Global Action Against Non-Consensual Sexual Deepfakes
Governments and European institutions are building urgent legal responses to AI-generated intimate imagery. Their approaches increasingly address both the person who makes or shares the material and the tools and platforms that enable it.
A sexual deepfake can place a real person’s face or likeness into an intimate image or video they never made and never agreed to. The image may be fabricated, but the consequences are not: humiliation, threats, reputational damage, fear of further distribution and pressure to leave public or professional life. The central legal question is therefore not whether the image is “real,” but whether a person’s identity and intimacy have been used without consent.
Europe: criminal rules and AI-system restrictions
The European Union is combining two different legal tools. Directive (EU) 2024/1385 requires Member States to criminalise the public online sharing, without consent, of intimate or sexually explicit images when the conduct is likely to cause serious harm. Its coverage expressly includes material produced or altered with AI, including deepfakes, when it is then shared publicly. The Directive sets minimum standards, leaves room for stronger national protections and gives Member States until 14 June 2027 to transpose its rules into national law. It does not, by itself, create a general EU-wide offence for making an image and keeping it private. 1
A second step came through Regulation (EU) 2026/1744, which amended the AI Act. It prohibits placing on the market, putting into service or using AI systems that generate or manipulate realistic intimate or sexually explicit depictions of an identifiable person without that person’s freely given, specific, informed, unambiguous and explicit consent. The prohibition applies from 2 December 2026. 2 3
The scope is specific. A provider is caught when the system is designed for this purpose, or when such output is a reasonably foreseeable and reproducible result and adequate safeguards are absent. A deployer is prohibited from using an AI system for the purpose of producing the material. The law does not bar every AI image tool: it allows legitimate uses with consent and safeguards, and excludes certain benign edits that do not increase exposure or change the sexual activity shown. 2
Spain helped push the EU measure. The Spanish government says it proposed the change in January 2026, with France also backing it, and that negotiators reached agreement on the amendment in May. Parliament later approved the package, and the measure became part of the enacted regulation. 3 4
National laws are taking different routes
The United Kingdom has adopted a direct creation-focused offence. Since 6 February 2026, intentionally creating a purported intimate image of an adult without consent—or requesting that another person create one—can be a criminal offence under the Data (Use and Access) Act 2025. The offence can apply even if the requested image is never produced. The statutory definition covers an image that appears to show an adult in an intimate state, including a synthetic or manipulated image. 5 6
The United States’ TAKE IT DOWN Act, signed on 19 May 2025, focuses on publication and removal. It criminalises certain knowing online publication of non-consensual intimate depictions, including computer-generated “digital forgeries.” Covered platforms must provide a notice process and remove qualifying material within 48 hours after receiving a request. The criminal ban took effect upon enactment; the platform removal process was required by 19 May 2026. 7
Australia’s 2024 federal reform strengthens offences addressing the creation and non-consensual online sharing of sexually explicit material, including material created or altered through technology such as deepfakes. It sits alongside state and territory laws and government support and reporting services. 8
These examples reveal distinct legislative choices. Some jurisdictions punish the creation or commissioning of an image; others centre on distribution, threats, or a platform’s duty to respond. A person may therefore face different remedies depending on where the creator, victim, platform and audience are located.
A global protection gap
The need for coordination is clear. UN Women reports that fewer than 40 per cent of countries have laws protecting women from cyber harassment or cyberstalking; it estimates that 1.8 billion women and girls lack legal protection from digital abuse. Those figures describe broader digital violence, not deepfake-specific legislation. UN Women also notes that 117 countries reported efforts to address digital violence in 2025, while responses remain fragmented. 9
Deepfake abuse exposes the limits of rules that only punish a final post. Synthetic content can be copied, recirculated and stored across services. Identifying the original creator may require evidence held in another country. Survivors may have to repeat their story to police, lawyers and moderators while trying to locate each copy. UN Women reports that these barriers contribute to low reporting and can make the route to help traumatic in itself. 10
The legal response is also broader than criminal prosecution. The AI Act’s transparency duties require certain AI-generated material to be identifiable or labelled, while EU rules on systems that generate non-consensual intimate content focus on prevention and safeguards. Labels can help people recognise synthetic media, but a label does not provide consent, undo humiliation or stop a malicious user from sharing an image. 2 14
Closing Thoughts
The strongest feature of these reforms is their recognition that a fabricated intimate image can still violate a real person’s dignity and autonomy. Yet legislation will be judged by what happens after a report is made: whether a victim can obtain a fast takedown, whether evidence is preserved, and whether responsibility reaches the people and systems that made the abuse possible. Laws should protect survivors without forcing them to prove that a synthetic image is authentic or to manage every copy alone.
What does this look like in practice?
A workable response has several steps. A person reports the image through a clear channel; the platform preserves relevant evidence, assesses the request promptly and removes the material where the law requires it. Investigators then need a way to identify the account or service involved, even when data crosses borders. A prosecutor can apply the rule that matches the conduct: creation, commissioning, sharing, threats or failure to comply with a removal duty. Support services should be available throughout, not only after a conviction.
That process requires trained staff, consistent definitions of consent, privacy-respecting evidence handling, accessible reporting and meaningful platform cooperation. Detection software may help locate copies, but it cannot replace human review or a survivor’s right to be heard.
Why does it matter?
A person’s sexual dignity and safety should not depend on whether an image was captured by a camera or generated by software. Clear laws can close loopholes, discourage abuse and give platforms and investigators duties they can be held to. Shared standards also matter because content travels across borders faster than a victim can pursue separate remedies in every country.
The remaining test is implementation. Rules must be enforced consistently, removal must be fast enough to limit further spread, and public safeguards must protect lawful expression and legitimate uses of AI. The goal is not to regulate synthetic media as such; it is to prevent the non-consensual use of someone’s identity and to give survivors a meaningful route to remedy.
References
Comments