Is a deepfake illegal? What the statutes say, jurisdiction by jurisdiction

This page is part of the deepfake detection hub and reads the texts rather than commentary. The datasets and consent page covers the regulators' decisions on face data; this one covers the statutes on the manipulated output.

01What makes a deepfake illegal under these texts?

None of the texts below makes a deepfake unlawful because it is a deepfake. Each attaches a consequence to a combination of content, consent, intent and place. The US federal and UK offences cover intimate depictions of a person who did not consent; the US offence adds intent to cause harm or actual harm, the UK base offence adds neither. The EU rule is a transparency duty on whoever deploys a system that produces a deep fake, not a criminal offence, and has no limit on subject matter. Virginia's statute, one state example, requires malicious dissemination with intent to coerce, harass or intimidate.

The rows are the texts read for this page; other US states, member states' criminal law and the rest of the world are outside it.

02What does the US TAKE IT DOWN Act say?

Section 2 of the Act inserts a new subsection (h) into section 223 of the Communications Act of 1934 and defines a "digital forgery" as "any intimate visual depiction of an identifiable individual created through the use of software, machine learning, artificial intelligence, or any other computer-generated or technological means" that, "when viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction of the individual" (S.146 enrolled text).

The offence is to use an interactive computer service to knowingly publish such a forgery of an adult without consent, where what is shown is not a matter of public concern and publication "is intended to cause harm" or "causes harm, including psychological, financial, or reputational harm". For a minor the test is intent to abuse, humiliate, harass or degrade, or to gratify sexual desire. Penalties are "imprisoned not more than 2 years" for adults and "not more than 3 years" for minors; threats to publish carry 18 and 30 months. Consent to the creation of a depiction "shall not establish that the individual provided consent for the publication".

Section 3 is the platform duty: a covered platform must establish a notice and removal process "not later than 1 year after the date of enactment" and, on a valid request, remove the depiction "not later than 48 hours" and "make reasonable efforts to identify and remove any known identical copies", with failure treated as an unfair or deceptive practice under the Federal Trade Commission Act. The Public Law page dates the Act 19 May 2025 (Public Law 119-12).

03What does the EU AI Act require for deepfakes?

Article 3(60) of Regulation (EU) 2024/1689 defines a "deep fake" as "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful". Article 50 imposes two duties. Providers of systems that generate synthetic audio, image, video or text "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated" (Article 50(2)). Deployers of a system that produces a deep fake "shall disclose that the content has been artificially generated or manipulated" (Article 50(4)), with a lighter duty for "an evidently artistic, creative, satirical, fictional or analogous work", where disclosure must not "hamper the display or enjoyment of the work" (Regulation (EU) 2024/1689).

The information must be given "at the latest at the time of the first interaction or exposure" (Article 50(5)). The Regulation was published in the Official Journal on 12 July 2024; Article 113 sets the general application date at 2 August 2026, and Article 50, in Chapter IV, takes that date. Article 99(4)(g) makes non-compliance with Article 50 subject to fines "of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover", whichever is higher.

04What are the UK offences?

Two Acts amended the Sexual Offences Act 2003. The Online Safety Act 2023 (Royal Assent 26 October 2023) inserted sections 66A to 66D by its sections 187 and 188. Section 66B makes it an offence to intentionally share "a photograph or film which shows, or appears to show, another person (B) in an intimate state" where B does not consent and the sharer does not reasonably believe B consents; aggravated forms add intent to cause alarm, distress or humiliation, or sexual gratification, and a fourth covers threats. The definition reaches deepfakes through section 66A(5), which treats "an image, whether made or altered by computer graphics or in any other way, which appears to be a photograph or film" as a photograph or film (Online Safety Act 2023, section 188). The base offence is summary only; the aggravated and threat offences carry up to 2 years on indictment. Part 10 of the Act, which holds these sections, came into force on 31 January 2024 under S.I. 2024/31.

The Data (Use and Access) Act 2025 added the creation offence. Its section 138 inserts section 66E, an offence of intentionally creating "a purported intimate image of another person" who does not consent, and section 66F, which covers requesting one. A purported intimate image "appears to be, or to include, a photograph or film of the person (but is not, or is not only, a photograph or film of the person)" and appears to show an adult in an intimate state. The offence is summary only, with a reasonable excuse defence; the revised text records that section 138 came into force on 6 February 2026 (Data (Use and Access) Act 2025, section 138).

05What does one US state statute look like?

Virginia's section 18.2-386.2 makes it a Class 1 misdemeanor to, "with the intent to coerce, harass, or intimidate, maliciously" disseminate or sell "any videographic or still image created by any means whatsoever" that depicts another person nude or in a listed state of undress without authorisation. The clause that reaches synthetic images defines "another person" to include "a person whose image was used in creating, adapting, or modifying a videographic or still image with the intent to depict an actual person and who is recognizable as an actual person by the person's face, likeness, or other distinguishing characteristic" (Code of Virginia 18.2-386.2). The history line records enactment in 2014 and amendments in 2019 and 2024 without saying which added the created-image clause, so this page does not either.

06How do these texts relate to detection?

Every text above defines its subject by what the content appears to show and by the circumstances of the person shown, not by how it was made or how detectable it is: the US test is a depiction "indistinguishable from an authentic visual depiction", the UK test an image that "appears to be a photograph or film", the EU test content that "would falsely appear to a person to be authentic or truthful". A detector score is evidence about a file, and the checking a face video page puts it last after provenance and context; the best deepfake detection model page shows that the best published off-the-shelf score on circulated fakes is 0.63 AUC.

The quotable caveat: a statute's date of force fixes the earliest conduct it can reach, so a 2023 case cannot be read against a 2025 Act. Metrics such as the equal error rate and conditions such as the FaceForensics++ compression levels describe how well a file can be classified; the statutes describe when making or sharing it carries a consequence.