Authored By: Fatima Amir
Government College University Lahore
Introduction
Imagine seeing a video of yourself doing something you never actually did. Technological innovation in Artificial Intelligence has made it possible to produce highly realistic videos of people saying or doing something they have never said or done. This technology, known as deepfake technology, uses deep learning algorithms like generative adversarial networks (GANs) to generate realistic fake content by combining, superimposing, replacing, or merging several videos, images, or audio files. Deepfake technology has significant benefits in film-making, entertainment, and education. However, its misuse has given rise to numerous offenses, including the creation of non-consensual pornography, the spread of political misinformation, celebrity impersonation, blackmail, identity theft, and financial fraud. These emerging challenges reflect the shortcomings in Pakistan’s legal system in dealing with cases involving synthetic media.
Deepfake technology has become easily accessible, and no technical skills are required to create such fake content, due to which the number of deepfake-related offenses has become prevalent in recent years. Legally, Pakistan relies on the Prevention of Electronic Crimes Act (PECA) 2016, the Pakistan Penal Code 1860, and the Defamation Ordinance 2002. However, these statutes are largely silent on synthetic media, AI-generated impersonation, and deepfake-specific harms.
This article argues that Pakistan’s existing legal framework is inadequate to address the digital harms caused by deepfake technology, and that comprehensive legislative reform is required to effectively protect victims. The article first explains the nature of deepfake technology, analyses Pakistan’s current legal framework, identifies its principal shortcomings, compares international regulatory approaches, and finally proposes reforms aimed at strengthening legal protection while preserving constitutional rights and technological innovation.
Understanding Deepfake Technology
“Deepfake” is a blend of the words “deep learning” (DL) and “fake.” Deepfakes are a form of synthetic media using artificial intelligence to produce or manipulate images, videos, or audio recordings that closely resemble real people. Unlike conventional photo or video editing, deepfakes rely on advanced machine learning models — particularly Generative Adversarial Networks (GANs) — which analyse large datasets to imitate a person’s facial expressions, voice, and mannerisms with remarkable accuracy.
The EU Artificial Intelligence Act (Article 3(60)) defines a “deep fake” as:“AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful.”
Pakistan’s Existing Legal Framework
Prevention of Electronic Crimes Act 2016 (PECA)
The Prevention of Electronic Crimes Act 2016 (PECA) serves as the foundation of Pakistan’s primary cybercrime legislation. While it has no specific provisions that address or regulate deepfakes, several provisions may apply where AI-generated content is used to harm an individual. Section 16 (identity theft) criminalizes the unauthorized use of identity information. Section 20 imposes sanctions for offenses against the dignity and reputation of a natural person through an information system, making it relevant where fabricated videos or audio recordings are circulated to defame or humiliate someone. Likewise, Section 21 provides protection against the unauthorized dissemination of intimate images or videos, which may extend to sexually explicit deepfakes created without a person’s consent. Sections 24 and 26 may also apply where synthetic media is used for cyberstalking, harassment, or identity-related offenses. However, these provisions were drafted to address conventional cybercrime and do not expressly recognize AI-generated content or the unique challenges associated with synthetic media. Consequently, law enforcement agencies must interpret existing provisions broadly, creating uncertainty in investigation and prosecution.
Pakistan Penal Code 1860 (PPC)
The Pakistan Penal Code 1860 (PPC) was enacted long before the emergence of artificial intelligence. However, several provisions can apply where digital technologies are used to commit traditional criminal offenses. It criminalizes offenses such as cheating, impersonation, criminal intimidation (Section 503), and defamation (Sections 499–500), all of which may arise when deepfakes are used to deceive, threaten, or damage another person’s reputation. [Note: please verify the PPC section numbers for defamation before publication.] For instance, an AI-generated voice recording used to impersonate a bank official and obtain confidential information may amount to cheating by impersonation, while a fabricated video intended to tarnish an individual’s reputation could constitute criminal defamation. Yet these provisions are ill-suited to directly address the creation or dissemination of synthetic media as a distinct form of digital misconduct.
Constitution of Pakistan 1973
Constitutional protections further strengthen the rights of victims. Article 14 of the Constitution guarantees the inviolability of human dignity and privacy, both of which are directly threatened by malicious deepfakes. In Shehla Zia v WAPDA, the Supreme Court held that fundamental rights should be interpreted broadly to protect individuals from emerging threats, reflecting the Constitution’s dynamic character. Similarly, in Benazir Bhutto v Federation of Pakistan, the Court emphasized that constitutional rights must receive a liberal interpretation consistent with democratic values. These decisions support the view that the rights to dignity and privacy extend to the digital environment, even though the cases predate artificial intelligence.
Defamation Ordinance 2002
Victims can seek civil remedies for reputational harm under the Defamation Ordinance 2002, which provides protection against reputational harm caused by deepfakes. However, civil cases take a long time, and during that period deepfakes quickly circulate on digital platforms. By the time relief is granted by the courts, the damage may already be done.
Legal Gaps in Pakistan
While Pakistan’s legal framework provides protection against cybercrime, fraud, and defamation, there is no specific legislation addressing AI or synthetic media. This framework does not provide a statutory definition of “deepfake,” “synthetic media,” or “AI-generated content.” These terms are not defined under PECA 2016 or the PPC 1860. This creates legal uncertainty in determining the extent of existing offenses, leaving courts to apply old legislation that is ill-equipped to address new developments in technology.
Another weakness is the fragmentation of Pakistan’s legal system. Individuals targeted by deepfakes might rely on the PPC for criminal liability, the Defamation Ordinance for civil remedies, PECA for cyber offenses, and constitutional provisions for privacy and dignity. As a result, victims may face lengthy and expensive legal proceedings, and law enforcement may struggle to determine which legal provisions apply, since there is no dedicated deepfake legislation.
There is also weak platform accountability. While social media platforms like Facebook, Instagram, TikTok, and X play a key role in the rapid spread of manipulated content, Pakistani legislation does not require these companies to clearly label and remove harmful deepfakes. The cross-border nature of digital technology makes enforcement more difficult still: deepfakes are often developed with foreign software, stored on servers in other countries, and shared by anonymous individuals across jurisdictions. While PECA gives limited extraterritorial jurisdiction, investigations often require international cooperation, and the sharing of digital evidence remains slow and cumbersome.
These shortcomings reflect an existing legal system that is reactive rather than proactive. Pakistan needs dedicated legislation targeting synthetic media and AI-generated content.
Comparative Perspectives: Lessons for Pakistan
European Union
The European Union has taken a comprehensive approach to regulating malicious deepfake content. The enacted Artificial Intelligence Act (AI Act) addresses the AI regulatory framework through a risk-based strategy. It defines deepfakes and requires deepfake transparency by mandating that developers and deployers disclose when content is AI-generated, ensuring responsible use of AI while holding developers accountable. Article 17, the “right to erasure” under the General Data Protection Regulation (GDPR), grants victims the right to request the removal of unlawfully held personal data.
United Kingdom
The United Kingdom has taken a more targeted approach through the Online Safety Act 2023. This Act imposes obligations on online platforms to assess the risks of illegal content and remove it promptly, aiming to reduce exposure to abusive and fraudulent content. It criminalizes generating and sharing a non-consensual, sexually explicit “deepfake” video or image of another person.
United States
Several U.S. states, including California and Virginia, have passed laws to regulate deepfakes. These laws specifically ban the creation of non-consensual deepfake pornography and deepfakes intended to influence elections or mislead voters.
China
China established its Deep Synthesis Regulation in 2023, perhaps one of the world’s earliest and most comprehensive approaches to date. It mandates watermark labeling of AI-generated content, and platforms are held directly liable for failing to mark such content. The main purpose is to reduce deception and prevent the spread of misinformation.
Proposals for Reform in Pakistan
Pakistan needs to move beyond outdated provisions and adopt a robust framework to regulate and address the misuse of deepfake technology. First, Parliament should enact dedicated deepfake-specific legislation that clearly defines “deepfake,” “synthetic media,” and “AI-generated content.” A clear statutory definition provides legal certainty and helps distinguish between lawful and unlawful uses. The legislation must criminalize the creation and dissemination of malicious AI-generated content and provide civil remedies for victims.
Second, PECA should be amended to directly address AI-specific offenses, including identity theft, financial fraud, cyber harassment, election manipulation, non-consensual intimate imagery, and impersonation through deepfakes. Courts should be empowered to issue orders for the immediate removal of abusive and fraudulent content to prevent its widespread dissemination.
Third, social media platforms must be held accountable by requiring them to detect, label, and remove unlawful AI-generated content, and to preserve digital evidence for investigations. In addition, Pakistan should establish dedicated deepfake investigation units within the Federal Investigation Agency (FIA) and enhance the digital forensic capabilities of the National Cyber Crime Investigation Agency (NCCIA) and the FIA through AI-focused training and technological investment.
Finally, these legal reforms must be complemented with public awareness campaigns and digital literacy programs to help citizens identify AI-fabricated videos and images.
Conclusion
Deepfake technology has become one of the most pressing legal issues to emerge from the rapid evolution of AI. Pakistan’s current legal framework for addressing cybercrime, fraud, and reputational damage — including the Prevention of Electronic Crimes Act 2016, the Pakistan Penal Code 1860, constitutional protections, and the Defamation Ordinance 2002 — was not designed with AI-generated synthetic media in mind. As a result, it offers only fragmented protection, leaving significant gaps in the determination of criminal responsibility, platform accountability, and victim rights.
This article has argued that the need for a comprehensive response arises from the absence of dedicated deepfake-specific regulation, the limited accountability of platforms, and the difficulty of enforcing cross-border offenses. Comparative analysis of regulatory approaches in the European Union, the United Kingdom, the United States, and China further demonstrates how legal systems elsewhere are being strengthened through targeted regulation, transparency requirements, and greater platform liability for AI-related harms. Pakistan needs to act swiftly to close its existing legal gap by establishing a comprehensive regulatory framework that safeguards its digital future while promoting the responsible use of artificial intelligence.
Reference(S):
Cases
Benazir Bhutto v Federation of Pakistan PLD 1988 SC 416.
Shehla Zia v WAPDA PLD 1994 SC 693.
Legislation
Constitution of the Islamic Republic of Pakistan 1973.
Defamation Ordinance 2002.
Online Safety Act 2023 (UK).
Pakistan Penal Code 1860.
Prevention of Electronic Crimes Act 2016.
Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L.
Secondary Sources
Chesney R and Citron DK, ‘Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security’ (2019) 107 California Law Review 1753.
Delfino RA, ‘Pornographic Deepfakes: The Case for Federal Criminalization of Revenge Porn’s Next Tragic Act’ (2020) 88 Fordham Law Review 887.
Heller B, ‘The AI Deepfake Crisis: A Legal Perspective’ (2021) Yale Journal of Law & Technology.
Westerlund M, ‘The Emergence of Deepfake Technology: A Review’ (2019) 9 Technology Innovation Management Review 40.
Goodfellow I, Bengio Y and Courville A, Deep Learning (MIT Press 2016).
European Commission, Artificial Intelligence Act (European Commission 2024).
UNESCO, Guidance for the Governance of Digital Platforms (UNESCO 2023).
World Economic Forum, Global Risks Report 2025 (World Economic Forum 2025).
