Children’s Images Online: Legal and Operational Risks for Companies in Poland
Every 108 seconds, the Internet Watch Foundation receives a report concerning child sexual abuse material. Reports of AI-generated child sexual abuse material are growing by more than 1,000% year on year. Your platform, AI tool, or influencer campaign could be part of the chain through which images are obtained or circulated—even if you are unaware of it.
Sharenting—parents or guardians posting images of children online—is no longer only a private matter. It creates legal, reputational, and operational risks for technology companies, platforms, marketing agencies, and other organizations that handle children’s images or work with content creators. AI-generated child sexual abuse material (CSAM) and “deep nude” tools increase those risks.
For a business operating in Poland, the relevant rules span the EU General Data Protection Regulation (GDPR), the EU AI Act, the Digital Services Act (DSA), and Polish law. This article explains how those rules intersect and what companies should review now.
Key terms and legal framework
| Term | Meaning |
|---|---|
| Sharenting | Parents or guardians posting children’s images on social media or elsewhere online. |
| Deep nude | An AI-generated realistic nude or intimate image created from a person’s photograph without their consent. |
| CSAM | Child sexual abuse material. |
| AI-generated CSAM | CSAM created or manipulated using AI tools. |
| Biometric data | Personal data resulting from specific technical processing of a person’s physical characteristics that enables identification—for example, a facial image processed for that purpose (Article 4(14) GDPR). |
| GPAI | A general-purpose AI model, such as a generative model capable of producing images or text. |
Three overlapping EU regulations matter:
- GDPR, applicable since May 25, 2018, protects personal data, including children’s biometric data. Article 8 addresses parental or guardian consent for processing a child’s data in connection with digital services where the child is under 16. Article 9 restricts the processing of biometric data without an explicit legal basis.
- AI Act (Regulation 2024/1689), being phased in from 2024 to 2027, regulates AI systems. Its Article 5 prohibitions have applied since February 2, 2025. Article 50 obligations concerning the marking of synthetic content are scheduled to apply from August 2026.
- DSA imposes content-moderation obligations on platforms. For very large platforms, CSAM is a key category of systemic risk.
Businesses dealing with Poland must also consider Polish law: Article 202 of the Polish Criminal Code addresses pornography involving minors, with penalties of two to 12 years’ imprisonment; Article 81 of the Polish Copyright Act protects a person’s image; and Article 98 of the Polish Family and Guardianship Code concerns parents’ representation of their child.
Why children’s images online create business risk
The figures cited in the approved source illustrate the scale of the issue:
| Measure | Figure | Source |
|---|---|---|
| CSAM reports received by the Internet Watch Foundation in 2024 | More than 400,000 | IWF |
| Year-on-year growth in AI-generated CSAM | More than 1,000% | IWF |
| Suspected CSAM records reported to INHOPE in 2024 | Almost 2.5 million; more than 200% growth year on year | INHOPE |
| Increase in CSAM reports to NASK/Dyżurnet in 2024 | Approximately 400% | NASK |
| CSAM files seized by Polish police | More than 2.5 million | Police |
| AI-generated CSAM publicly available online | 99% | IWF |
| Parents who have shared at least one “inappropriate” photo of their child | More than 67% | Scientific research |
| Parents in Poland who post images of their children online | 40–50% | NASK |
High-resolution photographs posted by parents can become source material for AI tools. They may be used to train generative models or attempt to defeat biometric security measures. A facial photograph may also become biometric data under the GDPR when it undergoes specific technical processing that enables identification.
The Polish data protection authority, UODO, has responded to cases involving manipulated images of minors. In June 2024, it referred to prosecutors a case involving students at a school near Warsaw who used an AI tool to generate a nude image of a teenage classmate. A similar case occurred in Bydgoszcz.
Where companies face exposure
User-generated-content platforms and upload-enabled software
A platform that lets users upload photographs or generate images may store AI-generated CSAM without initially knowing it. The source identifies three types of exposure:
- Criminal: Article 202 § 4b of the Polish Criminal Code penalizes storing pornographic content depicting a created or manipulated image of a minor participating in a sexual act. The stated penalty is two to 12 years’ imprisonment.
- Administrative: GDPR infringements involving a child’s biometric data can attract fines of up to EUR 20 million or 4% of annual turnover.
- Reputational: A CSAM incident can cause serious brand damage, potentially far exceeding the cost of preventive controls.
The DSA does not impose a general obligation to proactively monitor all content. Its notice-and-action model is reactive. Very large platforms—those with more than 45 million users in the EU—must, however, carry out annual systemic risk assessments that include CSAM-related risks.
Smaller platforms should not equate the absence of a general proactive-detection duty with an absence of responsibility. The source warns that failure to act promptly after receiving a report can jeopardize safe-harbor protection.
Developers and users of generative AI
If your company develops an AI photo-editing, content-generation, or image-processing tool, implement safeguards designed to prevent intimate images of real people from being generated, with particular attention to minors.
The AI Act position requires a distinction:
- Article 5 does not expressly prohibit supplying every generative tool capable of making deep nudes. Its prohibition concerning the exploitation of children’s vulnerabilities may apply where a system is deliberately designed for harmful uses targeting minors. The source distinguishes that use from merely supplying a general-purpose tool.
- Article 50 introduces synthetic-content marking obligations from August 2026. The source identifies machine-readable approaches such as watermarks, metadata, and cryptographic methods. Failure to implement applicable mechanisms can expose a provider to penalties.
- Breaching Article 5 prohibitions can result in penalties of up to EUR 35 million or 7% of global turnover, whichever is higher.
A company’s responsibilities depend on its position in the AI value chain. Exposure is not confined to the provider of an AI system: a company using a generative tool must also consider how it uses that tool and whether its outputs infringe others’ rights.
Employer branding and company events
Suppose a company holds a family picnic or Children’s Day event in Poland and posts photographs of employees’ children on its social media accounts. The source’s position is that doing so without formal, written consent from both parents or legal guardians and a GDPR privacy notice constitutes an infringement.
| Issue | Requirement described in the source | Legal basis cited |
|---|---|---|
| Publishing a child’s image | Written consent from both parents or legal guardians | Articles 97–98, Polish Family and Guardianship Code; Article 81, Polish Copyright Act |
| GDPR privacy notice | Information about the purpose, scope, and duration of processing | Article 13 GDPR |
| Withdrawal of consent | Withdrawal must be as easy as giving consent | Article 7(3) GDPR |
| A child’s face as biometric data | Possible where a photograph undergoes specific technical processing enabling identification | Articles 4(14) and 9 GDPR |
The source cites a Warsaw Court of Appeal judgment of July 4, 2018 (V ACa 484/17) as confirming the need for consent from parents acting as legal representatives. It advises against relying on verbal consent: in a dispute, a company may be unable to prove that consent was obtained.
Influencer partnerships
An influencer working with your brand may routinely post images of their child, including in sponsored content. Even if the influencer controls the account, audiences may associate those practices with your business.
If your agreement says nothing about children’s images, you have limited contractual control over how a minor’s image appears alongside your brand. Address the issue expressly in influencer agreements.
AI-generated deep nudes under Polish criminal law
The distinction drawn in the source turns on whether the person depicted is a minor.
Minors: the source states that generating qualifying material is punishable even without distribution. Article 202 § 4b of the Polish Criminal Code covers the “production” of pornographic content depicting a created or manipulated image of a minor participating in a sexual act. On the source’s reading, production includes creation using AI algorithms. It does not require an intention to distribute: generating and saving qualifying material to a drive satisfies the elements of the offense. The source also states that the degree of realism—whether a crude photomontage or a convincing deepfake—does not change that conclusion.
Adults: the source states that merely generating a deep nude without distributing it is not, under the Criminal Code provisions it discusses, a criminal offense. It explains that Article 191a requires the person to have actually been naked; Article 190a § 2 requires impersonation in dealings with third parties; and Articles 212 and 216 require dissemination.
The source also notes that EU Directive 2024/1385, concerning violence against women, requires Poland to criminalize the creation and sharing of “deep porn” involving adults by June 2027. It reports pre-legislative work in Poland: the Ministry of Justice announced a working group on February 10, 2026, and an extraordinary parliamentary committee met in March 2026. According to the source, no draft Criminal Code amendment had yet been published.
Platform duties under the DSA and Polish rules
The source states that a Polish amendment to the Act on Providing Services by Electronic Means, adopted on November 21, 2025, designated the President of the Office of Electronic Communications (UKE) as Poland’s Digital Services Coordinator. It describes the following request-driven order procedure:
| Element | Procedure described in the source |
|---|---|
| Scope | 27 categories of offenses, including CSAM distribution |
| Authority issuing an order | President of UKE or Chairperson of the National Broadcasting Council (KRRiT) |
| Police or prosecutor request | Two-day period |
| User request | Seven-day period |
| Complex cases | 21-day period |
| Approach | Reactive; initiated on request |
A qualification matters here. The source says that some AI-generated material containing nude images of children without a depiction of sexual acts does not meet the elements of an Article 202 offense and therefore is not formally “illegal content” under the DSA on that basis. It identifies this as a gap noted by court-appointed experts and UODO. At the same time, the source treats manipulation of a minor’s image as personal-data processing that is unlawful under the GDPR, even where the elements of that criminal offense are not met.
Temporary EU Regulation 2021/1232, which permits certain voluntary CSAM-detection scanning by communications service providers, was extended until April 2026, according to the source. Poland opposes mass scanning of private end-to-end encrypted correspondence.
Action checklist for your company
Priorities to address now
- Audit marketing and social media content. Identify published images of children. The source recommends removing those for which you lack documented, written consent from both parents or legal guardians.
- Adopt an internal policy on children’s images. Either prohibit images of employees’ children in company communications or require formal consent and an accompanying GDPR privacy notice.
- Assess CSAM detection for upload-enabled services. If you run a user-generated-content platform or software that accepts photo uploads, consider PhotoDNA (Microsoft, described in the source as free of charge), Google’s CSAI Match, or hash matching. Establish a process for reporting to NASK/Dyżurnet, Poland’s relevant reporting channel.
- Build safeguards into generative AI tools. Prevent the generation of intimate content using images of real people, and document those controls as part of your AI Act compliance work.
Steps for the coming months
- Update influencer agreements. Prohibit children’s images in sponsored content or require compliance with child-protection guidelines.
- Train marketing, HR, and social media teams. Cover company events, employer branding, and the risks of corporate sharenting.
- Review platform terms and policies with counsel. Address AI-generated user content and the processing of minors’ biometric data.
Regulatory dates to track
| Date | Development identified in the source | Business action |
|---|---|---|
| February 2, 2025 | AI Act Article 5 prohibitions began to apply | Check whether any AI system or use falls within a prohibited practice. |
| August 2, 2025 | Obligations concerning GPAI models began to apply | If you provide or use GPAI models, assess the procedures relevant to your role. |
| April 2026 | Stated expiry of temporary Regulation 2021/1232 | Monitor whether the voluntary-scanning framework is extended or replaced. |
| August 2026 | AI Act Article 50 synthetic-content marking obligations begin to apply | Prepare applicable marking mechanisms, including watermarks or metadata. |
| June 2027 | Deadline identified for implementing Directive 2024/1385 | Monitor Polish legislation concerning adult “deep porn.” |
How we can help
Children’s images and AI-generated content sit at the intersection of IT law, data protection, platform governance, and day-to-day operations. We help founders, CTOs, and management teams identify where those risks arise and implement controls without unnecessarily obstructing product development.
Our work includes:
- GDPR audits covering children’s images and biometric data in marketing materials and on platforms.
- AI compliance assessments addressing Article 5 prohibitions, Article 50 transparency obligations, and documentation of safeguards.
- Platform terms and policies covering user-generated and AI-generated content and the protection of minors.
- Influencer and creator agreements with provisions on children’s images, compliance, and oversight.
- Practical training for marketing, HR, product, and management teams.
If you would like to assess your company’s position, contact us.
Frequently asked questions
Could my company face legal problems if someone uploads an AI-generated deep nude of a child to our platform?
Yes. The source identifies criminal-law exposure under Article 202 § 4b for storing qualifying pornographic material depicting a created image of a minor participating in a sexual act. If your platform stores it and you fail to respond after learning of it, you also face the liability and GDPR risks discussed above. Consider detection tools such as PhotoDNA and establish a reporting procedure for NASK/Dyżurnet.
Can we publish photographs of employees’ children from a company event if their parents agreed verbally?
Do not rely on verbal agreement. The source calls for documented, written consent from both parents or legal guardians, together with an Article 13 GDPR privacy notice. Consent should be specific, informed, and freely given, with an easy way to withdraw it under Article 7(3). Without documentation, the company may face disputes concerning the child’s personal rights and data protection.
What should a generative AI developer do to prevent deep nudes?
Assess the applicable AI Act obligations, including the Article 5 prohibitions already in force and the Article 50 synthetic-content marking obligations scheduled from August 2026. Implement and document safeguards against generating intimate images of real people, particularly minors. The source notes that penalties for breaching Article 5 prohibitions can reach EUR 35 million or 7% of global turnover.
Can an influencer’s sharenting affect our brand?
Yes. A child’s image in sponsored content can create reputational risk for your business. Use your agreement to prohibit that use or require compliance with child-protection guidelines.
Can UODO fine a company over its use of children’s images?
Yes. The source states that manipulating a minor’s image constitutes personal-data processing and may be unlawful under the GDPR even where the material does not meet the elements of an Article 202 criminal offense. GDPR administrative fines can reach EUR 20 million or 4% of annual turnover. UODO has also referred cases involving minors’ deep nudes to prosecutors, including the June 2024 case near Warsaw.
What should we do when someone reports CSAM or a deep nude on our platform?
Act promptly: secure evidence, block access to the content, report it to NASK/Dyżurnet.pl, and contact prosecutors if you suspect a crime. The Polish order procedure described above has periods ranging from two to 21 days, but the source cautions that delaying action after a report can put DSA safe-harbor protection at risk.