The EU offers a layered framework for victims of deepfake intimate images. At the EU level, GDPR Article 17 provides a right to access personal data, and the Digital Services Act imposes content moderation obligations on large platforms. At the national level, several EU member states have specific NCII and deepfake laws. For content on US platforms, where most major social media operate, users can discover their face's online presence using various mechanisms.

GDPR Article 17: the right to access

GDPR Article 17 gives EU-based individuals the right to request access to their personal data, including intimate images, from entities subject to EU data protection law. For platforms with EU establishments (Meta, Google, Microsoft, TikTok all have EU offices), these access requests must be addressed. Complaints for non-compliance go to the relevant national Data Protection Authority.

The Digital Services Act (DSA)

The DSA, applicable since 2023, imposes specific obligations on very large online platforms (VLOPs) to address illegal content including non-consensual intimate imagery. VLOPs must provide accessible reporting mechanisms and respond to trusted flaggers' notices rapidly. This creates an additional avenue for EU victims alongside GDPR and national law.

National laws across EU member states

Several EU member states have specific criminal laws covering NCII and deepfakes: Germany (§ 201a StGB), France (Article 226-2-1 CP), Netherlands (Article 139h Sr), Spain, Sweden, and others. Criminal sanctions vary but all include provisions for the distribution of non-consensual intimate imagery including AI-generated content.

Using US platforms from the EU

EU users can discover their rights regarding content hosted on US platforms. Major platforms, Instagram, Google, Reddit, TikTok, X/Twitter, are US-hosted. Awareness of your face’s online presence creates an obligation for platforms regardless of the user's nationality or location.

Frequently asked questions

Which is faster for EU users, GDPR or options for US platforms?

Accessing options for US-hosted platforms is generally faster: awareness obligations may apply, while GDPR responses can take up to 30 days. ScanErase finds results for both types of requests simultaneously.

Can EU users report to a Data Protection Authority if a platform ignores access requests?

Yes. Filing a GDPR Article 17 access request followed by a DPA complaint where the platform fails to respond creates a mechanism with penalties for major platforms.

Related deepfake resources