What the NPC notice says—and when it was issued
On 11 August 2026, the National Privacy Commission explained that using a real person’s likeness to generate and share AI imagery processes personal information. It requires a legitimate purpose and a lawful basis; consent is not the only possible basis. Fabricated depictions may constitute false personal data. This is an operating note about that existing guidance, checked on 20 October, not a newly announced rule.[1]
The workflow below is Kooya’s analysis for marketing operations. It is not an NPC-prescribed checklist or a determination that a particular campaign is lawful. Have the person responsible for privacy assess the proposed use, including any claimed exception, before release.
Start with the identity decision
Write down whether the brief needs an identifiable real person at all. A demonstration of a product workflow may work with a project-owned mascot, illustrated scene or clearly fictional character. That choice can remove the need to transform a customer, employee or public figure into a spokesperson.
If the brief does need a real person, identify who, why and which representations are necessary. If it does not, avoid reference images or prompts that intentionally steer the result toward someone recognizable. A generated face is not a guarantee that nobody will recognize a real person; review the result as well as the prompt.
Build an asset record before uploading references
Give each reference and output a stable asset ID. Keep the source, owner, permitted purpose, proposed edits, approved channels, review date and evidence location together. Limit access to supporting records; a campaign spreadsheet does not need to expose copies of identity documents or private correspondence.
The Data Privacy Act sets principles including transparency, legitimate purpose and proportionality. Its Section 11 also ties collection and further processing to specified purposes. Those principles are the legal context for reviewing a changed use; the asset record itself is our operational recommendation.[2]
- Reference: where did this image come from, and who authorized its use?
- Transformation: what expression, setting, clothing or action will change?
- Purpose: what product or message will the person appear to support?
- Distribution: which accounts, placements, languages and campaign dates are covered?
- Decision: who approved this exact use, and where is the supporting evidence?
Test the difference between an approved photo and an approved portrayal
Consider a hypothetical employee whose portrait was approved for a company directory. A campaign team wants to animate that portrait beside a new product and add a first-person sales line. The output changes the apparent action, message and context. The directory approval is evidence to inspect, not a shortcut around reviewing the new purpose.
Pause the transformation until the appropriate reviewer resolves that gap. Show the proposed final composition and copy to the relevant approvers, rather than requesting approval of a neutral headshot and later substituting the sales version. Keep this example distinct from actual Kooya work: it illustrates a failure mode, not a reported client incident.
Review the generation vendor before the first upload
Map the reference image’s journey: who uploads it, which account receives it, whether collaborators can access it, how outputs are stored and what deletion controls exist. Check the provider’s current terms and account settings for training use, retention and onward access. Record uncertainties rather than assuming that a paid account settles them.
For an agency workflow, assign responsibility between brand, agency and production vendor before the campaign starts. Ask who can actually remove reference files, revoke a shared link or respond when a former collaborator still has an export. Avoid sending a larger employee or customer image library when a narrowly scoped reference would meet the approved brief.
Use the AI vendor selection guide to make supplier responsibilities and acceptance evidence explicit.
Approve the image, caption and placement together
A harmless-looking portrait can become a misleading endorsement when paired with copy. Review the whole placement: image, animation, headline, caption, testimonial language and destination. Ask what a reasonable viewer would think the depicted person did, said or approved. Do not manufacture a customer quote or performance claim to make the scene more persuasive.
Use clear disclosure where appropriate to the context, but do not treat an AI label as a replacement for reviewing the underlying use. Require a new approval when a revision materially changes the portrayal or message. A platform crop, translated caption or new product pairing can change what the audience sees.
- Creative owner checks the final portrayal and brand claim.
- Privacy or legal owner resolves the basis, purpose and unresolved identity questions.
- Publisher checks that the exported asset matches the approved version.
- Campaign owner records placements and the person authorized to pause them.
Make withdrawal possible before launch
A February 2026 international regulator statement hosted by the NPC calls for meaningful transparency and accessible ways to request removal of harmful AI-generated imagery. It is a joint statement of expectations, not a separate Philippine statute.[3]
Kooya recommends testing the response path with a sample asset before paid distribution. Can the team find every placement, pause scheduled posts, contact the media buyer and identify copies sent to partners? Record the difference between removing an owned post and requesting removal of an external copy. Do not promise that deletion from one account erases every downloaded file.
Give the receiving team a simple route to escalate an identity or portrayal complaint. Preserve the decision record, restrict unnecessary redistribution of the disputed image, and have the responsible owner determine the next action. The process should still work when the original designer is unavailable.
Start with one controlled campaign
Trial this workflow on a small, bounded set of assets with named owners. Measure whether reviewers can reconstruct the source-to-publication decision and locate every live placement. Count late substitutions, missing approvals and failed removal steps; do not call an attractive output a successful control test.
Expand only after the team can repeat the process without relying on someone’s memory. The useful system is a short route from brief to evidence, approval, publication and withdrawal—not a folder of generated images waiting for someone to take responsibility.