Photos of children and AI: risks and how to reduce exposure

SENSITIVE CONTENT WARNING

This report addresses child sexual exploitation and abuse, violence, deepfakes, and other criminal or abusive uses of artificial intelligence. The content discussed can be disturbing or trigger emotional triggers.

TecEdi does not reproduce explicit images, child sexual abuse material or graphic content. The purpose of this content is exclusively journalistic, informative and awareness-raising.

In Brazil, acquiring, possessing, storing, or soliciting material of sexual violence against children or adolescents is a crime. Offering, transmitting, distributing, publishing, or sharing this content also constitutes a crime, according to arts. 241-A and 241-B of the Statute of the Child and Adolescent. Since August 2026, article 241-C expressly mentions simulation by technological manipulation, including with artificial intelligence, and article 241-E covers real or fictitious representations generated or manipulated digitally.

This is a report about a crime and its impacts. No illegal material will be displayed, made available or indicated.

A birthday photo, an image from the first day of school, or a record of a soccer match contains nothing wrong. The child did nothing wrong. The parents who kept or shared that moment did not create the crime either. The problem begins when someone else copies the image and uses a digital tool to fabricate a sexual representation that never existed.

This is no longer a hypothesis. In August 2026, the Federal Police opened Operation Protective Cloak to investigate the creation and dissemination of sexual content involving a teenager. According to the official communication from the PF, the material would have been produced by manipulating real images of the victim with artificial intelligence and disseminated on a messaging application. Warrants were served and a cell phone was seized for forensics. The investigation was continuing when this report was concluded, so there is no basis to treat suspicion as a conviction.

In the United States, court documents gathered by the Department of Justice record an even more direct case. William Haslach, a former Minnesota school district official, photographed children in his care clothed, in images that the DOJ itself describes as non-explicit, and then used them to produce depictions manipulated by computer and AI. Nearly 60 victims had been identified. Haslach pleaded guilty in April 2026 of attempted production and production of obscene representation of child abuse. The sentence was not yet marked on the official page consulted.

These cases support an uncomfortable finding: an innocent photograph can be transformed without the knowledge of the child or the family. They do not prove that every children's photo on the internet will be used in this way, nor that the complete removal of children from the digital environment is possible or desirable. What they do prove is that the risk exists and that its consequences do not disappear because the scene was fabricated.

How AI Has Changed Image Manipulation

Montages and fakes were not born with artificial intelligence. What has changed is the combination of speed, scale, low cost, and the ability to produce variations. Tasks that previously required manual editing can be partially automated by systems that generate or alter images from instructions, visual references, or both.

It is important to separate different processes that appear under the same label.

Completely synthetic image: People and scenes are generated without deliberately depicting an identifiable real child.
Real photo manipulated: The face, body, or other feature of a specific child is inserted or turned into a fake.
Changed pre-existing abuse material: Records of real victims are modified to create new files and prolong revictimization.
Intimate forgery for coercion: A made-up image is used in bullying, stalking, blackmail, or sextortion.
Contaminated training data: Illegal or suspicious material appears in a set used to develop models.

These categories may intersect, but they are not equivalent. An entirely synthetic image does not necessarily have a child photographed as a direct victim of that scene. A fake-up made with the face of a real child hits someone identifiable. Altering existing abuse material re-exploits a victim whose violence has been recorded. And a file present in training data creates a problem of origin and governance, even if the user never sends a specific photo to the system.

Training a model and sending a photo are different things

During training, a model analyzes many examples and adjusts mathematical parameters to learn patterns. This should not be described as a conventional album stored inside the tool. Still, the origin and cleanliness of this data matters.

In 2023, an investigation by the Stanford Internet Observatory found more than 3,200 suspicious images of child sexual abuse material in the LAION-5B open suite, using fingerprint matches and additional analysis. O University Report It recommended more rigorous cleaning and removal of contaminated copies. The conclusion applies to the set examined. It does not authorize stating that all generators or all commercial models were trained with illegal material.

Another situation occurs after the model already exists. A person can provide the photograph of a specific child to edit the image, transfer characteristics, or guide a generation. In this case, the photo functions as the input to that operation. This does not demonstrate that it was part of the original training. The cases of the Federal Police and the DOJ show precisely the damage linked to the subsequent manipulation of identifiable people.

In 2025, the National Center for Missing & Exploited Children (NCMEC) received more than 30,000 reports of users attempting to generate abusive material by sending a text-accompanied file. The agency also recorded more than 145,000 reports on interaction or alteration of a file without text attached, and more than 12,000 in which companies indicated material found in training data. The categories reinforce why training, uploading, and the end result cannot be treated as the same step.

AI-generated child sexual abuse material

The preferred term in this article is child sexual abuse material, translated from the English acronym CSAM. The expression avoids turning the abuse of a child into a category of adult entertainment. With artificial intelligence, this material can take entirely synthetic forms or mix real and fabricated elements.

If the image is artificial, is the damage too?

The answer depends on what was created, how it was used, and who was hit. When the forgery represents a real child, there can be humiliation, fear, harassment, loss of trust, circulation among peers, and the need to repeatedly explain that it never happened. When the file derives from existing abuse material, the victim is exploited again. When it is fully synthetic, there is not necessarily a child photographed at the scene, but officials warn that the file can feed criminal communities, normalize child sexualization, and increase the volume that investigators need to examine while looking for real victims.

A Operation Cumberland, coordinated with support from Europol, showed the latter situation. In February 2025, authorities in 19 countries identified 273 suspects, arrested 25 people, conducted 33 searches, and seized 173 devices in an investigation into fully AI-generated material. These are operational results, not 273 convictions. Europol highlighted that the increase in synthetic files makes it difficult to screen and identify victims.

Documented cases show different victims

The Minnesota lawsuit demonstrates the use of ordinary photographs obtained by someone who had direct access to the children. There is no indication on the DOJ's page that the manipulated images were distributed, and the agency also reports that there is no charge of physical abuse against the children in the defendant's care. These distinctions are essential: The documented harm does not need to be magnified by allegations that the lawsuit does not make.

In Ohio, James Strahler II pleaded guilty in April 2026 of crimes that included digital stalking, production of obscene representations, and publication of digital forgeries. According to the DOJ, he used the faces of boys from his community in manipulated content and published hundreds of images involving real victims and animated characters. The sentence would be set later.

In Brazil, Operation Protective Cloak offers an example under investigation, not tried. The PF stated that the real images of a teenager would have been manipulated and shared. The use of the verb in the conditional is not a formality: warrant, seizure and forensics are part of the search for evidence. Only the process can establish criminal responsibility.

Together, the three records show different routes to the damage: a relationship of trust, access to the faces of people in the community, and circulation by messaging. None of them allows us to estimate how many public photographs have been copied in the world. They allow us to affirm that real children have already been turned into targets based on images that, in the beginning, did not record abuse.

What the numbers really measure

NCMEC began tracking reports with an AI nexus on CyberTipline in January 2023. There were 4,700 in 2023, 67 thousand in 2024, and more than 400 thousand in 2025. Between January 2023 and December 2025, its analysts classified more than 158 thousand images and videos sent in reports as AI-generated. The agency also reported having identified more than 275 direct victims in 2024 and 2025.

Year	AI-Nexus Reports Received by CyberTipline
2023	4.700
2024	67.000
2025	More than 400,000

These numbers need methodological restraint. A report is not synonymous with a child, perpetrator, single crime, or conviction. It may contain multiple files, and the same material may arrive through more than one company. The ability to identify AI and reporting forms have also changed over the period. The jump shows growth in what has been detected and reported, but it does not alone measure the total prevalence of crime.

The Internet Watch Foundation, IWF, uses another unit. The organization recorded 7,063 AI images and videos in 2024 and 8,029 in 2025. Within the video clipping, the 2025 Annual Report points to 3,443 files, compared to 13 in the previous year. Reports, URLs and files are different denominators. Adding them together would produce a large but false number.

Intimate deepfakes, bullying and sextortion

Apps called "nudify" promise to manufacture nudity from a clothed photograph. Australia's eSafety Commissioner reports that selfies, school photos and social posts are used in intimate fakes that circulate among students. The victim may never have produced or sent an actual intimate image.

The harm does not depend on the public believing in authenticity in order to exist. The image can be used to embarrass, delete, harass, or pressure. In sextortion, the perpetrator threatens to publish the forgery to obtain money, new images, or some behavior from the victim. O NCMEC documents cases in which a child refused to send an intimate photo and the aggressor fabricated one to continue the blackmail.

The central orientation of authorities is not to pay or produce more content. Giving in does not guarantee the end of the threat and can increase the demands. The victim needs to hear clearly that he is not to blame, even if he has sent a photo or talked to the aggressor. The person responsible must preserve messages, profile names, times and email addresses useful for the complaint, without redistributing the abusive file.

What parents and guardians need to know

Risk does not require panic or digital disappearance. It requires conscious choices. A Britain's National Crime Agency and the IWF warn that family photos can be copied from social networks, websites, or messaging apps and manipulated. No setting offers absolute protection, because a recipient can still save, forward, or capture the screen. Even so, reducing exposure decreases opportunities for misuse.

Review who can see the posts. Private profile is a useful barrier, but the list of followers also needs to be reviewed.
Audit the old photos. Archiving public publications reduces the amount of material available to strangers.
Avoid combining face, full name and routine. School, uniform, address, geolocation, frequent times and locations help third parties identify and approach a child.
Talk to family and friends. The choice of privacy loses effect when other people publish the same image openly.
Read the terms for schools, clubs, and events. Ask where the photos will be released, for how long, and how to withdraw consent.
Include the child in the decision. Depending on their age, ask if they accept the publication and explain that online files can be copied.
Prefer less identifiable frames when possible. Detail photos, activities, or faceless moments can preserve the memory with less exposure.
Turn off auto-find and remove unnecessary details. The problem is not just the file, but the context gathered around it.

These measures are risk reduction, not guarantee. Nor do they shift blame to parents or children when someone commits abuse. The responsibility lies with those who copy, fabricate, threaten, or distribute.

If a fake involving a child appears

Embrace before investigating. Tell them that the child is not to blame and that they did the right thing to ask for help.
Don't ask them to download or forward the file. This can expand circulation and expose more people to illegal material.
Preserve context safely. Store URLs, usernames, dates, threat messages, and protocol numbers. The Federal Police recommends preserving digital evidence, but storing illegal material itself requires guidance from the authority.
Report it on the platform itself. Use the categories of child abuse, intimate image without consent, forgery, or harassment.
Look for the police. The complaint can be made to the Civil Police; cases with federal or transnational repercussions can be referred by the Federal Police Crime Reporting.
Use the national channels. O Federal Government Guide indicates Dial 100, the Public Prosecutor's Office and SaferNet's National Complaint Center.
Ask for removal, but keep expectations realistic. O Take It Down It creates a digital fingerprint of intimate images produced when the person was under 18 on the device and shares it with participating platforms, without sending the original file. Coverage does not include the entire internet.
Seek psychological and legal support when necessary. Circulation can produce anxiety, isolation, and fear even when everyone knows the image is fake.

If there is an immediate risk to the child's integrity, contact the emergency service and the local authority. This report is not a substitute for individual legal advice.

AI, wars, and false evidence

The same power to fabricate a plausible scene affects records of attacks, protests, deaths and disasters. The International Committee of the Red Cross (ICRC) says AI systems are used to produce fake text, audio, photographs and videos that are increasingly difficult to distinguish from genuine content. In conflict, disinformation can alter decisions, cause displacement, amplify hostility and put civilians at risk.

There are two separate problems. The first is presenting a made-up image as proof of something that didn't happen. The second is publishing real material with a false caption, place, or date. In 2023, at the beginning of the Israeli-Hamas war, experts observed that much of the viral visual falsehoods were still coming from old or out-of-context real recordings, not advanced AI images. The new technology hasn't erased old methods of deception.

In 2026, researchers heard by the Reuters Institute at the University of Oxford reported growth of synthetic images in information warfare and more time needed to authenticate records. The report also documented the mixing of fabricated material with authentic images, a combination that makes the entire environment less reliable.

The reverse problem: calling a real photograph "AI"

The mere existence of deepfakes creates a convenient outlet for those who want to deny real evidence. Researchers call this Liar's Dividend. Instead of proving that a photo was fabricated, someone exploits the collective doubt and says only that it "looks like AI".

In conflicts, this accusation can discredit the record of victims, attacks or violations. In everyday life, it can allow the author of a threat to say that true audio is fake. The consequence is a broader erosion: artificial images can deceive, while authentic images fail to convince.

Therefore, checking a photograph does not mean looking for deformed hands, strange shadows or other popular defects. Models change, post-processing hides clues and real images also have compression, blurs and optical errors. The origin of the file, the first publication, the location, the time, other recordings and confirmation by independent sources weigh more than an isolated visual impression.

How companies and platforms are responding

The answers appear at different points in the cycle. Developers can filter training sets, test whether the model accepts abusive requests, block uploads and exits, record provenance signals, and offer reporting channels. Platforms can combine fingerprinting of known material, classifiers for new content, behavior analysis, and specialized human teams.

The initiative Safety by Design for Generative AI, organized by Thorn and All Tech Is Human, recommends protection from the development to the maintenance of the service. Among the measures are separating depictions of children from adult sexual content in training data, assessing capabilities before launch, detecting abusive inputs and outputs, removing models created to sexualize images, and sharing indicators with protection organizations.

No one layer solves everything. A fingerprint works great for rediscovering a known file, but each change can create a new version. A filter can mistakenly block legitimate uses or miss a criminal attempt. Models running outside of controlled services can lose protections. Transparency about results, failures, and resources dedicated to security is just as important as announcing a block.

What authorities are doing

Police work needs to distinguish synthetic content from real victims, locate people at risk, and preserve digital evidence without expanding circulation. In Operation Cumberland, Europol provided coordination, intelligence, and analysis to participating countries. In the United States, the FBI, Secret Service, and local police appear in the processes analyzed. In Brazil, the PF provides for virtual patrols in public digital environments and maintains the Guardians of Childhood program.

Volume is an obstacle. In 2025, CyberTipline received 21.3 million reports across all categories, containing 61.8 million files submitted by providers. More than 400,000 reports had some nexus to AI, but more than half didn't have enough detail to classify exactly how the technology participated. An avalanche of new files can consume time that is also needed to locate children in immediate danger.

What Brazilian law says

A Law 15,487, of August 6, 2026 updated the Statute of the Child and Adolescent and closed part of the discussion on representations generated by technology.

O Article 241-A provides for imprisonment from four to ten years and a fine for offering, transmitting, distributing, publishing or disseminating content of sexual violence against children or adolescents.
O Article 241-B provides for imprisonment of three to six years and a fine for acquiring, possessing, storing or requesting this material. The law also covers access or viewing for sexual purposes.
O art. 241-C provides for imprisonment of three to five years and a fine to simulate the participation of a child or adolescent for tampering, editing or modifying an image or voice, including with AI.
O Article 241-E defines the material in such a way as to include a real or fictitious child or adolescent in a representation produced, manipulated or generated by digital technologies.

The application depends on the facts and evidence of each case. Brazilian law should not automatically be used to describe foreign processes, which follow other criminal types. Similarly, an arrest or search is not a conviction, and a person who has pleaded guilty can still await sentencing.

AI detectors are not judges

Automatic tools usually return a probability, not a certificate of authenticity. O NIST, United States Standards Institute, explains that performance varies depending on the generator, the set used in the test, and the changes applied afterwards. Compression, resizing, and noise can reduce accuracy. A detector trained on images from a system usually works better in that system than in front of an unknown generator.

Provenance standards, such as C2PA, follow a different logic. They can attach a verifiable history of origin and edition to a file. This helps to check the production chain, but the own C2PA It points out that the credential does not decide whether the recorded narrative is true. And the absence of a credential does not prove that a photograph is fake, as adoption is not yet universal and metadata can be lost.

In serious investigation, detection, provenance, forensic analysis, context, and independent confirmation complement each other. No single button closes the question.

What we don't know yet

There is no reliable public count of all common photographs of children copied for manipulation. Discovered cases only represent what has reached authorities or platforms. It is also not possible to convert the number of reports into a direct estimate of victims.

There is still little longitudinal research on the specific effects of a childhood intimate fake, separate from other forms of image-based violence. The reported harms are real, but their duration and their relationship to age, circulation, school response, and family support need broader studies.

We also don't know the error rate of the filters used by each service, because companies disclose different levels of detail. Closed systems can have strong protections without enough transparency for external evaluation. Open systems allow auditing, but they can also be modified to remove barriers.

Finally, none of the data presented here allows us to conclude that all generative artificial intelligence produces this risk to the same degree. Architecture, data, access controls, moderation, and distribution change a lot between tools.

A fabricated image can cause a true consequence

The evidence does not call for a generic condemnation of artificial intelligence. It calls for precision. There are tools that help science, accessibility, creation, and education. There are also people who use the same ability to synthesize and edit to exploit children, stalk victims, and fabricate war records.

A family photo is not to blame for being copied. A child does not become responsible because he appeared in uniform, because he accepted a follower, or because he trusted someone. Privacy and digital education reduce opportunities, but they are not a substitute for safe platforms, competent investigation, applicable laws, and victim support.

The image can be artificial. The shame imposed, the blackmail, the fear of going to school, the wasted police work and the doubt cast on real proof are not.

Your children's photos are innocent. What someone can do with them using AI may not be.

Listen to this article