Deepfake and AI Impersonation: What’s Actually Law Right Now

In the US, the federal TAKE IT DOWN Act was signed into law in May 2025. It criminalizes knowingly publishing non-consensual intimate imagery, including AI-generated or digitally altered ("deepfake") intimate depictions, and requires "covered platforms" (social media, image/video-sharing, messaging, gaming services) to provide a notice-and-removal process that takes down a validly reported image — and known identical copies — within 48 hours of a request. That platform obligation became enforceable by the FTC in May 2026, so as of now it is both enacted and actively being enforced. This is currently the strongest, clearest federal tool for a deepfake intimate-image situation specifically. verify current FTC enforcement activity and any amendments before relying on the exact 48-hour figure

Several US states have also enacted their own right-of-publicity or digital-replica laws that predate and go beyond the federal picture. Tennessee’s ELVIS Act (effective July 2024) was the first state law to add "voice" explicitly to right-of-publicity protection, directly targeting unauthorized AI voice cloning. California enacted AB 1836 (bars unauthorized commercial digital replicas of deceased performers) and AB 2602 (voids certain contract clauses permitting digital-replica use of living performers unless specific conditions are met), both effective January 2025. Separately, roughly 30 US states now have election-specific deepfake disclosure laws — these are narrower, apply only around elections, and do not create a general impersonation remedy; some have even been struck down as unconstitutional (for example, Hawaii’s was permanently enjoined in early 2026).

In the UK, sharing non-consensual intimate images — including deepfakes — has been a criminal offense since the Online Safety Act 2023 inserted new sections into the Sexual Offences Act 2003, in force since January 2024. A separate offense specifically for creating (not just sharing) a sexual deepfake was more recently added via the Data (Use and Access) Act, reported to commence on 6 February 2026 — confirm this has actually taken effect as scheduled before relying on it, since UK commencement dates for this kind of provision can slip. verify current commencement status

The federal NO FAKES Act, which would create a general federal civil right against unauthorized digital voice/visual replicas with statutory damages, remains a bill, not a law, as of this writing — a version cleared the Senate Judiciary Committee in June 2026, but no confirmed full Senate or House passage has occurred. Treat any claim that the NO FAKES Act already gives you a federal right as premature, and check its current status at congress.gov before relying on it.

The EU AI Act’s Article 50 transparency obligation — requiring deployers to disclose that content is artificially generated or manipulated, covering deepfakes — is enacted law (the AI Act entered into force in August 2024), but its application is phased: the deepfake-labeling duty is generally reported to begin applying from 2 August 2026, with some carve-outs for systems already on the market pushed to December 2026. This means the obligation exists on paper but has only just begun (or is about to begin) actually applying as you read this — confirm the current date against the Act’s own application schedule. verify precise application dates, as Commission guidance was still being finalized as of mid-2026

What is already usable today, regardless of AI-specific legislation, are older legal theories: defamation (if the deepfake makes a false, damaging factual claim about you), false light (recognized in many, not all, US states), right of publicity for commercial use of your likeness, and intentional infliction of emotional distress. The EU’s Digital Services Act notice-and-action mechanism (Article 16) is also already in force and lets you flag illegal content — including unlawful deepfakes — to a hosting platform, creating a legal basis for removal or platform liability once the platform has "actual knowledge."

A platform takedown, especially under the TAKE IT DOWN Act’s 48-hour rule for intimate imagery, is currently the fastest and most reliable relief available — faster than any state or federal civil lawsuit.

Criminal referral can lead to prosecution for non-consensual intimate deepfakes or large-scale fraud, but outcomes depend on whether the perpetrator can be identified and located — many deepfake creators use anonymizing tools or operate from outside your country.

A civil lawsuit can produce money damages under existing defamation/false-light/right-of-publicity theories or a state digital-replica statute, but expect it to be slow, and be realistic that judgment against an anonymous or overseas defendant may be hard to actually collect.