DPA case 0174164 – Violation Found (Italy, 2025)

The controller is the company AI/Robotics Venture Strategy 3 Ltd., based at the British Virgin Islands, which is the provider of the website app.clothoff.info (ClothOff). This website constitutes a generative AI service of so-called "deep nudes". In particular, the service allows the user to upload a photo depicting one or more clothed persons and to obtain a new image depicting the same person or persons but without clothing, as well as to obtain further alterations of the image, according to the different functionalities of the service. The service uses deep learning algorithms to analyse and process clothing in images, effectively nudifying them to generate realistic results. Upon accessing ClothOff a pop-up that appears that states that according to its terms and conditions, the user is prohibited from "the use of photos of persons under the age of majority or without their consent". The user has to accept these terms to continue. On 6 August 2025, the DPA initiated investigations and requested the controller to provide information but the controller never responded. The DPA issued a preliminary decision until the completion of the investigation on the conduct mentioned above. First, the DPA found that the warnings contained in the terms and conditions of ClothOff mentioned above, while on the one hand confirmed the riskiness of the service offered and its very nature to illicit uses, on the other hand, however, they were mostly limited to reiterating to the user prohibitions already in force in the legal system. The DPA held that the controller failed to take fully effective measures to exclude: a) that individuals under the age of majority may use ClothOff as users; b) and that images referring to minors may be uploaded. It conclude that the controller violated the principles of fairness Article 5(1)(a) GDPR and the principle of accountability Article 5(2) GDPR. Second, the DPA noted that the controller had implemented a watermark reading the word "Fak