Crown Dependency Data Protection Advisory: generative AI image creation (2026-02-23)

Summary

This is a joint advisory issued by the Guernsey Office of the Data Protection Authority together with the Isle of Man Information Commissioner and the Jersey Office of the Information Commissioner, addressing risks from generative AI systems that can create non-consensual intimate images (deepfakes). It is primarily public guidance rather than a binding rule, aimed at helping individuals, parents and organisations understand the risks and their data protection rights.

Alongside the advisory, the three regulators signed a global joint statement with over 60 co-signatories reaffirming that where personal data is used to build or operate these AI systems, data protection and privacy law must be complied with, and setting out expectations for organisations that develop such systems.

• Privacy settings: Individuals are advised to review and tighten social media and online privacy settings to control who can see shared content.
• Limit data shared: Avoid sharing large amounts of personal information or images, particularly of children, with AI systems or online services unless necessary.
• Caution with AI tools: Be wary of AI tools requesting photos, videos, voice recordings or personal data, especially where retention, training use or sharing practices are unclear.
• Verify AI content: Do not rely on AI-generated text, images or video without checking against trusted sources, as such content may be fabricated.
• Do not create harmful content: Do not create or share AI-generated content that could harm a real person; creating indecent images of a child, real or deepfake, is a criminal offence.
• Exercise data rights: Individuals (and parents on behalf of children) can exercise data protection rights such as access, information and erasure, and can report misuse to platforms or the relevant data protection authority.
• Talk to children: Parents and carers are encouraged to discuss online safety and AI risks with children.

The advisory does not create new statutory obligations for licensed or regulated entities in the Crown Dependencies, but it reiterates that organisations designing or deploying generative AI systems processing personal data remain subject to existing data protection and privacy legislation.

Key obligations

• Organisations that design, develop or deploy generative AI systems processing personal data must comply with applicable data protection and privacy legislation, as reaffirmed in the accompanying joint statement.

Applies to

individuals and members of the public, parents and guardians, organisations that design and use generative AI systems