Deepfakes and the Criminal Law

Introduction: what this allegation means for you

Sophisticated images and videos depicting real people in scenes that never happened are no longer a specialist technology used only by film studios. Images, videos and audio recordings can now be created quickly, cheaply with very little – or even no – technical skill. That creates exciting possibilities in entertainment, education and accessibility, but it also creates serious criminal risk.

What do we mean by “deepfakes”? For our purposes, a deepfake is an image, video or audio recording that shows a real person in a scene that never happened or speaking words they never said. We can extend that to include real scenes where the context or other important details have been changed to give it the appearance of a real event. Such images have existed since the dawn of photography, but modern technology turns what was once a highly skilled endeavour into the work of a few seconds with the aid of AI technology.

In criminal defence work, deepfake allegations usually arise in one of several ways. Some involve intimate or sexual images said to have been created, requested, shared or threatened. Others involve AI-generated child sexual abuse material, fraud, blackmail, harassment, stalking, false online communications or fabricated evidence. The same technology can therefore lead to very different allegations and very different sentences.

The criminal law in England and Wales does not treat every deepfake as a crime. A parody video, film effect or obvious joke will not usually be criminal simply because AI or digital manipulation has been used. The law becomes engaged when the content, purpose, lack of consent, age of the person depicted, or use made of the material crosses a criminal threshold.

For a person under investigation, the consequences can be immediate. Police will seize phones, computers and cloud accounts. Bail conditions are likely to restrict contact with children and social media use. In intimate image or child image cases, the reputational damage may begin long before charge. Early advice is important because the issues are often technical and a careless answer in interview can be difficult to repair later.

What are deepfakes?

The word 'deepfake' is commonly used to describe media that has been created or altered so that it appears real. It may be a still image, video, audio recording or a combination of these. A familiar example is a face placed onto another person's body. Another is a voice recording that sounds like a real person giving instructions, making admissions or saying something damaging.

Modern deepfakes may be created through specialist software, generative AI tools, apps, websites or subscription services. A police investigation may therefore look not only at the final file, but also at prompts, search history, downloads, app use, subscriptions, payment records, group chats and cloud storage.

Deepfakes are not always sexual. They may be used to impersonate a director of a company, manipulate someone into transferring money, damage a reputation, bully a child, create false evidence or spread disinformation. However, much of the recent law reform in England and Wales has focused on intimate images, image-based sexual abuse and child sexual abuse material.

What does the law say?

The best way to approach the law is to ask four questions: what does the deepfake show, who does it appear to show, what did the accused person do with it, and what was their state of mind? Those questions determine whether the case is about intimate images, child images, fraud, blackmail, harassment, communications offences, evidence offences or something else.

Adult intimate deepfakes

The Sexual Offences Act 2003 now contains a group of offences dealing with non-consensual intimate images. The law covers photographs and films, but it can also cover images made or altered by computer graphics, AI or other means where they appear to be photographs or films. That is critical in deepfake cases because the allegation may be that the image is fabricated rather than genuine.

An image may be intimate if it shows, or appears to show, a person engaged in sexual activity, exposing genitals, buttocks or breasts, doing something normally done in private such as toileting or intimate personal care, or presented in a way that creates the appearance of such exposure. Borderline cases need careful analysis because the statutory wording matters.

Sharing and threatening to share

Section 66B of the Sexual Offences Act 2003 deals with sharing or threatening to share an intimate photograph or film. Sharing can include sending, showing, posting, uploading or placing an image in a group chat. The offences cover basic sharing without consent, sharing with intent to cause alarm, distress or humiliation, sharing for sexual gratification, and threatening to share an intimate image.

A threat offence can be committed even if the image does not exist. The focus is whether the defendant threatened to share an intimate image and intended, or was reckless as to whether, the complainant would fear that the threat would be carried out.

Creating or requesting adult intimate deepfakes

Since 6 February 2026, the law has also addressed creation and requests. Sections 66E and 66F make it an offence, in broad terms, to intentionally create or request the creation of a purported intimate image of another adult without that person's consent and without a reasonable belief in consent.

This is a significant change. Earlier law tended to focus on disclosure or threats to disclose. The current law can apply before an image has been shared. A person who creates a non-consensual intimate deepfake and keeps it privately may therefore still commit an offence, depending on the facts. A person may also commit the requesting offence even if the image is never actually created.

Nudification tools and image generators

From June 2026, further offences target the making, adapting, supplying or offering to supply tools designed or adapted to generate purported intimate images. These provisions are aimed at so-called nudification apps, services and similar systems. They do not criminalise every image-editing tool, but they can apply to programs, services or information supplied for the prohibited purpose.

Deepfakes involving children

The law is especially strict where the image appears to involve a child. A child is a person under 18. It is not a defence simply to say that an image was generated by AI, that no real child was abused to create it, or that the image is a pseudo-image rather than a photograph of an actual event.

The Protection of Children Act 1978 covers making, taking, distributing, showing, possessing with a view to distribution and advertising indecent photographs or pseudo-photographs of children. A pseudo-photograph is an image that appears to be a photograph, whether made by computer graphics or otherwise. High-quality AI images can therefore fall within the indecent images framework if they appear photographic and depict a child indecently.

Possession of an indecent photograph or pseudo-photograph of a child is also an offence under section 160 of the Criminal Justice Act 1988. There are separate offences relating to prohibited images of children, which can apply to certain non-photographic pornographic images, including computer-generated images, where the statutory criteria are met.

Possession of deepfakes

Possession is often misunderstood. In adult cases, mere possession of a deepfake image is not always a standalone criminal offence. It may, however, be powerful evidence of creation, requesting, intended sharing, threats, blackmail, harassment or coercive behaviour. Possession may also be criminal where the image falls within another category, such as extreme pornography.

Possession of indecent images or pseudo-images of children is different. That is a separate and serious criminal offence. Anyone under investigation should not delete images, messages or accounts in an attempt to tidy up the position. Deleting material can create further difficulties, including allegations about destroying evidence or frustrating an investigation.

Fraud, blackmail, harassment and false communications

Deepfakes can also be used in non-sexual offending. A voice clone used to persuade an employee to transfer money may amount to fraud by false representation. A video falsely showing someone in compromising circumstances may be used for blackmail if it is accompanied by an unwarranted demand with menaces. Repeated sending, posting or threatening may amount to harassment or stalking.

The Online Safety Act 2023 created communications offences that may also be relevant. A deepfake communication may fall within the false communications offence if it conveys information the sender knows to be false, is sent without reasonable excuse, and is intended to cause non-trivial psychological or physical harm. A threatening communication may be charged where the message conveys a serious threat and the defendant intends or is reckless as to whether the recipient will fear it will be carried out.

Deepfakes used as evidence can be even more serious. Fabricating audio, video or image evidence for use in police, family or criminal proceedings may lead to allegations such as perverting the course of justice, perjury or making a false statement.

What must the prosecution prove?

The exact elements depend on the offence, but most deepfake prosecutions require proof of several common points.

First, the prosecution must prove that the accused has some form of access to the image. It is not enough to show that a file existed. The prosecution must connect the relevant conduct to the defendant through devices, account logins, IP addresses, subscriber records, cloud data, payment records, prompts, usernames, admissions or other evidence. Shared-device cases often turn on this issue.

Second, the prosecution must prove what the material is. In an intimate image case, the image must meet the statutory definition. In a child image case, the issues may include indecency, whether the image appears photographic, whether it depicts a child, and how it should be categorised. In fraud or blackmail, the issue may be what false impression was created and how it was used.

Third, the prosecution must prove the conduct: creation, requesting, sharing, threatening, possession, distribution, supplying a tool or using a false representation. A person who merely receives an unsolicited adult image is in a different position from a person who creates, requests, forwards or threatens with it.

Fourth, consent and reasonable belief may be central in adult intimate image cases. Consent to one thing is not consent to everything. Consent to a real private photograph does not mean consent to create a sexualised deepfake, or distribute it..

Finally, intention or recklessness may matter. Some offences require intent to cause distress or humiliation, sexual gratification, dishonesty, intention to make a gain or cause loss, or recklessness as to whether a threat will be feared. Messages, relationship history and the defendant's account can all be important.

Defence strategies

Deepfake cases need early digital analysis before a final position is taken. The first issue may be identity: who used the device, account, AI service or payment method? Shared devices, old phones, workplace systems, automatic cloud synchronisation and compromised accounts can all create doubt or require further investigation.

The second issue may be whether the material meets the statutory definition. Not every altered image is intimate. Not every embarrassing image is sexual. Not every computer-generated image is criminal. The defence may need expert evidence or careful legal submissions on the correct threshold.

Consent and reasonable belief may also be important. Messages, prior discussions, commercial agreements, model releases or platform terms may affect whether there was consent or a reasonable belief in consent. These arguments must be handled carefully because consent to a different image or a past relationship will not automatically provide a defence.

A reasonable excuse defence may arise in limited circumstances, such as reporting, safeguarding, moderation, journalism, legal work, law enforcement or security. The facts matter. Forwarding a harmful image to 'show what happened' may still be risky if it was unnecessary or disproportionate.

Evidence that may help your case

Useful evidence may include devices, app data, AI prompt history, downloads, browser history, cloud synchronisation records, metadata, platform logs, subscription records, payments, group chats, deleted file recovery and communications between the parties. Context can be as important as the final image.

In child image cases, expert and forensic analysis will be needed. This evidence is likely to focus on when the image was created, first appeared on a device and when it was last accessed. The expert should comment on whether there is evidence that any part of that occurred automatically. For example, if the prosecution say the file was last accessed on the 21 April 2026 but the defendant says the device was second hand and he bought it in March 2026 but he never saw the image, then could that last access date be the result of some automatic operation by a virus scan or the devices operating system etc. In prohibited image cases, it may also be necessary to obtain expert evidence on whether something is a genuine work of art etc.

In fraud or impersonation cases, evidence may include call recordings, voice analysis, banking records, instructions to staff, account takeover evidence and messages between alleged conspirators. In blackmail cases, the demand, the alleged menace and the surrounding relationship will be central.

Penalties: what sentence can a person expect?

The sentence depends on the offence charged and the facts.

Sentences range from up to six months imprisonment at the lower end of the scale right up to life imprisonment where a deepfake image has been used in a bid to pervert the course of justice.