Are Deepfakes Illegal? Laws by Country in 2026

Are Deepfakes Illegal?

Creating a synthetic image, video or voice is generally legal. Film studios, advertisers, accessibility tools and satirists use the same techniques as fraudsters. What lawmakers have done instead is attach liability to specific harms. Across the jurisdictions covered here, five categories recur: sexual deepfakes made or shared without consent; fraud, impersonation and identity theft; election deception; unauthorised commercial use of a person's likeness or voice; and failing to label AI-generated content where a disclosure rule applies.

Two older bodies of law also catch many deepfakes without naming them. Fraud and false representation offences apply whether a criminal impersonates a chief financial officer in person or on a synthetic video call. Defamation, privacy and personality-rights claims let victims sue over fabricated content that damages them. A deepfake that is legal to make can still expose its maker to civil liability when published.

Deepfake Laws by Country: A 2026 Summary

The table lists the main national measures in force or adopted as of October 2026. It is a starting map, not legal advice; check the primary text and local counsel before relying on any entry.

Is It Illegal to Make a Deepfake in the US?

Making one is not a federal crime, but publishing certain kinds is. The TAKE IT DOWN Act, signed on 19 May 2025, makes it a federal offence to knowingly publish an intimate digital forgery of an identifiable adult without consent where harm is intended or caused, punishable by up to two years in prison, and up to three years where the victim is a minor. Covered platforms had one year, until 19 May 2026, to set up a process that removes reported content within 48 hours, enforced by the Federal Trade Commission.

Other federal rules reach deepfake fraud indirectly. The FCC confirmed in February 2024 that AI-cloned voices are artificial voices under the Telephone Consumer Protection Act, and the FTC's impersonation rule covers schemes that pose as businesses or government agencies. States fill most of the gaps: Ballotpedia reported on 30 July 2026 that 49 states had passed at least one deepfake law, 48 had laws on sexual deepfakes and 33 on political deepfakes, with 58 deepfake bills enacted in 2026 alone. The US deepfake laws guide on this site breaks these down by business process.

What Are the Deepfake Laws in the UK and EU?

In England and Wales, sharing or threatening to share an intimate image, including a deepfake, became an offence under section 66B of the Sexual Offences Act 2003, inserted by the Online Safety Act 2023. The Data (Use and Access) Act 2025 added offences of creating, or requesting the creation of, a purported intimate image without consent, which came into force on 6 February 2026; the government's January 2025 announcement said offenders face an unlimited fine. The Crime and Policing Act 2026 adds an offence of making or supplying nudification tools, with up to three years in prison, and a duty on platforms to remove reported non-consensual intimate images within 48 hours, enforced by Ofcom.

The EU works through two instruments. Article 50 of the AI Act, applicable from 2 August 2026, requires providers of generative systems to mark output in a machine-readable, detectable format and requires deployers who generate or manipulate deepfake image, audio or video to disclose it. Regulation (EU) 2026/1744, the Digital Omnibus on AI adopted on 8 July 2026, gives providers whose systems were already on the market a four-month transition for the marking duty. Separately, Directive (EU) 2024/1385 on violence against women requires member states to criminalise making manipulated sexual material of a person public without consent, with national laws due by 14 June 2027.

How Do China, India, South Korea and Australia Regulate Deepfakes?

China has the most prescriptive labelling regime. The Measures for Labeling AI-Generated Synthetic Content, issued by the Cyberspace Administration of China with three other ministries and in force since 1 September 2025, require visible labels and metadata labels on AI-generated text, audio, images, video and virtual scenes. Distribution platforms must add a notice when metadata shows AI generation, when a user declares it, or when the platform itself detects generation traces, and anyone who maliciously removes or forges labels is in breach. It is one of the few laws that names detection directly.

India's amendments to the IT Rules on synthetically generated information took effect on 20 February 2026. They require platforms to label permitted synthetic audio and video, embed provenance where feasible, cut takedown times to three hours after a court or government order and two hours for complaints about intimate or impersonation content, and, for the largest platforms, verify users' AI-content declarations with technical tools.

South Korea's National Assembly voted on 26 September 2024 to punish buying, saving or watching sexually explicit deepfakes with up to three years in prison or a fine of up to 30 million won, and raised the maximum for making or distributing them to seven years regardless of intent. Australia's Criminal Code Amendment (Deepfake Sexual Material) Act 2024, assented on 2 September 2024, makes sharing such material without consent punishable by up to six years, or seven where the sharer also created it.

Is AI Voice Cloning Legal?

Cloning a voice with the speaker's consent is legal almost everywhere, and voice-over, dubbing and accessibility products depend on it. Using a cloned voice without consent is where liability starts. In the US, AI-voiced robocalls without prior consent breach the TCPA following the FCC's 2024 ruling, and Tennessee's ELVIS Act protects a person's voice as part of their likeness. Using a cloned voice to impersonate a relative or an executive to obtain money is fraud under general criminal law in every jurisdiction listed above. Denmark's proposed copyright amendment would go further, giving people rights over realistic imitations of their voice even where no fraud occurs.

What Deepfake Laws Mean for Businesses

Most of these laws do not require a business to detect deepfakes. They do assume someone can tell when content is synthetic: a platform deciding whether China's rules require a suspected-AI notice, a trust and safety team triaging a TAKE IT DOWN request, a bank documenting a fraud loss, or a court weighing evidence. Detection supplies that evidence, while legal owners decide whether a duty applies.

Neural Defend's NeuroDetect is built for evidence work. An analyst uploads an authorised image, audio, video or document into a case; the analysis records model and version context, shows heatmaps and attention views down to regions, frames and audio segments, and exports a forensic report covering observations, uncertainty, provenance and analyst notes. For onboarding and account recovery, where deepfake fraud is a crime in every jurisdiction above, NeuroVerify checks a face image, video or audio in one API call with six signals and returns a unified risk score with signal-level evidence in under 200 ms p95 on eligible image requests. Neural Defend is certified to ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II, and deploys in the cloud, a private VPC, on premises or air-gapped where data residency rules require it.