Both of them, still, in some places, although she may get more lenient treatment because she's a juvenile. Other places have cleaned that up in various ways, although I think he's usually still at risk unless he actively turns her in to the Authorities(TM) for sending the picture.

And there's a subset of crusaders (not all of them, admittedly) who will say, with a straight face, that there is abuse involved. To wit, she abused herself by creating and sending the image, and he abused her either by giving her the idea, or by looking at it.

One for distribution (of her own image), one for possession. See sections 3 & 4

https://laws-lois.justice.gc.ca/eng/acts/c-46/section-163.1....

It comes down to prosecutorial discretion, and that can go either way.

Prosecutors have broad discretion to proceed with a matter based on whether there is a reasonable prospect of securing a conviction, whether it’s in the public interest to do so and various other factors. They don’t generally bring a lot of rigour to these considerations.

I'd be pretty surprised if any adult could be convicted of CSAM possession when they didn't act to obtain it.

Otherwise you could send one image to every American email account and put every American adult in prison.

Obviously this depends on the country, but many countries have so-called "Romeo and Juliet" laws which carve out specific exclusions for situations along these lines.