police/public prosecutor request) | 2 days |
| Time limit for implementation (user request) | 7 days |
| Complex cases | 21 days |
| Nature | Reactive — initiated upon request |
Note: some AI-generated CSAM — material containing nude images of children that does not depict sexual acts — does not satisfy the elements of an offence under Article 202 of the Criminal Code and is not formally considered “illegal content” within the meaning of the DSA. This is a loophole highlighted by court-appointed experts and the Polish Data Protection Authority. However, manipulating a minor’s image constitutes the processing of personal data and is unlawful under the GDPR — even if it does not satisfy the elements of a criminal offence.
Temporary EU Regulation 2021/1232, which allows communications service providers to voluntarily scan content to detect CSAM, has been extended until April 2026. Poland opposes the mass scanning of private correspondence (end-to-end encryption).
What your company should do: action checklist
Below you will find structured recommendations — from measures you need to implement immediately to those worth planning for the coming months.
Priority actions (implement now)
- Audit marketing and social media materials — review all published content for images of children. Remove any content for which you do not have the written, documented consent of both parents/guardians.
- Internal policy on children’s images — introduce a rule prohibiting the publication of employees’ children in corporate communications or requiring formal consent accompanied by a GDPR privacy notice.
- Integration of CSAM detection tools (if you operate a UGC platform or SaaS solution with photo upload functionality) — consider implementing PhotoDNA (Microsoft, free of charge), CSAI Match (Google), or hash matching. Establish a reporting procedure for NASK/Dyżurnet.
- Safety guardrails for AI tools (if you develop generative AI tools) — implement safeguards that prevent the generation of intimate content using images of real people. Document these as part of your AI Act compliance.
Actions to implement in the coming months
- Update influencer agreements — add a clause prohibiting the use of children’s images in sponsored content or requiring compliance with child protection guidelines.
- Training for marketing, HR, and social media teams — explain the legal risks associated with children’s images online: corporate sharenting, events, and employer branding.
- Review platform/service terms and conditions — ask a lawyer to verify them in terms of liability for AI-generated content and the processing of minors’ biometric data.
Regulatory timeline — key dates to remember
| Date | Event | Impact on the company |
|---|---|---|
| From 2 February 2025 | The prohibitions under Article 5 of the AI Act apply | Check whether your AI systems fall within the scope of prohibited practices |
| From 2 August 2025 | Obligations concerning GPAI models | If you provide or use GPAI models, implement the required procedures |
| April 2026 | Expiry of temporary Regulation 2021/1232 (voluntary CSAM scanning) | Monitor whether it is extended or replaced by the final CSAM regulation |
| From August 2026 | Obligation to label synthetic content (Article 50 of the AI Act) | Implement labeling mechanisms (watermarks, metadata) for AI-generated content |
| June 2027 | Deadline for implementing Directive 2024/1385 (criminalization of adult deep porn) | Prepare for an expansion of criminal liability |
How we can help
The risks associated with children’s images, AI-generated content, and new obligations under the AI Act lie at the intersection of IT law, data protection, compliance, and the day-to-day operations of technology companies.
We combine these areas into a single support model — from audits and documentation to ongoing advice. We help founders and CTOs understand where risks arise within their organizations and implement changes that mitigate them without hindering product development.
Our support includes:
- GDPR audit — verification of whether your company correctly processes biometric data and images of minors, including in marketing materials and on your platform.
- AI compliance — assessment of AI tools’ compliance with the prohibitions under Article 5 of the AI Act, preparation for the transparency obligations under Article 50, and documentation of safety guardrails.
- Platform policies and terms and conditions — review and update of terms and conditions regarding liability for UGC, AI-generated content, and the protection of minors.
- Agreements with influencers and content creators — clauses concerning children’s images, compliance rules, and control mechanisms.
- Team training — practical workshops for marketing, HR, product, and management teams.
If you would like to check whether your company is prepared for these risks, contact us.
Children’s images online: summary and next steps
Sharenting and deep nudes are not abstract threats. They pose risks to UGC platforms, AI tools, influencer campaigns, and corporate events. Three EU regulations — the GDPR, the AI Act, and the DSA — create a multilayered protection regime that imposes obligations on every company processing minors’ images or data.
Penalties for infringements can reach EUR 35 million (AI Act) or EUR 20 million (GDPR). Article 202 § 4b of the Criminal Code criminalizes the mere generation of a deep nude of a minor — with no requirement for it to be distributed.
Start with an audit: review your marketing materials, verify your influencer agreements, and check your platform’s safeguards. The sooner you bring these areas into compliance, the lower your financial, criminal, and reputational risk will be.
If you need legal support regarding the protection of minors’ images, AI Act compliance, or a GDPR audit, contact us.
Frequently asked questions
Could my company face legal problems if someone uploads an AI-generated deep nude of a child to our platform?
Yes. Article 202 § 4b of the Criminal Code criminalizes the storage of pornographic content depicting a created image of a minor participating in a sexual act. If your platform stores such material and you fail to act after becoming aware of its presence, you expose yourself to criminal and administrative liability (GDPR). Implement detection tools (e.g. PhotoDNA) and a reporting procedure for NASK/Dyżurnet.
Can I safely publish photos of employees’ children from corporate events if their parents have given verbal consent?
Verbal consent is insufficient. You need the written consent of both parents/legal guardians, accompanied by a GDPR privacy notice (Article 13). Consent must be specific, informed, and freely given. You must also provide an easy mechanism for withdrawing it (Article 7(3) of the GDPR). Without this, the company may face allegations of infringing the child’s personal rights and data protection laws.
What obligations does the AI Act impose if I am developing a generative AI tool — how can I prevent the creation of deep nudes?
The prohibitions under Article 5 of the AI Act (including the prohibition on exploiting children’s vulnerabilities) have applied since 2 February 2025. From August 2026, you must implement mechanisms for labeling synthetic content (watermarks, metadata — Article 50). Implement safety guardrails that prevent the generation of intimate content using images of real people and document them as part of your compliance framework. Penalties for violating the prohibitions can reach EUR 35 million or 7% of global turnover.
Can an influencer I work with expose my brand to risk by engaging in sharenting?
Yes. If an influencer features a child’s image in sponsored content and your agreement does not regulate this issue, the reputational risk transfers to your company. Update your agreements to include a clause prohibiting the use of children’s images or requiring compliance with child protection guidelines.
Can the Polish Data Protection Authority fine a company in connection with children’s images?
Yes. The Polish Data Protection Authority treats the manipulation of a minor’s image as the processing of personal data, which is unlawful under the GDPR even if it does not satisfy the elements of an offence under Article 202 of the Criminal Code. Administrative fines under the GDPR can reach EUR 20 million or 4% of annual turnover. The Polish Data Protection Authority actively refers deep nude cases involving minors to the public prosecutor — as in the case of the school near Warsaw in June 2024.
What should I do if I receive a report that CSAM or deep nude content has appeared on my platform?
Act immediately. Secure the evidence, block access to the content, report the case to NASK/Dyżurnet.pl and, if a criminal offence is suspected, to the public prosecutor. Poland’s DSA order procedure provides response times ranging from 2 to 21 days, but any delay in acting will deprive you of the protection afforded by the DSA’s “safe harbor” principle.
