Deepfakes and Consent: The Law on Non-Consensual Imagery

Almost every law targeting harmful deepfakes rests on a single idea: consent. A sexual or intimate image of a real person is not unlawful because it was made with AI. It is unlawful because the person depicted never agreed to it. Consent, or its absence, is the line that separates a lawful image from image-based sexual abuse, and it is the concept at the center of the fastest-moving area of deepfake law.

This guide explains the law on non-consensual intimate imagery, or NCII, as it applies to deepfakes: why consent is the legal linchpin, what actually counts as non-consensual imagery, what consent does and does not cover, how US and international law protect victims, and the concrete steps available to someone who has been targeted. Two notes before beginning. This is general information, not legal advice; the law changes quickly and varies by jurisdiction, so consult a qualified lawyer about a specific situation. And if you are dealing with this personally, support and takedown resources are listed at the end of this article.

The harm is neither hypothetical nor evenly distributed. Non-consensual deepfakes overwhelmingly target women and girls, and victims report severe and lasting effects. The law has responded, and understanding how it works starts with consent.

Why Consent Is the Legal Linchpin

The reason consent sits at the heart of this area of law is that lawmakers chose to regulate a harm rather than a technology. Making synthetic media is not inherently illegal, and neither is creating adult content with willing, consenting participants. What the law prohibits is using a real person's likeness in intimate content they never agreed to, because that is the act that causes the harm: the loss of control over one's own body and image.

This framing has a practical consequence. It means the same deepfake can be perfectly lawful or seriously criminal depending on one thing that is invisible in the image itself, namely whether the depicted person consented. A synthetic intimate image made with a performer's documented permission is lawful; the identical technique applied to a classmate, a colleague, or an ex-partner without their agreement is image-based sexual abuse. Consent is not a technicality in these laws. It is the entire offense.

‍

What Counts as Non-Consensual Intimate Imagery

Non-consensual intimate imagery is the creation, sharing, or threatened sharing of nude, partially nude, or sexually explicit images of a person without their consent. When those images are fabricated or altered with AI rather than photographed, they become non-consensual synthetic intimate imagery, commonly called deepfake pornography. In practice this covers several techniques: swapping a real person's face onto existing explicit footage, using a "nudify" app that digitally removes clothing from an ordinary photo, and generating a fully synthetic sexual image of a real, identifiable person.

A crucial point, now settled in US federal law, is that the harm does not depend on any genuine intimate image ever having existed. If someone's face is placed on another body, or a nude is generated from an innocent photo, the law still applies, because the depicted person is identifiable and did not consent. The fact that "it never really happened" is not a defense; for many victims it is part of what makes the violation so disorienting.

‍

What Consent Does and Does Not Cover

Most of the confusion in this area comes from misunderstanding the limits of consent, so it is worth being precise. Consent is specific, informed, and ongoing, and it does not transfer from one context to another.

Consent to create or send an image is not consent to share it. An intimate photo sent willingly to a partner becomes NCII the moment it is distributed without ongoing agreement. Consent to a real photograph is not consent to a deepfake; agreeing to be photographed clothed says nothing about a synthetic nude built from that photo. A publicly available image is not consent to sexualize it, and celebrity or public status does not waive the protection. Consent to one use is not consent to another, which is why the standard for legitimate uses is that consent should be specific, documented, and aligned with the intended use. And critically, minors cannot consent at all: any sexual deepfake of a minor is child sexual abuse material, illegal everywhere, with no artistic, personal, or satirical exception of any kind.

From Sharing to Creation: How the Law Expanded

The law has moved in three distinct waves, and knowing which wave a jurisdiction has reached explains what is actually prohibited there. The first wave criminalized the sharing or distribution of non-consensual intimate images, treating the harm as a publication problem. The second wave went further and criminalized the creation of such images, recognizing that the violation occurs at the moment of fabrication, even if the image is never posted. The third and current wave shifts attention to the enablers, placing removal obligations on platforms and, increasingly, aiming legislation at the generative AI tools, "nudify" services, payment processors, and hosts that make the abuse possible at scale.

‍

‍

This progression is why the same conduct can carry very different consequences in different places, and why "I only made it, I never shared it" is a shrinking defense.

‍

US Law: Criminal and Civil Protection

The centerpiece of US federal law is the TAKE IT DOWN Act, signed in May 2025, which makes it a federal crime to knowingly publish non-consensual intimate images of an identifiable person, expressly including AI-generated digital forgeries, and separately criminalizes threatening to publish them, which addresses sextortion. Penalties reach up to two years in prison for offenses involving adults and three years when a minor is depicted, and courts must order restitution to the victim. The law also imposes platform duties: as of May 19, 2026, covered platforms must run a notice-and-removal process and take flagged content down within 48 hours of a valid request, enforced by the Federal Trade Commission. The statute is already being enforced, with the first conviction handed down in April 2026 against an Ohio man who used AI to create and distribute such imagery in his community.

On the civil side, victims are gaining the ability to sue for damages. The DEFIANCE Act, which passed the Senate unanimously in January 2026 but had not yet become law, would create a dedicated federal civil cause of action for survivors of deepfake intimate imagery, with liquidated damages up to $150,000, or $250,000 where the content is tied to sexual assault, stalking, or harassment, plus a ten-year window to sue. In the meantime an existing federal civil remedy under 15 U.S.C. section 6851, created through the Violence Against Women Act reauthorization, may apply where the victim is identifiable. Beneath the federal layer, all 50 states and the District of Columbia have some NCII law, and 46 states now have statutes explicitly covering sexually explicit deepfakes, many also providing their own civil remedies.

The Law Elsewhere

Other jurisdictions have converged on the same consent-based approach through different routes. The United Kingdom criminalized sharing intimate deepfakes under the Online Safety Act 2023, then used the Criminal Justice Act 2025 to make creating one a standalone offense, with prosecutors confirming in 2026 that the offense applies even to content made purely for personal use. South Korea has among the world's toughest laws, where even possessing a non-consensual sexual deepfake can be criminal, a stance hardened after a large-scale abuse incident in 2024. France and Germany criminalize non-consensual sexual deepfakes directly, and across the European Union the Digital Services Act requires large platforms to remove such illegal content once notified. Australia handles the issue through its eSafety regulator, which can order removal and pursue civil penalties. The common thread is that non-consensual intimate deepfakes are now treated as image-based sexual abuse in a rapidly growing list of countries, rather than as a novelty of the technology.

‍

Rights and Remedies for Victims

If you have been targeted by a non-consensual deepfake, you have more options in 2026 than at any point before, and none of them require you to accept the content staying online. The practical sequence matters. Preserve evidence first, capturing screenshots that show the URL, the account that posted the content, and any timestamps, before anything is removed. Then request removal through the platform's reporting flow; under the TAKE IT DOWN Act, covered platforms must act within 48 hours of a valid notice. To stop the content from reappearing, hashing tools create a digital fingerprint of an image that partner platforms use to block re-uploads, without the image itself ever being shared. Alongside removal, you can report the matter to police for criminal referral, and consult an attorney about civil damages under state law or the emerging federal remedies.

For platforms and organizations, these rights translate into an operational duty. The 48-hour takedown requirement, and the obligation to make reasonable efforts to remove copies, assume a platform can actually detect the offending content at scale, which is where automated detection supports compliance. DuckDuckGoose's DeepDetector analyzes images and video for the signatures of synthetic media, helping platforms identify deepfakes so they can meet takedown and user-protection obligations and pair detection with hash-matching to prevent re-uploads. Detection does not resolve the question of consent, but it is what lets a platform act on a victim's request quickly enough to matter.

‍

Frequently Asked Questions

Is it illegal to make a non-consensual deepfake?
In a growing number of places, yes. Making a sexual or intimate deepfake of a real person without their consent is criminal under a rising wave of laws. The US TAKE IT DOWN Act criminalizes publishing such content, the UK criminalizes even creating it, and any sexual deepfake of a minor is illegal everywhere. Consent is what determines legality.

Does consent to a real photo count as consent to a deepfake?
No. Agreeing to be photographed, even nude, does not authorize someone to create a different synthetic image, and consenting to share an image in one context does not authorize another use. US federal law makes clear that an AI-generated sexual image of an identifiable person is covered even if no real intimate photo of them ever existed.

What is the TAKE IT DOWN Act?
It is the first US federal law criminalizing the non-consensual publication of intimate images, including AI-generated deepfakes, signed in May 2025. It also requires covered platforms to remove flagged content within 48 hours of a valid report and to make reasonable efforts to remove copies, with the FTC enforcing platform compliance. The first conviction under it came in April 2026.

Can victims of deepfake pornography sue?
Increasingly, yes. Many state laws provide civil remedies, and an existing federal civil provision may apply where the victim is identifiable. The DEFIANCE Act, which passed the Senate in January 2026, would create a dedicated federal civil cause of action with damages up to $150,000, or $250,000 when tied to abuse, though it was not yet law as of early 2026.

What should I do if someone made a deepfake of me?
Preserve evidence with screenshots first, then use the platform's reporting process to request removal, which covered platforms must action within 48 hours. Use a hashing tool such as StopNCII.org to block re-uploads, contact a support organization like the Cyber Civil Rights Initiative, and consider reporting to police and consulting an attorney about civil options.

Is it illegal to make a deepfake of a minor?
Yes, without exception. Minors cannot consent, and any sexual or intimate deepfake of a minor is child sexual abuse material, which is illegal in every jurisdiction with no artistic, personal, or satirical exception. Anyone who was under 18 when a targeted image was taken can use NCMEC's Take It Down service to have it removed.

Is creating a deepfake illegal if I never share it?
In some places, yes. The UK's Criminal Justice Act 2025 makes creating an intimate deepfake an offense even if it is never distributed, and prosecutors have confirmed this applies to content made purely for personal use. Other jurisdictions still focus on distribution, so the answer depends on where you are.

Do public figures have the same protection?
Generally yes for intimate imagery. Being a public figure does not waive protection against non-consensual sexual deepfakes, and high-profile incidents have driven much of the recent legislation. Public status affects some other areas of deepfake law, such as commentary and satire, but it does not create a right to make sexual content of someone without consent.

This article is for general information only and is not legal advice. Laws on deepfakes and non-consensual imagery change frequently and differ by jurisdiction. Consult a qualified attorney about your specific situation.

Support and takedown resources: StopNCII.org offers a free hashing tool for adults to block the spread of intimate images across partner platforms. NCMEC's Take It Down service (takeitdown.ncmec.org) does the same for anyone who was under 18 when an image was taken. The Cyber Civil Rights Initiative (cybercivilrights.org) provides free crisis support and removal guidance.