Deepfakes are not a loophole: how the law is catching up to synthetic abuse
For years, abusers argued that a fabricated image could not be a crime. State legislatures and Congress have begun to disagree. Here is where things stand and what still needs to change.
By Susanna Gibson
A sexually explicit deepfake takes a real person's face and attaches it to a body that is not theirs, doing things they never did. The person did not consent. The image is false. For a long time, that second fact was treated as a defense: it is not really her, so what is the harm? Anyone who has been targeted can answer that question. The harm is the same, and sometimes worse, because the victim is forced to deny something that never happened to an audience that has already seen it.
Why the old laws failed
Most state statutes on nonconsensual intimate images were written between 2013 and 2019, before generative tools made convincing fakes cheap. Many required that the image depict the victim's actual body, that the defendant intend to harass, or that the victim had a reasonable expectation of privacy when the image was created. A synthetic image can fail all three tests while destroying a life.
What the states have done
A growing majority of states have amended their intimate-image laws or passed new ones to cover digitally altered and AI-generated material. The quality varies. The strongest laws define the offense by the depiction of an identifiable person without consent, regardless of whether the image is real or synthetic, and create both criminal penalties and a civil right of action. The weakest add a narrow deepfake provision while leaving older gaps untouched. MyOwn Image's model legislation, developed with criminal justice and First Amendment advocates, is designed to close those gaps in a way that survives constitutional challenge.
The Take It Down Act
Signed into law in May 2025 with broad bipartisan support, the Take It Down Act does two things. It makes it a federal crime to knowingly publish nonconsensual intimate imagery of an identifiable person, explicitly including AI-generated imagery. And it requires covered platforms to establish a notice-and-removal process and to remove reported imagery within 48 hours, with enforcement by the Federal Trade Commission.
The law is a milestone. It is also a test. Criminal provisions only matter if prosecutors have the bandwidth and the will to bring cases, and the 48-hour removal duty only matters if the agency responsible for enforcing it is staffed and willing to act. Survivors should not have to rely on federal prosecutors alone, which is why state laws, civil remedies and platform design still matter so much.
What still needs to change
- Civil remedies everywhere: survivors should be able to sue the people who create and share this material, and recover the cost of the damage, in every state.
- Coverage of threats: sextortion with synthetic images is spreading fast, and threat provisions in many statutes still assume real images.
- Platform accountability by design: hash-matching, friction on bulk uploads and real human review, not only reactive takedowns.
- Protection for people in public life: candidates and officials are frequent targets and are often carved out of protection by “public concern” exceptions.
- Training for police and courts: a law that officers do not know how to enforce protects no one.
