Deepfake Technology and the Law: Is Bangladesh Ready?

1. Introduction

The fourth industrial revolution has fundamentally reconfigured the architecture of socio-legal interactions in Bangladesh. As the state aggressively transitions toward its strategic vision of a tech-driven economy, the rapid democratization of generative artificial intelligence (AI) has introduced an unprecedented mutation in cyber-jurisprudence: hyper-realistic synthetic media, colloquially termed “deepfakes.” Deepfakes utilize deep learning architectures, primarily Generative Adversarial Networks (GANs), to seamlessly superimpose human faces, manipulate vocal vectors, and fabricate synthetic audio-visual sequences that are virtually indistinguishable from authentic recordings.

While synthetic media drives innovation in digital marketing and education, its deployment in the domestic sphere has been overwhelmingly malicious. In Bangladesh, deepfakes have evolved into a formidable instrument for Technology-Facilitated Gender-Based Violence (TFGBV), non-consensual intimate image (NCII) generation, targeted political disinformation campaigns designed to disrupt democratic stability, and sophisticated financial fraud.

This technological leap exposes a profound legislative asymmetry: technology evolves exponentially, whereas the law adapts incrementally. This article examines whether Bangladesh’s domestic legal framework is structurally prepared to mitigate the existential harms of deepfake technology. Through a critical evaluation of the newly enacted Cyber Security Act 2026, the draft National AI Policy 2026–2030, and traditional penal provisions, this study maps the existing statutory loopholes and proposes an actionable regulatory roadmap for deepfake governance.

2. Conceptualizing Deepfakes: The Anatomy of Digital Harm

To regulate deepfakes effectively, the law must first comprehend their socio-technical taxonomy. Unlike traditional digital alterations (such as “shallow fakes” or basic image editing), deepfakes manipulate reality at an algorithmic level by training a model on vast datasets of a target’s physical and vocal attributes. In Bangladesh, these harms manifest across three primary domains.

2.1. Techno-Gendered Exploitation

The most pervasive and devastating application of deepfakes in Bangladesh is the non-consensual creation of synthetic pornographic material targeting women. Victims are frequently subjected to digital extortion, character assassination, and systemic social ostracization. Because societal norms heavily penalize women regarding perceived sexual purity, the weaponization of an individual’s likeness via AI creates profound psychological and socio-economic trauma, rendering women prime targets in a vulnerable digital ecosystem.¹

2.2. Political Disinformation and Epistemic Threat

The political landscape of Bangladesh has increasingly witnessed the deployment of manipulated audio clips and altered videos of political leaders to manipulate public opinion or induce civic unrest. Deepfakes pose an “epistemic threat”: they not only convince people that a lie is true, but they also enable bad actors to claim that authentic, incriminating evidence is merely an AI-generated fake (the “liar’s dividend”).

2.3. The Evidentiary Crisis in Judiciaries

Under section 45A of the Evidence Act 1872, digital records are admissible in Bangladeshi courts. However, the infiltration of flawless deepfakes systematically undermines the reliability of audio-visual evidence, threatening to cripple the traditional standard of proof in both civil and criminal trials.

3. The Current Legislative Landscape of Bangladesh: A Critical Evaluation

Bangladesh does not possess a standalone, dedicated statute governing artificial intelligence or synthetic media. Instead, the state relies on an ad-hoc tapestry of cyber-laws and traditional penal codes to prosecute deepfake-related offenses — a gap that becomes especially clear when the harms mapped above are tested against the statutes actually available to prosecutors.

3.1. The Cyber Security Act 2026 (CSA)

The Cyber Security Act 2026 represents the most modern iteration of cyber-safety governance in Bangladesh, succeeding the legacy frameworks of the 2023 Act and the Digital Security Act 2018.² While the CSA 2026 attempts to balance public welfare with constitutional civil liberties, it remains structurally inadequate to handle generative AI.

The primary deficiency of the CSA 2026 lies in its definitions. Section 2 of the Act expands the concept of “data systems” to acknowledge software agents and automated systems. However, the statute completely fails to explicitly define “synthetic media,” “deepfakes,” or “algorithmic manipulation.” Consequently, prosecutors must awkwardly retrofit deepfake offenses into generic provisions:

Section 25 (Transmission of Offensive or False Information): This section criminalizes the intentional broadcasting of digital data known to be false or threatening. While applicable to political deepfakes, the provision focuses on content dissemination rather than the actual algorithmic synthesis of an identity, creating evidentiary hurdles in proving specific intent to cause harm.

Section 29 (Defamation via Digital Mediums): This provides financial and custodial penalties for publishing defamatory material online. However, traditional defamation laws require harm to a reputation caused by an expression of ideas; they are ill-equipped for situations where an individual’s entire physical and vocal identity has been stolen and synthesized.

Furthermore, Section 35 of the CSA 2026 retains controversial provisions allowing warrantless searches and seizures by enforcement agencies under the newly formed National Cyber Security Agency (NCSA). This creates a dual risk: it fails to protect citizens from AI threats while expanding state surveillance powers, potentially infringing upon the right to privacy guaranteed under Article 43(b) of the Constitution of Bangladesh.

3.2. The Pornography Control Act 2012

For deepfakes involving sexual exploitation, prosecutors frequently invoke the Pornography Control Act 2012. Section 8 of this Act penalizes the production, distribution, or storage of pornographic material using morphed or digitally manipulated images of individuals without their consent.

While the Act carries severe criminal penalties (up to seven years of imprisonment), its efficacy is restricted by its text. The statute relies heavily on the concept of “morphing” — a rudimentary 20th-century visual editing technique. Deepfakes do not merely “morph” an existing photograph; they generate completely novel, predictive synthetic frames. Defense counsel can exploit this technological distinction, arguing that completely synthetic data generated by an autonomous neural network does not fit the strict statutory definition of “morphed content.”

3.3. The Penal Code 1860

When modern cyber-laws fail, recourse is sought in the colonial-era Penal Code 1860. Sections 463 and 464 (Forgery and Making a False Document) are occasionally used to prosecute the creation of deepfakes. However, the statutory definition of a “document” under section 29 of the Penal Code historically contemplates physical or basic electronic records. Extending “forgery” to encompass the generation of autonomous deep-learning vectors stretches judicial interpretation to its absolute limit, resulting in significant legal uncertainty.

4. Comparative Legal Analysis: Global Benchmarks vs. Domestic Reality

To measure Bangladesh’s structural readiness, its legal framework must be contrasted with emerging global regulatory paradigms.

4.1. The European Union Approach

The European Union’s landmark AI Act (2024) utilizes a stringent, risk-based classification system. Under this framework, generative AI systems producing synthetic media face strict transparency obligations. Providers must ensure that AI-generated outputs are clearly marked in a machine-readable format and explicitly disclosed as synthetic to the end-user. Bangladesh’s CSA 2026 contains no equivalent disclosure mandates, leaving the entire burden of detection on the end-user or the victim.

4.2. The United States Approach

In the United States, federal initiatives like the DEFIANCE Act 2024 establish a civil cause of action, enabling victims of non-consensual deepfake pornography to sue creators and distributors for damages. In contrast, Bangladesh’s regime is exclusively criminal and reactive. It lacks civil frameworks that empower victims to pursue direct financial restitution from those who profit from their digital exploitation.

5. Institutional and Forensic Deficits

A law is only as strong as its enforcement mechanism. In Bangladesh, the “legal response gap” is exacerbated by severe institutional constraints.³ The Criminal Investigation Department (CID) of the Bangladesh Police and the BGD e-GOV CIRT (Computer Incident Response Team) lack advanced, AI-driven forensic tools necessary to authenticate deepfakes.

Traditional digital forensics rely on metadata analysis and cryptographic hashing. Deepfakes, however, are routinely scrubbed of metadata when uploaded to social media platforms (e.g., Facebook, WhatsApp). Detecting high-tier deepfakes requires advanced Deepfake Detection Models that analyze biological anomalies, such as unnatural blinking rates or irregular blood-flow patterns in synthetic skin. Without substantial investment in forensic infrastructure, statutory prohibitions in the CSA 2026 will remain practically unenforceable.

6. The Way Forward: A Comprehensive Blueprint for Reform

Bangladesh stands at a critical juncture. To bridge the gap between technological harm and legal redress, the state must transition from a reactive punitive approach to a proactive, regulatory model.⁴

6.1. Immediate Legislative Enactment: The Artificial Intelligence Act

While the Draft National AI Policy 2026–2030 proposes the creation of a comprehensive Artificial Intelligence Act by 2028,⁵ a two-year legislative vacuum is unacceptable given the current velocity of AI harms. The Ministry of Law should immediately fast-track dedicated legislation containing the following structural pillars:

1. Statutory Definitions: Explicitly define “Synthetic Media” and “Deepfakes” to prevent judicial ambiguity.
2. Mandatory Provenance Tech: Obligate AI developers operating within Bangladesh to implement cryptographic watermarking and C2PA (Coalition for Content Provenance and Authenticity) standards on all generative outputs.
3. Strict Intermediary Liability: Amend the Information and Communication Technology Act 2006 to hold social media platforms accountable if they fail to remove flagged, non-consensual deepfakes within a mandatory 24-hour window.

6.2. Judicial and Forensic Capacity Building

The government must establish a specialized National Digital Forensics Laboratory under the National Cyber Security Agency (NCSA). This laboratory must be equipped with automated deepfake detection software. Concurrently, specialized training programs should be designed for the judiciary to handle AI-generated evidence under the Evidence Act 1872, establishing strict guidelines for authenticating digital evidence before it is admitted into trial.

7. Conclusion

Deepfake technology has weaponized the digital landscape, transforming human identity into mutable, easily exploited code. Bangladesh’s current legal architecture — though recently updated via the Cyber Security Act 2026 — remains fundamentally unequipped to handle the scale of generative AI threats. Relying on analog laws to police digital innovations creates an unbridgeable legal response gap that leaves citizens, particularly women, exposed to systemic harm. To truly achieve a resilient and secure digital economy, Bangladesh must move beyond aspirational policy papers. It must implement robust, enforceable, and technologically literate statutory frameworks that enforce algorithmic accountability, fortify institutional forensics, and firmly safeguard individual dignity in the age of artificial intelligence.

Note(S):

1. Mayeesha N and others, ‘Victims of AI: Addressing the Legal Response Gap to AI-Related Crimes in Bangladesh’ (2026) 13(2) International Journal of Research and Scientific Innovation (IJRSI) 1980.
2. Sanzida Rahman, ‘Cybersecurity Act 2026 of Bangladesh: A Critical Analysis of Its Deficiencies and Limitations’ Legal Research Review (2026) researchgate.net/publication/407196373 accessed 3 July 2026.
3. Tawhid Islam and others, ‘The Standardization of Bangladesh Cyber Security Act 2026: A Critical Evaluation in the Age of Artificial Intelligence and other Advanced Technologies’ (Department of Law, University of Rajshahi, June 2026) researchgate.net/publication/406981590 accessed 3 July 2026.
4. Ferdows Hossen, ‘Bangladesh’s AI Policy 2026 Is a Bold Start — But Without These Fixes, It May Remain Toothless’ (2026) Medium Legal Analysis, medium.com/@fahasan.du.
5. Information and Communication Technology Division, National AI Policy Bangladesh 2026–2030 (Draft V1.1) (Ministry of Posts, Telecommunications and Information Technology, Government of Bangladesh 2026) aipolicy.gov.bd.

Reference(S):

Primary Sources

Constitution of the People’s Republic of Bangladesh, art 43(b).

Cyber Security Act 2026, ss 2, 25, 29, 35.

Pornography Control Act 2012, s 8.

The Evidence Act 1872, s 45A.

The Penal Code 1860, ss 29, 463, 464.

Secondary Sources

Hossen F, ‘Bangladesh’s AI Policy 2026 Is a Bold Start — But Without These Fixes, It May Remain Toothless’ (2026) Medium Legal Analysis, medium.com/@fahasan.du.

Islam T and others, ‘The Standardization of Bangladesh Cyber Security Act 2026: A Critical Evaluation in the Age of Artificial Intelligence and other Advanced Technologies’ (2026) Department of Law, University of Rajshahi / ResearchGate, researchgate.net/publication/406981590.

Mayeesha N and others, ‘Victims of AI: Addressing the Legal Response Gap to AI-Related Crimes in Bangladesh’ (2026) 13(2) International Journal of Research and Scientific Innovation (IJRSI) 1980–1995, rsisinternational.org/journals/ijrsi.

Rahman S, ‘Cybersecurity Act 2026 of Bangladesh: A Critical Analysis of Its Deficiencies and Limitations’ (2026) Legal Research Review / ResearchGate, researchgate.net/publication/407196373.

UNESCO, Readiness Assessment Methodology (RAM) Country Profile: Bangladesh (Global AI Ethics and Governance Observatory 2026).