The data protection authorities of the Isle of Man, Guernsey and Jersey have joined 61 regulators worldwide in issuing a joint statement warning about the growing misuse of artificial intelligence systems capable of generating harmful images and videos of real people - including children - without their consent.

The creation of non-consensual intimate imagery using AI, often referred to as ‘deepfakes’, can cause significant emotional distress, damage reputations and infringe individuals’ data protection rights.

Coordinated by the Global Privacy Assembly’s International Enforcement Cooperation Working Group, the statement sets out key expectations and fundamental principles for organisations that develop or deploy AI content generation systems.

Organisations are advised to build strong safeguards to prevent misuse of personal data and the creation of harmful or intimate content.

They should be transparent about how their systems function, including their limitations, embedded safeguards and the consequences of misuse. Clear, rapid and accessible processes must be available to enable individuals to request the removal of harmful material.

Enhanced protections for children are also required, alongside practical guidance for families and educators. Regulators have confirmed that they will continue coordinated international action - including information sharing, enforcement measures and public guidance - to address what is increasingly recognised as a global risk.

While organisations designing and operating these systems bear primary responsibility for complying with data protection law, individuals can also take steps to reduce the risk of misuse.

The Crown Dependencies have issued joint advice encouraging parents and carers to speak with children about online risks and to play an active role in helping them stay safe.

Users are urged to exercise caution when using AI tools and when relying on AI-generated content. Some tools present greater risks than others, particularly those requesting photos, videos, voice recordings or detailed personal information.

Extra care should be taken where it is unclear how long information will be retained, whether it will be used to train AI models, or with whom it may be shared.

AI-generated text, images and videos may be inaccurate, misleading or entirely fabricated, and it is not always easy to distinguish real from artificial content.

Information shared with AI systems may also be difficult to fully remove. Once uploaded, personal data may be stored, copied or reused in ways that are hard to control, and deletion cannot always guarantee complete erasure.

Producing or circulating misleading, intimate or damaging content about a real person may be unlawful and carry serious consequences. Creating and sharing indecent images of a child is a criminal offence, including in the island, regardless of whether AI technology is involved.

Online platforms and AI providers must comply with data protection law.

Individuals have legal rights over their personal data, including the right to be informed about its use, to access it and, in certain circumstances, to have it erased.

These rights apply to children, and parents or guardians may be able to exercise them on a child’s behalf. If personal data is misused or harmful content is shared, concerns can be raised with the relevant service provider and, where necessary, with the data protection authority.

Isle of Man Information Commissioner Dr Alexandra Delaney-Bhattacharya said regulators are ’deeply concerned’ about the generation of harmful and destructive indecent imagery, including deepfakes, and emphasised that while organisations hold primary responsibility, parents and carers should engage openly with children about online dangers and help them navigate AI tools safely.