Deepfakes of Students: Where EU Law Stands, and What a School Needs Before It Happens

In September 2023, parents in the Spanish town of Almendralejo reported that fake nude images of their daughters were circulating in WhatsApp groups. About twenty girls were affected. The following summer, a youth court in Badajoz put fifteen schoolboys on a year’s probation. The faces had been taken from the girls’ own social media profiles.

Nothing in that case needed special skill. It needed a photo and an app. That’s why it belongs in a school’s planning, and not only in the news.

It isn’t only students, and it isn’t only images

In January 2024, a recording of a high-school principal in Maryland making racist remarks spread through his school community. He received threats and was removed from his post. The recording was fake. The school’s athletic director had made it with AI, and in April 2025 he was sentenced to four months in jail.

A cloned voice, an adult, a member of staff as the target. A policy written around students sharing photos doesn’t cover any of it.

Where EU law now stands

In May 2024 the EU adopted Directive 2024/1385 on combating violence against women and domestic violence. Article 5 requires member states to make it a criminal offence to produce or alter, and then make public, “images, videos or similar material making it appear as though a person is engaged in sexually explicit activities, without that person’s consent”. Threatening to do it is covered too. The directive’s own explanation names deepfakes and artificial intelligence.

Member states have until 14 June 2027 to write this into national law. Denmark isn’t bound by the directive.

Three limits are worth knowing, and none of this is legal advice:

• It’s a directive. What applies in your country today is your national law, which may already go further. The Badajoz court didn’t wait for it: it convicted under existing offences, including creating child abuse material.
• The wording is narrow. The offence is about material made “accessible to the public” and “likely to cause serious harm”. How a court reads those words for a class group chat isn’t something we can tell you.
• Children change the picture. Where the person shown is a child, older and stricter rules on child sexual abuse material come into play, as they did in Badajoz.

The same directive has a line that speaks to schools directly. Preventive measures must include “the development of digital literacy skills, including critical engagement with the digital world and critical thinking to enable users to identify and address cases of cyber violence, to seek support and to prevent its perpetration”. Teaching isn’t an add-on in this law. It’s written into it.

A separate EU rule, Article 50 of the AI Act, now requires deepfakes to be disclosed and AI-generated content to be marked. We’ve written about what that changes for a school separately.

The evidence rule reverses

When we wrote about the EU’s action plan against cyberbullying, we said schools lose cases because nobody kept a screenshot. With a sexual image of a child, the instinct to collect evidence can make things worse.

The UK’s national guidance for schools is blunt about it: “Never view, copy, print, share, store or save the imagery yourself, or ask a child to share or download.” It also says not to delete the imagery, or ask the young person to delete it.

That’s one country’s guidance, and yours may differ in detail. The point is that a rule like this exists, and the teacher a student shows the image to needs to know it before that moment, not after.

What a school needs before it happens

• Name it in the policy. Check whether your anti-bullying policy mentions generated images, cloned voices or altered video at all. A policy written before 2024 is unlikely to.
• Write the first hour. Who is told, who must not look at the image, who speaks to the families, and who decides whether the police are called. Decide it on a quiet day.
• Find your national rule on handling images. Every member state has a Safer Internet Centre that gives free advice, and the #NotOnOurFeed toolkit sorts its resources by country and language.
• Teach it early. Students should hear, before anyone needs it, that making or sharing such an image can end in court, as it did in Badajoz, and that being sent one is never a reason to forward it.

We’d rather a school read this on a quiet afternoon than go looking for it on the day. Our Cyberbullying course spends a full day on generated images and cloned voices, and ends with a written protocol for your own school — who is told, in what order, within what time. Browse it alongside our other structured courses, or start a registration once you know which one fits.