Deepfakes and the Law: Can Regulation Keep Up?

Deepfakes and the Law: Can Regulation Keep Up? By Diksha Bhatkar

What are Deepfakes?
Deepfakes use AI (artificial intelligence) to mimic people’s faces and voices, creating fake actions and statements, making it appear that someone performed actions or said things they never did.

It works by collecting a large amount of real data, such as images, audio recordings, etc., of a person. The collected data is used to train an AI model. During this process, the AI learns facial expressions, lip movements, and voice patterns. The more data fed into the system, the more realistic the output becomes.

After training, the AI can replace a person’s face in videos, generate a synthetic voice, or modify existing media. This allows the creation of videos or audio clips in which the person appears to speak or act in ways that never occurred. The generated content is refined further to improve facial movements with speech and enhance visual or audio quality. The final output often appears highly convincing to viewers.

Why Deepfakes are Becoming a Legal Concern
The rise of deepfake technology has raised numerous legal challenges.

1. Intellectual Property Rights
   Deepfake development often depends on pre-existing visual and audio materials. Using such content without authorization may result in disputes over copyright ownership and permissible use. Additionally, the creation and distribution of deepfake content can interfere with the exclusive rights of authors and creators, particularly where such content reproduces or closely imitates protected work. These challenges highlight the difficulty of applying traditional intellectual property frameworks to rapidly evolving deepfake technologies.

Example – OpenAI / Midjourney IP Disputes
Hollywood studios like Disney and Universal sued AI company Midjourney over alleged copyright infringement for generating images incorporating their copyrighted characters without permission.

2. Misinformation and Democratic Integrity
   Deepfakes pose a serious threat to democratic integrity by enabling the creation and rapid dissemination of false yet highly realistic information. Fabricated videos or audio recordings of political leaders, candidates, or public officials can mislead voters, manipulate public opinion, and interfere with the electoral process. The persuasive realism of deepfakes undermines the ability of citizens to distinguish between authentic and manipulated content, weakening public trust in media, political institutions, and democratic discourse.

Example – Deepfake Video of President Volodymyr Zelensky (2022)
A deepfake video falsely depicted Ukrainian President Zelensky urging Ukrainian forces to surrender during the Russian-Ukrainian conflict. Although the video was quickly identified as manipulated, its circulation highlighted the potential of deepfakes to spread misinformation, weaken public trust in political leadership, and destabilize democratic institutions during a crisis.

3. Privacy and Consent Violations
   Deepfake technology raises serious privacy and consent concerns, as it often involves the use of an individual’s facial features, voice, or biometric data without permission. Creating deepfakes violates principles of informed consent, purpose limitation, and lawful use. Non-consensual deepfake content undermines an individual’s autonomy and right to control their personal identity, exposing significant gaps in existing privacy and data protection laws.

Example – Scarlett Johansson Case (2024)
In 2024, Scarlett Johansson raised legal and ethical concerns after an AI system released a voice feature closely resembling her voice without her consent. Johansson publicly objected to the unauthorized imitation, asserting it violated her privacy and personality rights. Following legal pressure and public scrutiny, the company withdrew the feature.

4. Identity Theft and Financial Fraud
   Deepfake technology has significantly increased the risk of identity theft and financial fraud by enabling the realistic impersonation of individuals through AI-generated audio and video. Fraudsters can replicate the voice or appearance of senior executives, employees, or trusted individuals to deceive victims into transferring funds or disclosing sensitive information. These practices challenge existing legal frameworks on fraud and cybercrime.

Example – Deepfake Video Call Fraud involving Arup (Hong Kong, 2023)
In 2023, a finance employee at multinational engineering firm Arup was deceived into transferring approximately USD 25 million during a video conference call that appeared to include senior executives. The call was later revealed to be a deepfake, replicating executives’ faces and voices. Authorities in Hong Kong confirmed this was a sophisticated case of identity impersonation enabled by deepfake technology.

5. Defamation and Reputational Harm
   Deepfake technology poses a significant threat to reputation by enabling the creation of false audio-visual content that depicts individuals engaging in conduct or making statements they never did. Such content spreads rapidly, causing serious and often irreversible reputational damage. The legal framework governing defamation struggles to address deepfakes due to difficulties in identifying creators, proving intent, and establishing falsity.

Example – Rana Ayyub Deepfake Case (India, 2023)
In 2023, Indian journalist Rana Ayyub became the target of explicit deepfake videos circulated online. The videos falsely portrayed her in pornographic content, leading to severe reputational damage, emotional distress, and threats to her safety. Despite reporting the content to social media platforms such as X, delays in content removal highlighted limitations in platform accountability and existing legal mechanisms.

How Deepfakes Challenge the Law
Deepfake technology presents complex challenges by exposing gaps in traditional laws not designed for synthetic and AI-generated content.

1. Difficulties in Attribution and Liability
   It is often difficult to attribute responsibility and determine liability for deepfakes. Content can be created anonymously, using widely accessible AI tools, and disseminated rapidly. Identifying the original creator becomes technically and legally complex.

2. Inadequacy of Existing Legal Frameworks
   Existing laws were designed for traditional media and are ill-suited for deepfake technology. Most focus on outcomes like defamation, fraud, or privacy violations rather than the creation of synthetic media. The absence of a clear legal definition of deepfakes and the rapid pace of AI advancement make enforcement difficult.

3. Jurisdiction and Enforcement Issues
   Deepfakes cross borders: a single deepfake may be produced in one country, hosted in another, and cause harm elsewhere. Differences in national legal standards and limited cross-border cooperation make effective enforcement challenging.

4. Conflict with Freedom of Expression
   Regulating deepfakes risks limiting legitimate uses, such as satire, parody, artistic expression, and political commentary. Laws that are vague or overly restrictive may chill free speech, while weak regulation may allow harmful misinformation to spread unchecked.

5. Speed of Harm vs. Speed of Legal Remedies
   Deepfakes spread rapidly, causing immediate harm before victims can seek relief. Legal remedies are slow in comparison, reducing effectiveness and leaving victims inadequately protected.

Existing Legal Frameworks
Most legal systems lack specific legislation for deepfakes, relying instead on laws for defamation, privacy, data protection, IP rights, and cybercrime. Intermediary liability regimes often protect online platforms, reducing enforcement effectiveness. Some jurisdictions are introducing AI-specific guidelines, but the overall response remains fragmented and reactive.

Can Regulation Keep Up?
Regulation is evolving but lags behind rapid technological development. Existing laws are reactive, addressing harm after it occurs. The global and borderless nature of deepfakes, combined with enforcement and attribution challenges, limits regulatory effectiveness. Recent efforts toward AI-specific laws, transparency requirements, and platform accountability show growing awareness, but regulation must become more adaptive, technology-focused, and internationally coordinated.

Possible Legal and Regulatory Solutions

• Introduce clear legal definitions and AI-specific legislation addressing the creation, distribution, and misuse of deepfake content.

• Implement mandatory transparency measures, such as labeling or watermarking AI-generated content.

• Strengthen platform accountability with faster takedown obligations and limit safe-harbour protections.

• Improve international cooperation and harmonize legal standards.

• Invest in detection technologies and public awareness initiatives.

Existing Regulations That Could Serve as Global Models

1. European Union – AI Act and Digital Laws
   The EU proposed the AI Act, requiring transparency for AI-generated or manipulated content, and the Digital Services Act (DSA) strengthens platform responsibility for the rapid takedown of harmful content.

2. China – Deep Synthesis Regulations (2023)
   China mandates clear labeling of AI-generated content, user consent for personal image/voice use, and platform accountability.

3. United States – State-Level Deepfake Laws
   While lacking a comprehensive federal law, states have enacted targeted legislation, e.g., California restricts political deepfakes during elections, Virginia and Texas criminalize malicious deepfake pornography and election interference.

Why These Rules Need Global Adoption
Deepfakes operate across borders, but laws remain national. Shared principles such as transparency, consent, and platform accountability could significantly reduce harm while preserving legitimate AI innovation.

Conclusion
Deepfake technology presents a complex challenge worldwide. Current laws address related harms but remain reactive and insufficient for AI-generated media. Targeted regulations focusing on transparency, consent, and platform accountability are emerging, but the lack of uniform global standards limits effectiveness. Legal systems must adopt adaptive, technology-specific, and internationally coordinated approaches that balance innovation, freedom of expression, and harm prevention. Without such reforms, regulations are likely to remain one step behind the evolving threat of deepfakes.