The International Regulatory Landscape of Non-consensual Intimate Deepfakes

INTRODUCTION

In the new age of developing artificial intelligence ('AI') technologies, non-consensual intimate deepfakes ('NCIDs') are a critical issue affecting populations globally, developing into a priority for policy interests. NCIDs are as much an ethical issue as much as they are a regulatory one. The creation and sharing of NCIDs directly violate the autonomy and human rights of victims in the creation of consumable sexual content. Unlike conventional forms of sexual abuse, NCIDs are widely accessible due to the convenience and accessibility of AI technologies to create or share NCIDs.

Considering the growing urgency of regulating NCIDs, this report outlines the current policy responses across Australia, America, Europe and Asia, along with policy recommendations identified to develop more robust measures internationally. There has been a rapid rise in the number of NCIDs across all these jurisdictions. The gravity of this issue is evidenced in that 98% of all deepfake videos online are of a pornographic nature, with 99% of individuals targeted being women (Security Hero, 2023). In Australia alone, the creation of NCIDs has surged by 550% since 2019 (Cretan, 2025). The Asia-Pacific region has also seen a rise in deepfake creation, with a 1530% rise in cases between 2022 and 2023 (AI Asia Pacific Institute, 2024). In most jurisdictions, the largest demographics identified in victims of NCIDs are women and minors, with NCID creation and distribution being especially common in school and university environments (Werthmuller & Rix, 2025; Nwuda, 2026; EPRS, 2025). In America specifically, The National Center for Missing and Exploited Children ('NCMEC') revealed that as of 2025, there were 30,000 reports of users attempting to generate child sexual abuse material ('CSAM') (NCMEC, 2025).

The issue of criminalising NCIDs comes with many uncertainties, mainly in labelling NCIDs as actual crimes due to image generations being viewed as not contributing to 'physical' harm (The Straits Times, 2024). This raises questions on how to legislate and prosecute those creating or distributing NCIDs (Mackenzie & Choi, 2024). However, these are questions worth answering. In a report from United Nations ('UN') Women, 41% of respondents self-censored on social media to avoid being abused, and links were established between the risk of being victim to NCIDs and declining in mental health (UN Women, 2026). Despite the difficulties that arise around criminalising NCIDs, the importance of protecting victims and increasing deterrence through accountability is evident.

This paper explores each jurisdiction, discusses the limitations of each legislative approach, and provides some recommendations to improve each of these existing frameworks.

AUSTRALIA

CURRENT LEGISLATION

1. Creation and sharing of NCIDs

In 2024, the Australian federal government introduced new legislation banning the creation and sharing of NCIDs (Schriever, 2024). The introduction of the Criminal Code Amendment (Deepfake Sexual Material) Bill 2024 ('Deepfake Sexual Material Bill') sought to target both the creation and non-consensual sharing of sexually explicit content altered or created with AI technology (Griffiths, 2024). As a result, the Criminal Code Act 1995 (Cth) ('Criminal Code') extends to the use of carriage services, and material which depict either a sexual pose or activity and/or a sexual organ or region as designed to represent a real identifiable person (Griffiths, 2024). Sharing NCIDs has a maximum penalty of 6 years imprisonment, while both creating and sharing NCIDs has a maximum penalty of 7 years due to its classification as an aggravated offence (Griffiths, 2024).

2. Regulatory Agency

Australia also has its own independent online safety regulatory agency run by the eSafety Commissioner to expansively safeguard Australian online experiences (eSafety Commissioner, 2020). Amendments to the Criminal Code expanded the regulatory scope and power enabling the eSafety Commissioner to give remedial directions or penalties (Martin, 2025). The eSafety Commissioner released a series of response guides for deepfake incidents to support parents, teachers and students with NCID incidents within schools (eSafety Commissioner, 2020). These measures align with policy goals outlined in Australia's National Plan to End Violence against Women and Children 2022-2032 (Department of Social Services, 2025). The National Plan recognises the contribution of technology facilitated and intimate image-based abuse in perpetuating family and domestic violence against women and children (Department of Social Services, 2025). Between the financial years of 2018-2024, the eSafety Commissioner was estimated to have spent approximately $224.6 million in taxpayer funds to achieve regulatory objectives, reflecting the Federal Government's commitment to these initiatives (Martin, 2025).

LIMITATIONS AND RECOMMENDATIONS

Limitations:

- Difficulties defining the regulatory boundaries of AI governance: inability to entirely prohibit AI technology due to conflicts between stakeholders in fields such as commerce and education (Broinowski & Martin, 2024); AI technology continues to evolve in action capacity.
- The eSafety Commissioner's current regulatory capacity of action is reactive in nature, only addressing cases once brought to attention (Bolge & Taylor, 2024), and lacks effective preventative measures.
- Penalties associated with legislation: maximum penalties as opposed to minimum allow for judicial failures in sentencing proportionally to the severity of offences, and litigation remains very costly (Deepfake Sexual Material Bill).
- Enforcement of legislation requires updated skillsets of law enforcers and other frontline responders.

Recommendations:

- Call for restrictive measures: criminalise downloading, accessing and/or supplying "nudify" apps (Henry, 2025); collaborate with technology companies to increase AI technology transparency and introduce guardrails to reduce NCID capacity of AI technology (Henry, 2025).
- Preventative training: increase preventative training enforced by the eSafety Commissioner to improve general digital literacy and strengthen efficacy of bystander interventions (Broinowski & Martin, 2024); include NCID education in respectful relationship classes within schools and NCID training for law enforcers and frontline responders (Henry, 2025).
- Expand the regulatory powers of the eSafety Commissioner to address legislative blind spots.

AMERICA

CURRENT LEGISLATION

All states have various protections against NCIDs (STACK Cybersecurity, 2026). The Take It Down Act, 2025 ('TIDA') regulates NCIDs in two ways, and criminalises the publication of NCIDs, imposing obligations on digital platforms.

1. The criminalisation of the publication of NCIDs

The TIDA refers to 'digital forgeries' which are defined as "any intimate visual depiction of an identifiable individual created through the use of software, machine learning, artificial intelligence, or any other computer-generated or technological means, including by adapting, modifying, manipulating, or altering an authentic visual depiction, that, when viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction of the individual." The TIDA makes it a federal crime to publish NCIDs of an identifiable person without their consent. Prosecution under the TIDA requires that the forgeries are realistic enough to trick a reasonable observer, and that the maker had improper intent. Where the victim is an adult, the publication of digital forgeries must be intended to cause psychological, financial, or reputational harm. Where the victim is a minor, the intention must be to humiliate, harass, or sexualise the minor (Fichtner & Strader, 2026).

The TIDA further criminalises intentional threats to publish both digital forgeries and authentic images. The threats must have been made for the purposes of intimidation, harassment or extortion, with penalties dependent on the age of victims and the publication of such material. Unauthorised publication incurs fines and imprisonment for up to 2 years. The penalty is merely 18 months in cases of threatened publication. Where the victim is a minor, the penalty is increased to potential imprisonment of up to 3 years, and up to 30 months imprisonment for threats of publication (Fichtner & Strader, 2026).

2. Obligations on digital platforms

The TIDA imposes obligations on platforms to make reasonable efforts to remove NCIDs and duplicates within 48 hours of being notified of their existence. Non-compliance can result in significant fines. Platforms covered by these provisions include "public websites, online services, and mobile applications that primarily facilitate user generated content or specialise in publishing nonconsensual intimate imagery" (Fichtner & Strader, 2026). Obligations are enforced through a 'notice and removal' framework where platforms incorporate a mechanism for the report of NCID which requests for their removal (Fichtner & Strader, 2026).

LIMITATIONS AND RECOMMENDATIONS

Limitations:

- The Creation of Deepfakes: The TIDA targets the removal of NCIDs but fails to provide protections against their creation (Ding et al, 2026).
- Liability for the Creation of Deepfakes: current law assumes companies are aware of the nature and use of applications promoted on their platforms, creating a limitation (Nwuda, 2026).
- 'Notice and Removal' Framework: unlike the Digital Millennium Act (DMA), the TIDA lacks safeguards against misuse of the framework, meaning the framework may be subject to abuse (Thorpe, 2026).
- Scope of the Act: the TIDA has been criticised as being unconstitutionally overbroad (Ding et al, 2026), with a scope broad enough that it could be used as a tool of censorship and government control (Grimmelmann, 2025).

Recommendations:

- Incorporate in TIDA the approach in Anderson v TikTok, which established liability for the knowing distribution and targeted amplification of content that posed risks to minors, and introduce provisions creating liability for platforms that knowingly or recklessly allow proliferation of NCIDs.
- Incorporate in TIDA penalties for misuse of the notice-and-removal framework, and establish a 1-2 week review period following the 48-hour takedown period to allow platforms time to verify the unlawful nature of content (Thorpe, 2026).
- Amend TIDA to clarify the language used and narrow the scope (Greeno, 2025).

ASIA

CURRENT LEGISLATION

Several Asian countries have attempted to address the issue of NCIDs with methods ranging from expanding existing law and creating new legislation, resulting in varied efforts across the region.

1. South Korea

South Korea is significantly affected by the issue of the epidemic of digital violence against women and children, with 53% of NCIDs existing globally being created in South Korea (Security Hero, 2023). In 2024, after several years of protests against the spread of deepfakes through Telegram chats, South Korea's National Assembly passed a bill to criminalise the creation or consumption of NCID material, where perpetrators can be jailed up to a maximum of seven years (CNN World, 2024). Whilst South Korea has taken promising steps against digital sex crimes such as NCIDs, without cultural education and accountability, there are limited impacts of the current legislation in place. In the 2024 period, there were 812 reports of deepfake crimes with only 387 apprehensions, leaving over 400 perpetrators unprosecuted (Smith & Brake, 2024). The politicisation of sex crimes in the country also contributes to the attitudes around criminalisation, with a previous Digital Sexual Crimes Task Force being dissolved in 2022.

2. Hong Kong

In Hong Kong, a different approach has been taken to combat similar issues of cases with prolific NCID crimes. After a case in 2025 of students at a university being caught spreading over 700 sexually explicit deepfakes on campus, there were difficulties in prosecuting perpetrators without clear legislative bases to do so (Au & Chen, 2025). The Hong Kong Privacy Commissioner asserted that the existing legislation was enough to prosecute individuals (Ka-sing, 2025). However, others suggest NCIDs may fall outside of the scope of current legislation, because current laws only prohibit superimposed images when there are threats to publish without consent (Au & Chen, 2025). The generation of NCIDs is still not criminalised (Channel News Asia, 2025).

3. China

In China, attempts have been made to prosecute perpetrators through the current laws around criminalising obscenity, instead of implementing amendments to capture NCIDs. Whilst the Cyberspace Administration of China has addressed holding service providers accountable through draft legislation in 2023, no specific legislative provisions have been enacted to address NCIDs specifically (Hemrajani, 2023). However, there have been arrests made for creation of NCIDs utilising the existing laws on obscenity crimes, on the basis that obscene materials are not permitted to be distributed for profit (Daum, 2026).

4. Singapore

Singaporean lawmakers have passed the Online Safety (Relief and Accountability) Act to protect victims of deepfakes in 2025, with an Online Safety Commission ('OSC') being established to target NCID content and protect victims from anonymous perpetrators (Koh, Tham, & Liam, 2025). The OSC launched in 2026, with the new Act complementing existing laws in conjunction with a narrowed scope to cover new types of digital violence and plans to expand further. This follows the United Kingdom and South Korea in implementing similar penalties for creation and possession of NCID material, with the penal code now providing for penalties between five to 10 years, depending on the offence (Singapore Ministry of Home Affairs, 2025).

5. Indonesia, the Philippines and Malaysia

Indonesia, the Philippines and Malaysia have taken the approach of banning 'Grok', the AI technology implemented on the platform 'X', to temporarily curb the creation of sexually explicit deepfake material. This is the first instance of a state intervening against the platform (Trajano, 2026). The categorisation of Grok's 'undressing' capability as a cybercrime and the quick response to the issue reflects on the severity of the issue and shows national lawmakers around the world are attempting to update their regulation with developments in technology.

LIMITATIONS AND RECOMMENDATIONS

Limitations:

- Reliance on existing laws to capture NCIDs as a crime, e.g. utilisation of obscenity laws in China, wherein NCIDs may not meet the thresholds for what constitutes obscenity (Hemrajani, 2023).
- Insufficient deterrence of NCID crimes, indicating reactive approaches (Au & Chen, 2025).
- Current penalties do not reflect the severity of the crime and do not adequately protect victims' interests, exacerbating harm.
- Patchwork of approaches across Asia in addressing NCIDs, which are inconsistent in their approaches to criminalisation, including bans on AI models such as 'Grok' in some places such as Indonesia, Malaysia and the Philippines.

Recommendations:

- Clarify definitions of obscenity to capture NCIDs within obscenity laws rather than relying on existing legislation (Daum, 2026), and introduce new laws to accurately capture NCIDs within the scope of the criminal justice system, following the approach in Singapore.
- Implement institutional responses that align with cultural understandings to approach education around criminal justice, and implement deterrence through meaningful accountability, creating preventative measures (Au & Chen, 2025).
- Raise the terms of imprisonment to adequately reflect the severity of the crimes due to their non-consensual and sexual nature, and increase urgency of action to avoid further harm and protect victims.
- Implement a uniform approach across the Asia-Pacific region to highlight the severity of the crimes and establish a collective approach to protecting victims (Trajano, 2026), echoing the approach of Indonesia, the Philippines and Malaysia.

EUROPE

CURRENT LEGISLATION

There are three key pieces of legislation relevant to the creation and dissemination of NCIDs which are applicable to all member states of the European Union.

1. The General Data Protection Regulation (GDPR)

The GDPR was enacted in 2018 to establish the importance of data privacy and security. It applies to any platform or organisation that processes the personal data of any citizens or residents of the European Union (Wolford, 2025). A violation of the GDPR results in a fine of maximum €20 million or 4% of global revenue, depending on which is higher, in addition to compensation if demanded (Wolford, 2025).

The GDPR overlaps with NCIDs as personal data, in the form of images, is processed when deepfakes are created (van der Helm, 2021). Persons that create deepfakes fall under the definition of creators and thus are required to respect rights and remedies in the GDPR (van der Helm, 2021). Under those rights, data subjects can request platforms to remove NCIDs as the creator has unlawfully processed data (van der Helm, 2021).

2. The Digital Services Act ('DSA')

The DSA came into effect in 2024 and aims to create a digital space that respects the rights of citizens and consumers (European Commission, n.d.). The obligations imposed by the DSA are dependent on the size and impact of the platform, to minimise the risks of exposing citizens to harmful and illegal content (European Commission, n.d.). Under Article 54, individuals can seek compensation if there is a violation of an obligation in the DSA. Victims of NCIDs also have a right of removal without undue delay (von Wickede et al., 2024; EPRS, 2024).

There are additional obligations for very large online platforms ('VLOPs'). VLOPs must conduct risk assessments on whether their services have "foreseeable negative effects on human dignity" by "facilitating the dissemination of illegal content" (EPRS, 2024). For example, investigations into X were opened under both the DSA and GDPR as its new AI-enabled picture editing feature should have had a comprehensive risk assessment foreseeing and preventing the outpour of NCIDs, indicating that the VLOP violated the DSA by not conducting a good faith risk assessment (Seck & Maier, 2026).

3. The European Union Artificial Intelligence Act 2024 ('AI Act')

Under the AI Act, AI technologies are classified according to their risk level, which includes banning systems and applications that pose unacceptable risks, imposing regulations for high-risk AI systems, and imposing lighter transparency obligations for limited risk AI systems (AI Act). Most of these obligations are placed on providers and developers of high-risk AI systems (AI Act). Non-compliance with prohibited AI practices has maximum fines of the higher amount out of EUR 35 million or 7% of total worldwide annual turnover, while breaches of high-risk AI system requirements have maximum fines of EUR 15 million or 3% of total worldwide annual turnover depending on which is higher (DLA Piper, 2026).

The application of some rules for high-risk AI systems has been delayed by the European Union to give regulators and companies more time to prepare (Pala, 2026). This includes Article 50, which covers transparency obligations for content created or manipulated by AI (Hartman, 2026). A political agreement on proposed amendments to the AI Act was reached by European Union legislative bodies in May 2026 (Latham & Watkins, 2026). The amendments, not yet in force, specified the prohibition of AI systems that generate or manipulate sexually explicit content without explicit consent (Latham & Watkins, 2026). AI systems designed to create intimate deepfakes or those lacking reasonable safeguards against such use cannot be placed on the European Union market by providers or deployers (Latham & Watkins, 2026). Penalties for violation are fines up to €35 million or 7% of annual worldwide turnover, whichever is higher (Latham & Watkins, 2026).

LIMITATIONS AND RECOMMENDATIONS

Limitations:

- The General Data Protection Regulation: to receive compensation, the creator of an NCID needs to be identified, which is difficult as NCID creators are often anonymous (van der Helm, 2021); the victim bears the onus of removing NCIDs as they have to initiate its removal (EPRS, 2024).
- The Digital Services Act: despite reporting mechanisms, NCIDs remain online for prolonged periods or spread before moderation, with platforms seeming to prioritise engagement over effective enforcement (Balueva et al., 2021), focusing on platform risk management rather than victim-centred remedies.
- The AI Act: transparency obligations are difficult to enforce as watermarking can easily be stripped and creators of synthetic content will not self-identify (Seeman, 2025), with no remedies for victims, no penalties for malicious use, and broad exceptions for creative works (Seeman, 2025).

Recommendations:

- Provide alternatives for individuals to seek compensation from search engines and social media platforms that fail to remove NCIDs (van der Helm, 2021).
- Utilise the existing DSA framework to hold VLOPs accountable for NCIDs in conjunction with the AI Act for victim-centred remedies (Balueva et al., 2021).
- Introduce criminal liability for the creation and dissemination of NCIDs, as in Italy (Seeman, 2025), and introduce enforceable rights for individuals over images through a likeness-based copyright model, such as that considered by Denmark (Seeman, 2025).

RECOMMENDATIONS FOR AUSTRALIA

The legislative amendments in Australia to address the issue of NCIDs have been significant milestones but remain limited. Having considered the approaches taken by other jurisdictions, we recommend that:

1. Australia consider imposing obligations on online platforms, similar to the approach taken in America under the TIDA (Fichtner & Strader, 2026).

2. Australia help establish a joint Asia-Pacific regulatory organisation to aid in addressing the transnational nature of AI technologies in a uniform manner, and highlight the critical nature of the crime by addressing it at an international level. Australia has already established an online safety regulatory agency similar to the OSC that exists in Singapore. However, the OSC assists in targeting the role that platforms have in the production of NCID. The eSafety commission could expand their responses in recognition of the risk that online platforms create with NCID (Koh, Tham, & Liam, 2025).

3. Australia consider implementing or legislating a mechanism similar to the Digital Services Act, which applies in the European Union, to hold platforms accountable for facilitating the creation and dissemination of NCIDs (European Commission, n.d.).

In conjunction with these findings, the Australian government should prioritise the extensive of different groups of society to reduce susceptibility to creation, and encourage the adoption of preventative precautions (Henry, 2025). The regulatory and legislative landscapes across the world are evidencing efforts in criminalising NCIDs as a first step, where in future countries are to strive towards proactive measures, and prioritising prevention of harm to victims.