On August 11, 2026, the Philippines' National Privacy Commission (NPC) advised that a person's face and likeness are personal information under the Data Privacy Act of 2012 (Republic Act 10173). Using AI tools to generate an image or video from a real person's likeness, then posting or sharing it, can therefore be unlawful processing (Tribune; Philstar). Reporting also says the Philippine National Police (PNP) will pursue people who create and share malicious deepfakes. Dedicated AI bills, including HB 7396, HB 7913 and HB 2827, remain stuck in House committee.
The strongest case for the NPC's move
The case for acting is real. Deepfakes can wreck reputations, enable fraud and harass private people, and victims need a remedy now. Congress has not delivered one. The NPC's reading is textually defensible. Section 3(g) of RA 10173 defines personal information as any information "from which the identity of an individual is apparent or can be reasonably and directly ascertained" (RA 10173 text). A face plainly meets that test. A regulator with an existing complaint process, takedown powers and penalties can give victims something faster than a new statute.
The advisory also offers a route to relief that does not require a prosecutor. Reporting says anyone whose likeness is misused can demand takedown and file a complaint with the NPC. For an ordinary person targeted by a fabricated video, that is a practical benefit.
What the law actually attaches to this
The exposure is significant. Section 25(a) of RA 10173 punishes unauthorized processing of personal information with imprisonment of one to three years and fines of ₱500,000 to ₱2,000,000 (same statute text). Coverage says the NPC also treats these penalties as sitting alongside civil and administrative liability.
The Act was written in 2012 to govern databases, registries and companies that collect data. It was not written for generative image tools or for people posting memes. The mismatch shows in three places.
- The lawful-basis model. Processing personal data needs a lawful basis, and coverage of the advisory says consent alone is not enough without a legitimate purpose. That works for a bank holding customer records. It fits poorly when a citizen edits a photo of a politician into a satirical clip.
- Who counts as a processor. The advisory reaches individuals who create and share content, not just organisations. Every user of a consumer image generator becomes a potential data controller.
- Enforcement by threat. When police announce they will file charges against creators and against people who merely share deepfakes, the deterrent lands on the sharer. Sharing is often done by people who cannot tell whether a clip is synthetic.
The speech carve-outs are doing the heavy lifting
The NPC does acknowledge speech interests. It says satire, parody, commentary and reporting on matters of public interest may fall under the constitutional right to freedom of speech, but only to the minimum extent necessary to achieve those purposes (Tribune). Section 4 of the Act separately excludes information processed for journalistic, artistic, literary or research purposes (statute text above).
Those are the right instincts. The problem is that the boundary is drawn by a regulator's advisory, not by a court or a statute written for synthetic media. "Minimum extent necessary" is a proportionality test. In practice it will be applied by a complaint officer or a police unit deciding whether a clip is parody or a malicious fake. A creator who guesses wrong faces a criminal penalty, and the rational response is to stay silent. Political satire, which most needs protection, is the category most likely to be chilled. The advisory's own coverage says public officials and their families are protected like anyone else, so a critic making a mocking video of an official must first work out whether the exemption applies.
The ordinary criminal law adds another layer. Republic Act 10175, the Cybercrime Prevention Act of 2012, provides that crimes defined in the Revised Penal Code and committed through information and communications technologies carry a penalty one degree higher (RA 10175 text). Police pursuing a deepfake maker will have several statutes to choose from, none of them drafted around what makes a synthetic clip harmful.
A better path: fix the definition, not the stretch
For innovation, the main cost is uncertainty. Developers of image and video tools, and the local startups building on them, cannot tell whether offering a face-swap feature makes them a party to unlawful processing. Investors read that as risk. It is the same regulation-by-interpretation pattern that has slowed AI adoption elsewhere, where broad general-purpose rules are applied to a new technology before anyone has defined the harm.
Proportionate regulation would look different. Legislators should aim at the harm, not the technology: deceptive synthetic media that depicts a real person doing or saying something they did not, made or spread to defraud, harass or sexually exploit. That means a narrow intent-and-harm standard with an explicit satire and public-interest defense written into statute, and liability for the maker or knowing distributor rather than every re-sharer. The pending House bills are the natural vehicle. They have sat in committee for years, and the NPC's advisory removes the urgency that might have moved them, because the executive branch has now supplied a stopgap.
The risk is that the stopgap becomes permanent. An advisory can be reissued, narrowed or dropped without a public vote. Creators and toolmakers get no stable rule to build on, and victims get a remedy that depends on how each complaint officer applies a proportionality test.
What to watch
- Whether the NPC publishes decided complaints that show where satire ends and unlawful processing begins.
- Whether PNP charges are filed against makers of fraudulent deepfakes or against ordinary sharers.
- Whether the House committee schedules hearings on the pending AI bills, and whether any carries an explicit speech defense.
The NPC deserves credit for acting on a real harm with the tools it has. The next step is for Congress to replace the stretch with a rule written for the problem.