Once a novelty on the internet, deepfakes – AI-powered videos, images or audio that convincingly impersonate people – have gone mainstream. From their origins as a novelty, they are increasingly being used in everything from election campaigns to scamming. As deepfakes become easier to produce, many are asking: Are deepfakes illegal?
Well, yes and no. In 2026, deepfakes are generally in a legal grey zone. The software is not typically illegal, but how it’s applied can quickly become illegal.
Why Deepfakes Aren’t Always Illegal
The key thing to remember about deepfake detection is that they are a tool. They can be applied for both benign and malicious purposes. For instance, creators and filmmakers sometimes use AI similar to deepfakes to age-regress actors or bring historical characters to life. They usually do so in a lawful way, particularly if it’s with permission and disclosure.
But there are issues when deepfakes are used for deception, manipulation, and harm. This is where most laws kick in. Rather than place an outright ban on the technology, governments typically regulate its use, especially when deepfakes are used to deceive, impersonate or spread disinformation.
In the United States: No One Rulebook
In the US, there isn’t a single law that explicitly defines the legality of deepfakes. Rather, it’s a bit of a patchwork, with various states enacting laws to address different threats.
For example, some states (such as California and Texas) have introduced laws that specifically address deepfakes in political campaigns, particularly when they are used to deceive voters. And there are laws protecting people from non-consensual creation of deepfake material, especially non-consensual pornographic material, which is sometimes categorised as revenge porn.
More generally, many negative applications of deepfakes fall under current laws. If someone creates a deepfake of a corporate CEO and persuades some employees to transfer money, then that would be covered by fraud and identity theft laws, even if the statute doesn’t specifically mention “deepfake”.
EU: The More Organised Approach
The European Union has adopted a more integrated and proactive approach. Instead of addressing deepfakes specifically, it has developed more general regulations around AI that indirectly regulate deepfakes.
The AI Act requires deepfakes to be transparently labelled in many cases. Put simply, if it is AI-generated and may deceive someone, then it must be disclosed. This is part of the EU’s plan.
Also, existing laws such as the GDPR apply if there are privacy issues. So, if someone’s facial or auditory likeness is mimicked without their consent, this may give rise to privacy concerns – even if the message is not intentionally harmful.
What’s interesting about the EU approach is that it’s not only about punishing wrongdoing, but also about stopping it in the first place.
United Kingdom: Closing the Gaps
The UK is somewhat in between the US and EU. It has strong reliance on existing legislation, but is increasingly adopting more specific measures.
The Online Safety Act, for instance, will address harmful online content, including manipulated media. There is also a greater focus on deepfake porn and harassment, with calls for tougher punishments.
In reality, if a deepfake is used to cause harm – for example, financially, socially or emotionally – it is likely to breach established laws such as fraud, defamation or harassment. The difference is that we’re starting to realise we need to address AI content more explicitly in the future.
Asia-Pacific: Quick and Severe in Some Cases
Some Asian governments have been more proactive. In China, for instance, there are some of the most specific regulations on deepfakes.
There, deepfakes must be marked as fake and creators must seek permission from the people they’re depicting. This is true for both harmful and benign deepfakes. This is to eliminate doubt – viewers must be able to tell when something is not real.
Elsewhere in the region, it’s early days. For instance, India doesn’t yet have specific legislation around deepfakes, but has existing IT and criminal laws that it uses to address cases. Australia is also tackling online safety and misinformation, particularly relating to elections and trust.
When is a Deepfake Illegal?
There are some consistencies across countries. A deepfake is likely to be illegal if it involves:
Impersonation and fraud: To obtain a benefit (such as money)
Consent issues: Particularly sex-related material without permission
Defamation: Ruining someone’s reputation through misinformation
Misinformation: Manipulating elections or creating damaging lies
So, it’s not the deepfake itself, but what it is used for, and what it does.
Why Businesses Should Pay Attention
For companies, particularly those in fintech, cryptocurrency, and digital verification, deepfakes are not only a legal threat but a risk to their operations.
Cybercriminals are already using deepfake audio and video content to get past identity verification, impersonate CEOs, and trick employees. That means organisations need to enhance their identity verification technology and keep pace with the latest scams.
Government regulators are also getting tougher. They may be penalised, not only for the loss but for having poor controls, if they don’t prevent or detect deepfake fraud.
Which is why many companies are investing in biometric authentication, liveness detection, and other AI-powered fraud prevention technologies. It’s no longer about compliance, it’s about security in a world where appearances can be deceiving.
The Road Ahead
The future of deepfake legislation is certainly in flux. Governments are starting to understand the challenges and future legislation will likely emphasise transparency, accountability and prevention.
We could see more rules around tagging AI-generated content or liability for platform users. International collaboration will also play a bigger role, as deepfake crimes often have cross-border implications.
