Is Creating a Sexually Explicit Deepfake Illegal in the UK? Non-Consensual Deepfake Legislation Explained

Is creating a sexually explicit deepfake illegal in the UK?

Yes, in England and Wales, since 6 February 2026. Section 138 of the Data (Use and Access) Act 2025 inserted new offences into the Sexual Offences Act 2003: creating a purported intimate image of an adult, and requesting its creation, without the person's consent or a reasonable belief in consent. The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026, made on 15 January 2026, brought section 138 into force on 6 February.

A purported intimate image is one that appears to show the person nude or engaged in a sexual act. It does not matter whether the picture was made with a generative model, a face-swap app or manual photo editing, and the maker does not have to share it. When the Ministry of Justice announced the measure on 22 January 2025, it said the offence would carry an unlimited fine.

Images of children were already covered. Indecent pseudo-photographs of a child are illegal to make, possess or distribute under long-standing child-protection law, regardless of how they were produced.

Is it illegal to share a deepfake intimate image in the UK?

Yes. The Online Safety Act 2023 rewrote the intimate image offences in the Sexual Offences Act 2003. Section 66B makes it an offence to share, or threaten to share, a photograph or film that shows or appears to show another person in an intimate state without consent. The government confirmed in January 2025 that this covers deepfakes.

The base sharing offence is summary-only, which means magistrates hear it and the maximum is six months in custody. More serious versions, where the person intended to cause alarm, distress or humiliation, or acted for sexual gratification, can be tried in the Crown Court. In September 2024 the sharing offences became priority offences under the Online Safety Act, so regulated platforms must proactively find and remove such content.

What does the Crime and Policing Act 2026 add?

The 2026 Act targets the supply side and the speed of removal. Its headline measure is an offence of making, supplying or offering to supply a tool for use as an intimate image generator, a category the government says covers apps, websites, Telegram bots and AI models. The government factsheet cites My Image My Choice research finding that the two largest nudification services received a combined 13 million visits in January 2024.

The table summarises the measures most relevant to deepfakes. Commencement dates for individual clauses are set by regulations, so check that each provision is in force before relying on it.

What must platforms and employers do about non-consensual deepfakes?

Platforms regulated under the Online Safety Act carry the heaviest duties. They need a reporting route that works for victims, an expedited complaints process, a removal clock that can meet 48 hours, and a way to stop re-uploads. The government factsheet notes that the Revenge Porn Helpline supported 22,275 cases in 2024, a 20.9% rise on the previous year, and achieved a 90.9% removal rate on reported content. Volume at that scale cannot be handled by manual review alone.

Employers, schools and universities are not platforms, but they meet these cases through misconduct complaints. A sensible internal procedure preserves the original file and the context in which it circulated, limits who can view it, refers suspected offences to the police, and supports the person depicted. It should not ask the victim to prove the image is fake before acting, because the law does not require that either.

Where does deepfake detection help under UK law, and where does it stop?

The UK offences are written around consent and appearance. A prosecutor does not need to show that an image was AI-generated, only that it appears to show the person in an intimate state and that consent was absent. Detection therefore rarely decides a case. What it does well is triage, corroboration and scale.

On a platform, a detector can flag likely synthetic sexual imagery at upload, help route reports to the right queue, and identify altered variants of a reported image that a simple hash would miss. In an investigation, a forensic analysis that shows manipulated facial regions supports the victim's account that the image is not a real photograph, which matters for harm and sentencing. Ofcom's 2024 discussion paper on deepfake defences reaches a similar view: detection, provenance and labelling each help, and none works alone.

Detection cannot establish who made an image, whether the person consented, or whether a defence applies. Results also degrade on heavily compressed screenshots and re-shared copies, so a low score is not proof of authenticity.

How Neural Defend supports investigators and platforms

For investigations, NeuroDetect lets an analyst upload an authorised image, video or audio file into a case and keep the model and version context of every analysis. Explainability heatmaps point to the regions behind a finding, an LLM-assisted summary explains the result in plain language with links to the evidence, and the analyst makes the final call. The exported forensic report records observations, uncertainty, provenance and analyst notes, which is the documentation police referrals and civil claims need.

For platforms, NeuroVerify screens images in a single API call across six signals, including Visual Safety Screening, Face Manipulation Detection and AI Content Compliance, at under 200 ms p95 on eligible image requests under defined test conditions. On the public VendorBench-100 benchmark of 36 systems, Neural Defend ranked first for deepfake image detection with an MCC of 0.876 against 0.646 for the next vendor. Neural Defend can be deployed in a private cloud, on-premises or air-gapped where intimate content must not leave a controlled environment.