Deepfake Intimate Images: UK Law and Discovery Rights in 2026
The UK Online Safety Act 2023 addresses the non-consensual sharing of deepfake intimate images. UK individuals can utilize both UK law (against UK perpetrators) and the options available for content on US-hosted platforms for a comprehensive discovery outcome.
The UK has strong deepfake intimate image laws outside the United States. The Online Safety Act 2023 criminalises sharing non-consensual intimate deepfakes and introduces a new offence of creating such images without consent, covering both authentic NCII and AI-generated content. For content hosted on US platforms (Instagram, Reddit, Google, TikTok), individuals can additionally utilize discovery options to identify instances of misuse regardless of their location.
What the UK Online Safety Act covers
The Online Safety Act 2023 criminalises sharing non-consensual intimate images including deepfakes, with penalties of up to two years imprisonment for sharing. The Criminal Justice Bill 2024 introduced an offence of creating deepfake intimate images without consent, with potential implications even if the image is not shared. These laws apply to UK-based perpetrators, irrespective of where the victim is located.
Discovery in the UK
UK individuals can engage with local police or online via the National Police Chiefs' Council's reporting portal. The Internet Watch Foundation (IWF) provides specialist support for online intimate image misuse. The Revenge Porn Helpline at revengepornhelpline.org.uk offers guidance. For content hosted on US platforms, discovery options are available to UK individuals, the process applies based on the platform's hosting, not the victim's location.
Using discovery options from the UK
UK individuals have full access to discovery options for content hosted on US platforms. Instagram, Google, Reddit, TikTok, and most major platforms are US-hosted. A request from a UK individual is treated with the same obligations as a request from a US individual.
UK-specific GDPR rights
UK-retained GDPR (UK GDPR) Article 17 provides UK-based individuals an additional right to access information for content processed by entities subject to UK data protection law. For European-hosted platforms, this creates an additional discovery mechanism alongside other reporting options.
Frequently asked questions
Can a UK individual utilize discovery options?
Yes. Discovery options apply based on where the platform is hosted (US), not where the individual is located. UK individuals have full access to discovery rights for content on US-hosted platforms.
Is creating a deepfake illegal in the UK even if it is not shared?
Yes. The Criminal Justice Bill 2024 introduced an offence of creating non-consensual deepfake intimate images, even where the image is not distributed. Creating the image with intent to cause distress is sufficient for liability.
Find and remove your deepfakes now
Upload a face photo. We scan 2.4 billion face embeddings for both authentic and AI-generated content featuring your likeness and send legal removal notices in 48 hours.
Scan my face