University of Hong Kong: a law student made about 700 indecent AI-generated images of some 20 to 30 classmates and teachers; the privacy watchdog opened then closed a criminal probe

In February 2025 a male law student at the University of Hong Kong was found to have used free online AI software to create indecent images of women after friends discovered the files on his laptop. He had taken photos from the social-media accounts of some 20 to 30 women, including university classmates, former primary and secondary schoolmates and secondary-school teachers; an Instagram post by three victims said the material amounted to about 700 images (including deepfakes and unedited photos saved without consent), organised into folders named after the victims. The Standard reported the images dated back to about May 2024. There was no allegation the student distributed the images. When victims approached HKU in March 2025 seeking a disciplinary process, the university cited legal opinion that the conduct likely did not constitute an offence it could address, proposed a verbal reprimand and warning letter, and in April showed victims a roughly 60-word apology; some victims had to share tutorials with the accused. After the victims went public on 12 July 2025, the response drew criticism from lawmakers and advocates, and Chief Executive John Lee said universities bear responsibility for students' conduct. The PCPD opened a criminal investigation on 15 July 2025, treating non-consensual disclosure of personal data with intent to cause harm as a possible offence. On 17 December 2025 Privacy Commissioner Ada Chung announced the office was ending the investigation for insufficient evidence, because no victim was willing to provide further information, while releasing anti-deepfake guidance for schools and parents and noting the office had received five deepfake complaints and two enquiries that year, up from none the year before. Advocates said the episode exposed a legal gap: Hong Kong criminalises distribution, but not creation, of non-consensual intimate images.

Some 20 to 30 women had indecent and deepfake images of themselves generated with AI from their social-media photos; victims reported distress and had to share classes with the accused, and the criminal investigation was closed for insufficient evidence, leaving them without redress.

February 2025: friends found the images on the student's laptop and the matter was reported to HKU. In April 2025 HKU showed victims a roughly 60-word apology letter, which many found insincere; the university said it had issued a warning letter and made class adjustments. 12 July 2025: three victims went public on Instagram. 15 July 2025: the Office of the Privacy Commissioner for Personal Data (PCPD) opened a criminal investigation. 17 December 2025: the PCPD announced it was ending the investigation for insufficient evidence, as no victim was willing to provide further information, and released deepfake guidance for schools and parents; the commissioner said the office would not rule out resuming if victims came forward with evidence. Hong Kong law criminalises publication or distribution of intimate images, including AI-generated ones, but not their mere creation.