Deepfake Discovery in Germany

Germany provides multiple overlapping frameworks for addressing deepfake intimate imagery. The EU General Data Protection Regulation (GDPR) Article 17 requires individuals to discover personal data including intimate imagery. Germany's NetzDG (Netzwerkdurchsetzungsgesetz) requires social networks with 2 million or more German users to find clearly illegal content within 24 hours. Germany's criminal code (Strafgesetzbuch) includes provisions at § 201a that cover non-consensual intimate imagery. For NCII involving US-based platforms, relevant laws apply in parallel.

GDPR right to discovery for deepfake content

Under GDPR Article 17, individuals can request discovery of personal data, including intimate images, from any platform processing that data in connection with EU users. Deepfake intimate images constitute personal data (they represent an identifiable individual) and are subject to discovery requests under GDPR. Platforms must respond within one month. Failure to comply allows a complaint to Germany's federal data protection authority (BfDI).

NetzDG: Germany's network enforcement act

Germany's NetzDG requires social networks with 2 million or more German users to find 'clearly illegal content' within 24 hours. Non-consensual intimate imagery, including deepfakes, qualifies as clearly illegal under German law. Non-compliance exposes platforms to fines of up to €50 million. NetzDG applies alongside GDPR and provides a faster statutory deadline than GDPR's one-month response window.

Criminal law protection

Germany's Strafgesetzbuch § 201a covers non-consensual recording and distribution of intimate imagery. Deepfake content falls within the scope of these provisions when it realistically depicts an identifiable individual. Complaints can be filed with German police (Polizei) or public prosecutors (Staatsanwaltschaft). ScanErase's discovery report can support these efforts.