Begoña Gómez denounces the PP for impersonating her image with AI in an electoral video

For a complaint of identity theft through artificial intelligence to succeed in Spain, it is necessary to prove what was done, who could have done it, and why the facts fit an infringement. It is not enough to demonstrate that AI was used: a fake profile, a cloned voice, and a manipulated video can have different legal consequences. The complaint initiates the investigation but does not guarantee an accusation or conviction.

1. Preserve evidence before requesting removal

The first step is to preserve the content and its context. It is advisable to gather:

• Complete links, usernames, dates, messages, and screenshots that allow identifying the publication.
• Original audio, video, or image files, emails, and conversations, avoiding modifying or recompressing them.
• Evidence of consequences: transfers, deceived contacts, threats, professional harm, or expenses.

It is recommended to keep a copy and document how each file was obtained. Screenshots are useful, but their authenticity can be disputed. Depending on the complexity of the case, a notarial deed or a computer expert report can strengthen the evidence; these are not universal requirements. Unauthorized access to others' accounts for investigation should not be done.

2. Determine the reportable conduct

The term "identity theft" alone does not determine the applicable crime. It is necessary to describe whether someone used the identity to deceive and obtain money, effectively assume another's identity, threaten, harass, access accounts, or disseminate content affecting privacy.

Creating a fake profile does not automatically constitute the crime of usurpation of civil status. Nor does every harmful montage have a criminal response: a civil claim for violation of honor, privacy, or image may apply. The content, purpose, dissemination, and circumstances matter.

3. File the complaint or consider a criminal lawsuit

The victim can file a complaint with law enforcement, the Public Prosecutor's Office, or the competent judicial body. They must chronologically explain the facts, provide available evidence, and identify accounts, possible perpetrators, and witnesses. It is not necessary to know the author to file a complaint.

The complaint can generally be filed without a lawyer or solicitor. The criminal lawsuit is a different formal action, usually with both professionals, allowing the exercise of prosecution. Some crimes have specific requirements for the injured party's initiative; therefore, it is advisable to review the legal fit before choosing the route.

4. Investigate and request protection

During the investigation, statements, expert reports, and data from platforms or providers can be collected through the corresponding legal channels. It is especially important to promptly request the preservation of information that may disappear.

The victim can request that protection measures be considered and, when appropriate, the removal or limitation of content. It is advisable to also claim before the platform, preserving the evidence beforehand. An expert report can analyze manipulation and file integrity; proving the existence of a deepfake does not necessarily identify its creator.

5. Proceed to trial or use complementary routes

To advance to trial, there must be sufficient indications of a crime and the participation of the investigated party. Then accusations and defense are formulated, evidence is presented, and a sentence is issued. A conviction requires sufficient lawfully obtained evidence; suspicions are not enough. If there is insufficient basis, dismissal may be ordered.

The civil route may allow claiming cessation of interference and compensation. If there is unlawful processing of personal data, a claim before the data protection authority may be considered. This route does not replace the criminal process nor alone grant compensation. Individual advice is advisable to choose actions and control deadlines.

The Minister for Digital Transformation and Public Administration exercises the political and regulatory leadership of the state policy on artificial intelligence but does not personally concentrate all supervisory functions. Specialized oversight corresponds to the Spanish Artificial Intelligence Supervisory Agency (AESIA), attached to the department through the Secretariat of State for Digitization and Artificial Intelligence, without displacing the competencies of other authorities.

1. Direction of public policy and regulation

Article 1 of Royal Decree 210/2024 assigns the Ministry "the proposal and execution of the Government's policy" on digital transformation and the development and promotion of artificial intelligence. The minister has superior direction of the department and its bodies, so their responsibility is to set priorities and promote necessary actions for safe AI respectful of rights. These powers must be exercised coordinately and without prejudice to those of other ministries (BOE of February 28).

Within this framework, ministerial functions include:

• Strategy and planning: development, coordination, and evaluation of the Spanish Artificial Intelligence Strategy and related public actions.
• Regulatory promotion: development of regulatory proposals and consideration of ethical aspects of AI.
• Institutional coordination: cooperation among departments, administrations, and professional, industrial, and academic sectors.
• International dimension: participation and representation in initiatives and forums, coordinated with Foreign Affairs when appropriate.

These are departmental functions exercised through competent bodies; they should not be confused with a personal power of the minister to inspect or sanction any system.

2. Relationship with AESIA and limits of ministerial direction

Article 2.9 of Royal Decree 210/2024 establishes AESIA's attachment to the Ministry through the Secretariat of State. However, this institutional link does not eliminate its technical autonomy: Article 8 of its Statute recognizes technical independence and provides that, in performing its functions, the Agency will act with full autonomy.

Additionally, Article 9 of the Statute establishes that acts of its Governing Council, Presidency, and Directorate that develop public functions exhaust the administrative route, except for the tax exception indicated in that provision. Therefore, the attachment does not make the minister an ordinary appeal instance against its decisions (AESIA Statute).

3. What corresponds to specialized supervision

Articles 4 and 10 of the Statute assign AESIA the supervision of systems within its competence and, according to applicable regulations, inspection, verification, and sanction functions. Its purpose is to reduce risks to integrity, privacy, equal treatment, non-discrimination, and other fundamental rights.

It is also responsible for advice, training, dissemination, trend detection, social impact assessment, cooperation with other authorities, and promotion of testing environments. Supervision, therefore, combines compliance control and risk prevention; it is not limited to imposing fines.

4. Sectoral coordination and compliance support

The competence is not exclusive to the Ministry or AESIA. The Statute expressly preserves the functions of Health and the Spanish Agency of Medicines and Medical Devices, as well as those of Labor and the Labor Inspection in labor relations.

The department also promotes practical compliance tools. An example is the guides derived from the controlled testing environment, with recommendations on risk management, data, transparency, and cybersecurity. These guides are not binding nor do they replace applicable standards, according to the official information published.

In summary: the minister directs and promotes the public framework; AESIA exercises specialized supervision within its powers, respecting its autonomy and sectoral competencies.

In Spain, artificial intelligence can be used in electoral campaigns, but it is not outside the law: it must comply with electoral rules, data protection, political advertising, and content transparency. As of October 28, 2026, it is essential to distinguish applicable European obligations from Spanish reforms that were not approved.

1. Data protection and political profiles

The GDPR and Organic Law 3/2018 require justifying the use of personal data, informing about its purpose, limiting collected data, protecting it, and allowing the exercise of rights. That data is published on the internet does not authorize any electoral reuse.

Political opinions receive enhanced protection. STC 76/2019 annulled article 58 bis.1 of the LOREG, which enabled their collection by parties. Therefore, that article does not serve as a basis to create ideological profiles. The AEPD has warned against inferring ideology by AI from other data. If processing involves high risk for individuals, a data protection impact assessment is required.

2. Content and assistant transparency

Article 50 of the European AI Regulation establishes differentiated obligations, applicable from August 2, 2026:

• Assistants and chatbots: inform that interaction is with AI, unless it is obvious.
• Deepfakes: disclose that images, voices, or videos apparently authentic have been artificially generated or manipulated. Satire has particularities but no absolute transparency exemption.
• Texts of public interest: warn of artificial generation unless there is human review or editorial control and a responsible person for publication.
• Providers: incorporate technical mechanisms to detect synthetic content. According to Demócrata, systems marketed before August 2 have until December 2, 2026, to adapt this labeling.

Labeling does not legalize content: rights to honor, privacy, image, and data protection remain enforceable.

3. Political advertising and platforms

Regulation (EU) 2024/900 on transparency and targeting of political advertising fully applies from October 10, 2025. It requires identifying political ads, their sponsors, the related electoral process, and the use of targeting techniques. These techniques are subject to reinforced data processing conditions.

Additionally, the Digital Services Regulation requires advertising transparency and restricts ads based on profiles using sensitive data. Large platforms must assess and reduce risks to electoral processes, as explained by the CNMC.

4. Electoral rules and high-risk systems

The LOREG continues to apply regardless of technology: AI does not allow circumventing propaganda time limits or advertising contracting restrictions. Ordinary publication must be distinguished from contracted electoral advertising.

AI specifically designed to influence voting is classified as high risk; tools exclusively administrative or logistical are excluded. However, according to Demócrata's explanation cited, full obligations of Annex III were postponed to December 2, 2027. Not all should be considered enforceable today.

5. Spanish reforms not in force

The Spanish AI governance project and initiatives on image and voice simulations expired on October 6, 2026. They cannot be invoked as current laws nor their proposals for new crimes or competence distribution as approved obligations.