Taotlus

FOR INTERNAL USE Notation made on: Final date: Basis: Holder of information: Police and Border Guard Board Your ref no UndressMe AI [email protected] Our ref 17.04.2026 no 2.1-3/13719-1 Procedural notice and request for assistance to counter the threat Police and Border Guard Board of the Republic of Estonia (hereinafter referred to as PBGB) is contacting the organization UndressMe AI as the operator of the artificial intelligence content generation tool (hereinafter referred to as the Program) regarding information indicating possible misuse of the Program for the creation of material depicting minors in sexually explicit or suggestive contexts. The purpose of this notice is to inform the service provider of the suspected misuse of its service and to request the provider’s observations and information regarding the measures taken to prevent such misuse. 1.1 Legal framework According to § 178 of the Estonian Penal Code, it is prohibited to produce, acquire, store, display or distribute material depicting a person under eighteen years of age in a pornographic or erotic situation (Karistusseadustik, § 178). The interpretation of erotic content involving minors has been clarified in Estonian case law. The Criminal Chamber of the Supreme Court has held that erotic content may also be present where otherwise ordinary situations are depicted but the focus of the material is recognisably directed towards the naked bodies of children and the representation has no other meaningful context (Riigikohus, 2017). The Tallinn Circuit Court has further stated that erotic content may occur even in depictions of ordinary life situations where the visual focus is deliberately directed at children’s bodies in a sexualised manner (Tallinna Ringkonnakohus, 2022). At the European Union level, Directive 2011/93/EU on combating the sexual abuse and sexual exploitation of children defines child sexual abuse material as including any material depicting a person under eighteen years of age in a real or simulated sexually explicit situation (European Parliament & Council of the European Union, 2011). Recent legislative developments at the European Union level further clarify that such material may also include realistic images or pseudophotographs generated through artificial intelligence or similar technologies (European Parliament, 2025). Under § 6 subsection 1 of the Estonian Law Enforcement Act, a law enforcement agency is an authority authorised by law to perform state supervision. Pursuant to § 6 subsection 2 of the same Act, where the ascertainment and countering of a threat or elimination of a disturbance Pärnu mnt 139 / 15060 Tallinn / [email protected] / www.politsei.ee Registry code 70008747  FOR INTERNAL USE does not fall within the competence of another authority, it is within the competence of the police. In accordance with § 30 subsection 1 of the Law Enforcement Act, the police may question a person if there is reason to believe that the person possesses information necessary for preventing or countering a threat or eliminating a disturbance within the competence of the authority (Korrakaitseseadus, § 6; § 30). In accordance with § 40 subsection 1 of the Administrative Procedure Act, before issuing an administrative act, an administrative authority shall grant the participant in proceedings the opportunity to present their opinion and objections. Where such an opportunity has been granted but the participant does not respond within the specified time limit, the authority may proceed with issuing an administrative act on the basis of the information available (Haldusmenetluse seadus, § 40). In addition, pursuant to Article 51(1)(a) of Regulation (EU) 2022/2065 (Digital Services Act), the competent authority has the power to require providers of intermediary services and other relevant persons to provide information necessary for the performance of supervisory tasks without undue delay. Where such requested information is not provided, Article 51(2) of the Digital Services Act empowers the competent authority to adopt enforcement measures, including the issuance of binding orders to ensure compliance with applicable legal obligations (European Parliament & Council of the European Union, 2022). Accordingly, where the requested explanations or information are not provided within the specified time limit, the competent authority is entitled to proceed with the issuance of a binding administrative order in order to ensure compliance with applicable legal requirements and to prevent the continued availability or dissemination of potentially unlawful content. 1.2 Information received by the Police and Border Guard Board According to information received by PBGB, there are references indicating that the Program operated by UndressMe AI may have been used to generate images depicting persons appearing to be minors in sexually suggestive or pornographic situations. At this time we have information about 3 of such cases. The descriptions of the material indicate that the generated content depicting faces of real persons appearing to be under the age of fourteen in pornographic situations. Although PBGB has not at this stage captured specific URLs, image hashes or user account identifiers associated with the content, the available information indicates that the material may have been generated using the Program and shared through online environments. Such content may fall within the scope of material depicting minors in pornographic or erotic situations within the meaning of § 178 of the Penal Code. PBGB also notes that according to the Terms of Service, the Program uses automated mechanisms intended to detect attempts to upload images of minors and maintains logs of such attempts for a period of up to six years. PBGB therefore requests confirmation whether such detection mechanisms have identified any attempts to generate or upload content involving minors and whether corresponding logs exist that could assist in assessing the potential misuse of the Program related to Estonia. 1.3 Terms of service of the service provider PBGB notes that the publicly available Terms of Service of the Program contain provisions prohibiting the creation of such material. 2 (5)  FOR INTERNAL USE In particular, the Terms of Service state that: • uploading, attempting to create or generating content involving minors is strictly prohibited • any content involving child abuse or exploitation, including images or artistic depictions of minors in sexual or suggestive contexts, is prohibited • users must not upload or generate reference images involving minors. These provisions demonstrate that the service provider itself recognizes the risk of misuse of the Program for generating content involving minors. 1.4 Possible misuse of the service According to the information available to PBGB, the suspected misuse may involve: • generating synthetic content depicting minors in pornographic situations • generating content based on prompts describing minors in pornographic contexts • sharing such generated material through external platforms. Where such activity occurs, it may constitute the production or dissemination of material depicting minors in erotic or pornographic situations within the meaning of § 178 of the Penal Code. In addition, where real or identifiable individuals are used as a reference for generating synthetic sexual images, the conduct may also raise issues related to the unlawful use of another person’s identity or personal data under § 157¹ and § 157² of the Penal Code. 1.5 Request for information PBGB requests UndressMe AI to provide information and observations regarding the following:  whether the service provider has detected attempts to generate images depicting minors in sexual or suggestive contexts using the Program  what technical measures are implemented in the Program to prevent the creation of such content  whether any content moderation or automated detection mechanisms are used to identify prompts or generated images involving minors  whether the service provider retains logs, metadata or other information regarding generated content which could assist in identifying such misuse  whether the service provider has previously reported similar incidents to competent authorities.  whether the generation of content through the Program requires the use of Gems or other paid tokens and whether records of such transactions are retained. PBGB also requests information regarding whether the Program stores generated content or corresponding hash values that could be used for identification of such material. 1.6 Request for cooperation PBGB emphasizes that the purpose of this notice is to inform the service provider of potential misuse of the Program and to encourage cooperation in preventing the generation or dissemination of material harmful to children. PBGB invites UndressMe AI to provide information on the measures taken or planned to strengthen safeguards preventing the generation of such material. PBGB also requests information regarding the appropriate contact channel for potential law enforcement cooperation in the event that further investigation becomes necessary. 3 (5)  FOR INTERNAL USE 1.7 Deadline for response PBGB requests UndressMe AI to submit its observations and the requested information within 30 days from the receipt of this notice. Responses may be submitted electronically to the Police and Border Guard Board via the designated contact channel [email protected] 2. Recommendations for internal review In light of the information described above, PBGB recommends UndressMe AI to initiate an internal review in order to assess whether the Program may have been used to generate content involving minors in sexual or suggestive contexts. PBGB recommends that the internal review includes,  where technically possible: verification of whether prompts or reference inputs describing minors have been submitted to the Program  review of generated outputs that may depict minors in sexualized situations  assessment of whether such content may have been generated or stored within the Program infrastructure  identification of user accounts involved in the generation or distribution of such material  preservation of relevant logs, metadata and other technical information that may assist in determining the origin and distribution of the material. PBGB further requests that any information identified during such review that may indicate the creation or dissemination of child sexual abuse material be preserved in accordance with the applicable legal requirements and, where relevant, communicated to the competent law enforcement authorities. The purpose of this request is to prevent the potential misuse of the Program and to support the protection of children in online environments. 3 References European Parliament. (2025). Proposal for a directive of the European Parliament and of the Council on combating child sexual abuse and child sexual exploitation. https://eur- lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025AP0116 European Parliament, & Council of the European Union. (2011). Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography. https://eur- lex.europa.eu/eli/dir/2011/93/oj European Parliament, & Council of the European Union. (2022). Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services and amending Directive 2000/31/EC (Digital Services Act). https://eur- lex.europa.eu/eli/reg/2022/2065/oj Riigikohus. (2017). Criminal Chamber judgment No. 1-16-5792 https://www.riigikohus.ee/et/lahendid?asjaNr=1-16-5792/101 Tallinna Ringkonnakohus. (2022). Judgment No. 1-21-7004. https://www.riigiteataja.ee/kohtulahendid/detailid.html?id=312681027 Republic of Estonia. (2025). Penal Code. https://www.riigiteataja.ee/en/eli/507052025001/consolide Republic of Estonia (2023). Administrative Procedure Act. https://www.riigiteataja.ee/en/eli/505122023003/consolide 4 (5)  FOR INTERNAL USE Yours sincerely (Digitally signed) Eduard Kamenski Senior Commissioner North Prefecture, Information Bureau, Web Community Group Web Police Officer Eduard Kamenski, +3726125840, [email protected] 5 (5)