This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
In September 2023, a scandal emerged in Almendralejo, Spain, where over 20 underage girls were targeted by classmates using an AI application called 'ClothOff' to create and circulate non-consensual naked images of them. The images were derived from photos taken from the victims' social media profiles and were used for harassment, bullying, and at least one documented case of extortion. The incident sparked a national debate in Spain regarding the legal classification of AI-generated non-consensual sexual content and the adequacy of existing laws to protect minors from digital violence.
In Spain, an AI app was used to digitally alter photos of young girls, making them appear naked. This manipulation sparked an investigation after these images were circulated in Almendralejo, a town in the Extremadura region, raising serious concerns about digital privacy violations and the potential spread of these images on pornographic sites.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The AI system was used to generate and expose minors to highly toxic, non-consensual sexually explicit content.
The incident involved the targeted creation of humiliating sexual imagery of specific victims to harass them, with at least one case of attempted blackmail/extortion.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The harm was caused by the intentional actions of human users (the schoolboys) who chose to generate and distribute non-consensual deepfakes using a post-deployment AI application.
Added categories peak at 3: Substantial (Child Sexual Exploitation & Abuse (CSEA), Direct)
Local minors in Spain used a consumer AI application to generate and distribute non-consensual explicit images of classmates. While the incident caused severe psychological harm to the victims and initiated national discussions on legal reform regarding synthetic media, its national security implications remain minor and are addressed through domestic law enforcement and legislative channels.
The ClothOff app operates as a simple tool that performs a specific, well-defined function of image manipulation based on direct user uploads without autonomous planning.
Limited Risk: The report describes the use of an AI system to generate deepfakes, which falls under the Limited Risk category of the EU AI Act.
The primary function of the ClothOff app is to generate deepfake naked images by digitally removing clothes from uploaded photos.
The reports from multiple reputable news agencies provide highly consistent and detailed accounts of the incident, the specific AI app used, the demographics of the victims and perpetrators, and the resulting harms.
None, the role of the AI app in generating the non-consensual imagery is clear and undisputed.
Technology
Accessible Deepfake Generation
AI apps allow anyone to generate hyper-realistic nudes for a low cost.
Bypassed App Safeguards
App safeguards were bypassed using a combination of different applications.
Automated Stripping Tools
Automated services make undressing women extremely easy for non-experts.
Data Inputs
Public Social Media Photos
Clothed photos were easily harvested from victims' Instagram profiles.
Human Factors
Lack of Minor Digital Literacy
Teenagers treated the harmful deepfake creation as a joke.
Malicious Extortion Intent
Some perpetrators used the fake images to blackmail victims for money.
Inadequate Parental Oversight
Parents failed to monitor or restrict their children's smartphone usage.
Process and Methods
Flawed Search Engine Ranking
Search engines indexed and highly ranked nudify apps, making them easy to find.
Ineffective App Age Verification
The app lacked robust methods to verify age or consent of those depicted.
Easy Messaging App Distribution
WhatsApp and Telegram groups allowed rapid dissemination of the fake images.
Management
Prioritizing Fun Over Safety
App creators designed the tool to 'make people laugh' without safety controls.
Reliance on User Policy Compliance
Management relied on users to follow guidelines rather than enforcing consent.
Regulatory Environment
Legal Loopholes for AI Nudes
Current laws struggle to classify non-consensual AI nudes as child pornography.
Age of Criminal Responsibility
Spanish law prevents prosecuting perpetrators who are under 14 years old.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
