Deepfake laws by jurisdiction: what each text requires, and from when

This page belongs to the consent and regulation part of the deepfake detection hub. The is a deepfake illegal page answers the reader's question by the four tests the statutes apply; this page is the law-by-law reference with dates of force, and adds China, which that page does not cover.

01Which deepfake laws are in force, and from when?

The rows are the texts read for this page; other US states, member states' criminal law and the rest of the world are outside it.

02What does the US TAKE IT DOWN Act ban?

The Act inserts a subsection (h) into section 223 of the Communications Act of 1934 and defines a "digital forgery" as "any intimate visual depiction of an identifiable individual created through the use of software, machine learning, artificial intelligence, or any other computer-generated or technological means" that a reasonable person would find indistinguishable from an authentic depiction (S.146 enrolled text). The offence is to knowingly publish one online without consent where publication is intended to cause or causes harm; the penalty is "imprisoned not more than 2 years" for an adult subject and "not more than 3 years" for a minor, and consent to creation "shall not establish that the individual provided consent for the publication".

Section 3 adds the platform duty: within one year of enactment a covered platform must run a notice process and remove a reported depiction "as soon as possible, but not later than 48 hours", enforced by the Federal Trade Commission. The Public Law page records approval on 19 May 2025 (Public Law 119-12).

03What does the EU AI Act require for deep fakes?

Regulation (EU) 2024/1689 defines a deep fake in Article 3(60) as "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful" (Official Journal text). Article 50 places two duties: providers of generative systems "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated", and deployers producing a deep fake "shall disclose that the content has been artificially generated or manipulated", with a narrower disclosure for evidently artistic or satirical work.

The Regulation was published on 12 July 2024 and, under Article 113, applies from 2 August 2026, the date that governs Article 50. Non-compliance carries, under Article 99(4)(g), "administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher". The marking duty connects to the provenance standards on the Content Credentials and C2PA page, though the Regulation names no standard.

04What do the UK provisions make an offence?

Two Acts amended the Sexual Offences Act 2003. The Online Safety Act 2023, section 188, inserted sections 66B to 66D: an offence of intentionally sharing "a photograph or film which shows, or appears to show, another person (B) in an intimate state" without consent (section 188); section 66A(5) treats an image "made or altered by computer graphics or in any other way, which appears to be a photograph or film" as one, which brings a deepfake within it. The base offence is summary only and the aggravated forms carry up to 2 years on indictment. Part 10 commenced on 31 January 2024 under S.I. 2024/31 (commencement regulations).

The Data (Use and Access) Act 2025, section 138, inserted sections 66E and 66F: creating, or requesting the creation of, a "purported intimate image" of an adult without consent, punishable on summary conviction by imprisonment up to the summary maximum or a fine. The revised text records "S. 138 in force at 6.2.2026 by S.I. 2026/31, reg. 2" (section 138).

05What does China's Deep Synthesis regulation require?

The Provisions on the Administration of Deep Synthesis Internet Information Services were issued as Decree No. 12 of the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security on 25 November 2022 and, under Article 25, took effect on 10 January 2023 (official text, cac.gov.cn). Article 23 defines deep synthesis to include face generation, face replacement, face manipulation and posture manipulation. The text is in Chinese; the summaries below are this page's reading of it.

Four articles bear on face deepfakes. Article 14 requires a provider offering face or voice editing to prompt the user to inform the person being edited and obtain their separate consent. Article 16 requires technical marks, not affecting use, on all generated or edited content. Article 17 requires a prominent label on the content for services that could confuse or mislead the public, naming face generation, face replacement, face manipulation and synthesised or imitated voices, and Article 18 forbids removing, altering or hiding those marks. Article 22 attaches no penalty of its own: breaches are punished under other laws, with public security sanctions for public order violations and criminal liability for crimes.

06How do these laws differ in what they regulate?

The US federal, UK and Virginia texts are criminal offences aimed at one content type, the intimate image of a real person made or shared without consent, and they bind the person who publishes, shares or creates it; the UK creation offence is the only one that bites before anything is shared. The EU and Chinese texts are administrative rules that bind the system's provider and deployer, require marks and labels on the output, and do not depend on consent or intent. Both groups can apply to one clip. None of these texts says how a deepfake is to be detected, and none sets an accuracy requirement for detectors. The documented deepfake scams page records cases of the harm these laws address; the datasets and consent page covers the regulators' decisions on face data.