Introduction
The rapid advancement of artificial intelligence (AI) technologies has given rise to deepfakes, digitally manipulated videos or audio that convincingly depict individuals saying or doing things they never did. While these technologies hold potential for creative and benign uses, their misuse—particularly creating deepfakes of others without consent—poses significant ethical, social, and legal challenges. This essay argues that the creation of deepfakes without explicit permission should be made illegal under EU law, focusing on the threats to privacy, reputation, and societal trust. Drawing on existing EU legal frameworks, such as data protection and privacy regulations, the discussion will explore the risks associated with deepfakes, evaluate the adequacy of current laws, and propose the need for specific legislative measures. By examining these dimensions, the essay aims to highlight the urgent necessity for robust legal intervention to mitigate the harms of unauthorised deepfake creation.
The Nature and Risks of Deepfakes
Deepfakes are created using deep learning algorithms, particularly generative adversarial networks (GANs), which enable the synthesis of hyper-realistic content by overlaying one person’s likeness onto another’s body or voice (Paris and Donovan, 2020). While initially developed for entertainment and satire, their potential for harm has become increasingly evident. For instance, non-consensual deepfake pornography, which often targets women, has proliferated online, causing severe emotional distress and reputational damage (Ajder et al., 2019). Beyond individual harm, deepfakes can undermine democratic processes by spreading disinformation, as seen in fabricated political footage designed to manipulate public opinion.
The risks associated with deepfakes are multifaceted. Primarily, they infringe on personal privacy by misappropriating an individual’s likeness without consent, a direct violation of fundamental rights enshrined in EU law. Additionally, the viral nature of online content exacerbates the difficulty of retracting or debunking false material, leaving victims with limited recourse. Indeed, the psychological impact of such misuse cannot be understated, as individuals may face humiliation or harassment long after the content is removed. These concerns necessitate a critical examination of whether current EU legal frameworks are equipped to address such novel technological threats.
EU Legal Frameworks: Privacy and Data Protection
Under EU law, the protection of personal data and privacy offers a starting point for addressing the harms of deepfakes. The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a cornerstone of this framework, establishing strict rules on the processing of personal data, including biometric data such as facial images (European Union, 2016). Creating a deepfake often involves using an individual’s likeness, which qualifies as personal data under Article 4(1) of the GDPR. Processing such data without lawful basis or consent violates GDPR principles, potentially attracting hefty fines and legal action.
Moreover, Article 8 of the Charter of Fundamental Rights of the European Union guarantees the right to the protection of personal data, while Article 7 safeguards respect for private and family life (European Union, 2012). Unauthorised deepfakes arguably breach these rights by exploiting personal attributes for malicious or deceptive purposes. However, while the GDPR provides a robust framework for data protection, it does not explicitly address the unique challenges posed by AI-generated content. For example, enforcement becomes complex when deepfakes are created using publicly available images, raising questions about the scope of ‘lawful processing’ under GDPR. This gap suggests that while existing laws offer some protection, they are insufficiently tailored to tackle the nuances of deepfake technology.
The Limitations of Current EU Legislation
Despite the protective mechanisms of the GDPR and the Charter, several limitations hinder their effectiveness against deepfakes. Firstly, the transnational nature of digital content complicates jurisdiction and enforcement. Deepfakes created in one country can be disseminated globally, making it difficult for EU regulators to hold perpetrators accountable if they operate outside the bloc. Secondly, the GDPR primarily focuses on data controllers and processors, which may not easily apply to individual creators or anonymous actors sharing deepfakes on decentralised platforms.
Furthermore, while the EU’s Digital Services Act (DSA) (Regulation (EU) 2022/2065) imposes obligations on online platforms to address illegal content, its provisions on AI-generated material remain broad and lack specificity regarding deepfakes (European Union, 2022). This legislative ambiguity means that victims often struggle to seek redress, as platforms may not prioritise the removal of such content without clearer legal mandates. These shortcomings highlight the need for targeted legislation that explicitly addresses the creation and distribution of unauthorised deepfakes, ensuring accountability at both individual and systemic levels.
Arguments for Prohibiting Unauthorised Deepfakes
Given these challenges, there is a compelling case for introducing specific EU legislation to prohibit the creation of deepfakes without consent. Such a law would serve multiple purposes: it would protect individuals’ rights to privacy and dignity, deter malicious actors through clear penalties, and reinforce societal trust in digital media. A precedent for such an approach can be observed in the EU’s proactive stance on other technology-related harms, such as cybercrime under the Budapest Convention, which the EU supports (Council of Europe, 2001). By analogy, a similar framework could criminalise non-consensual deepfake creation, establishing it as a distinct offence with defined sanctions.
Moreover, a legal prohibition could be complemented by mandatory labelling of AI-generated content, ensuring transparency and reducing the risk of deception. Critics might argue that such a ban could stifle innovation or freedom of expression, particularly in artistic or satirical contexts. While these concerns are valid, they can be addressed through exceptions for consensual or publicly beneficial uses, provided strict safeguards are in place (Ajder et al., 2019). Balancing these competing interests is complex, yet the overriding need to protect vulnerable individuals from harm arguably justifies a restrictive approach.
Conclusion
In conclusion, the emergence of deepfakes represents a profound challenge to personal privacy, societal trust, and legal frameworks within the EU. While existing laws such as the GDPR and the Charter of Fundamental Rights provide a foundation for addressing these harms, their limitations—particularly regarding enforcement and specificity—reveal the inadequacy of current measures. Therefore, this essay has argued for the introduction of targeted EU legislation to make the creation of deepfakes without consent illegal, complemented by transparency measures like mandatory labelling. Such steps would not only safeguard individual rights but also set a precedent for regulating emerging technologies responsibly. The implications of inaction are significant; without clear legal intervention, the proliferation of unauthorised deepfakes risks normalising privacy violations and eroding trust in digital spaces. As technology continues to evolve, so too must the law, ensuring that innovation does not come at the expense of fundamental human rights.
References
- Ajder, H., Patrini, G., Cavalli, F., & Cullen, L. (2019) The State of Deepfakes: Landscape, Threats, and Impact. Witness.
- Council of Europe. (2001) Convention on Cybercrime. Council of Europe Treaty Series, No. 185.
- European Union. (2012) Charter of Fundamental Rights of the European Union. Official Journal of the European Union, C 326/391.
- European Union. (2016) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119/1.
- European Union. (2022) Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services (Digital Services Act). Official Journal of the European Union, L 277/1.
- Paris, B. & Donovan, J. (2020) Deepfakes and Cheap Fakes: The Manipulation of Audio and Visual Evidence. Data & Society Research Institute.
