Deepfake Technology and the Law: Is Existing Legislation Sufficient to Protect Victims?

I. Introduction

The rapid advancement of artificial intelligence (AI) has transformed digital content creation, making it possible to generate highly realistic synthetic media, commonly referred to as ‘deepfakes’. Although these technologies present significant opportunities for innovation in entertainment, education, and communication, they also facilitate the creation of deceptive content capable of causing serious harm to individuals and society. In January 2024, sexually explicit AI-generated images falsely depicting the American singer Taylor Swift circulated widely across social media platforms, highlighting the inadequacy of existing legal and regulatory frameworks in responding effectively to malicious deepfake content.¹

The legal challenges posed by deepfakes arise because they blur the distinction between authentic and manipulated media, giving rise to issues relating to privacy, defamation, identity fraud, intellectual property, election interference, and cybersecurity.² Existing legal frameworks, including privacy, cybercrime, and data protection laws, provide certain legal remedies; however, they were not specifically designed to regulate AI-generated synthetic media and often fail to address the unique harms associated with deepfake technology.³

This article argues that existing legal frameworks are insufficient to comprehensively address the harms caused by malicious deepfakes, and that targeted legislative reform is necessary to protect victims while safeguarding innovation and freedom of expression. It first examines the nature of deepfake technology and the legal framework governing it in South Africa, then considers the approaches adopted in selected foreign jurisdictions, analyses the limited case law available, critically evaluates the shortcomings of existing legal mechanisms, and concludes by proposing reforms suitable for South Africa.

II. Legal Framework

A. Understanding Deepfake Technology

Deepfakes are a form of synthetic media generated through artificial intelligence, particularly deep learning techniques such as generative adversarial networks and diffusion models, to create or manipulate images, videos, and audio recordings that closely resemble authentic content.⁴ Unlike traditional digital editing, deepfake technology enables the realistic imitation of a person’s facial expressions, voice, and mannerisms, making it increasingly difficult to distinguish fabricated media from genuine recordings.

Although deepfake technology has numerous legitimate applications, including in education, filmmaking, healthcare, and scientific research, its misuse has become a growing legal and societal concern.⁵ Malicious deepfakes have been used to create non-consensual intimate images, commit financial fraud through voice cloning, spread political misinformation, manipulate public opinion, and damage individuals’ reputations.⁶ The rapid dissemination of such content through digital platforms significantly increases the potential harm to victims, often before legal remedies can be effectively pursued.

The increasing accessibility of generative AI tools has further complicated the regulation of deepfakes. Previously, creating convincing synthetic media required specialised technical expertise and significant computing resources. Today, freely available AI applications enable individuals with little or no technical knowledge to produce realistic deepfakes within minutes.⁷ This rapid technological advancement has outpaced the development of legal frameworks, leaving many jurisdictions—including South Africa—without legislation specifically designed to regulate AI-generated synthetic media.

The legal implications of deepfake technology extend across multiple areas of law, including privacy, defamation, intellectual property, cybercrime, and constitutional rights. Rather than falling within a single legal category, deepfakes frequently engage several legal principles simultaneously, creating uncertainty regarding the most appropriate remedies available to victims.⁸ Determining whether existing legal frameworks adequately address the harms associated with deepfakes has consequently become an increasingly important question for lawmakers, courts, and legal scholars. It is to the South African framework that the discussion now turns.

B. The Existing South African Legal Framework

South Africa does not currently have legislation that specifically regulates deepfake technology. Instead, victims of malicious deepfakes must rely on a combination of constitutional rights, statutory provisions, and common-law remedies to seek redress.⁹ While these mechanisms offer some protection against the harms associated with deepfakes, they were enacted before the emergence of generative artificial intelligence and therefore do not squarely address the challenges posed by AI-generated synthetic media.¹⁰

The Constitution of the Republic of South Africa, 1996, provides the foundation for protecting individuals affected by malicious deepfakes. Section 14 guarantees the right to privacy, which the courts have interpreted to extend beyond searches and seizures to the protection of personal information against unlawful collection, use, and dissemination.¹¹ This right is particularly relevant where deepfakes involve the unauthorised use of a person’s image, voice, or likeness. Section 10, which guarantees the right to human dignity, is equally engaged where synthetic media degrades or sexualises its subject.¹² At the same time, section 16 protects the right to freedom of expression, including artistic creativity and the freedom to receive or impart information.¹³ The coexistence of these rights requires courts to balance the protection of individual dignity and privacy against the preservation of freedom of expression when disputes involving deepfakes arise.

The Protection of Personal Information Act 4 of 2013 (POPIA) further strengthens the constitutional right to privacy by regulating the processing of personal information.¹⁴ Under POPIA, personal information means information relating to an identifiable, living natural person, and includes photographs and biometric information, the latter being treated as special personal information subject to heightened protection.¹⁵ Where deepfake technology is used to manipulate or distribute identifiable images without consent, POPIA may provide civil remedies against those responsible. However, the Act was not drafted with AI-generated synthetic media in mind and does not expressly regulate the creation or dissemination of deepfakes.

The Cybercrimes Act 19 of 2020 supplies the principal criminal protections. It creates offences of cyber fraud, cyber forgery and uttering, and cyber extortion, each of which may be committed through the use of synthetic media.¹⁶ Of particular significance, section 16 criminalises the unlawful and intentional disclosure, by means of an electronic communications service, of a data message containing an intimate image of a person without that person’s consent. The definition of an intimate image expressly extends to depictions that are real or simulated, which on its ordinary meaning captures synthetically generated and digitally altered imagery.¹⁷ Overlapping protection is provided by sections 18F and 18G of the Films and Publications Act 65 of 1996, as amended by the Films and Publications Amendment Act 11 of 2019.¹⁸

Finally, the common law retains an important role. A victim may bring an action for defamation where a deepfake conveys a false and injurious impression, or rely on the actio iniuriarum for an impairment of dignity or privacy, including the unauthorised use of a person’s image.¹⁹ These remedies are well established, but they are civil, individualised, and dependent on the identification of a defendant.

C. The International Legal Framework

The regulation of deepfake technology has become an international concern, with many jurisdictions recognising that existing legal frameworks are insufficient to address the risks associated with AI-generated synthetic media.²⁰ Although no universally accepted legal framework currently governs deepfakes, several jurisdictions have introduced legislative and regulatory measures aimed at promoting transparency, protecting individual rights, and reducing the misuse of artificial intelligence.²¹ These developments provide valuable guidance for South Africa as it considers future legal reforms.

The European Union has adopted one of the world’s most comprehensive approaches to regulating artificial intelligence through the Artificial Intelligence Act.²² The Act introduces a risk-based regulatory framework and requires deployers of AI systems that generate or manipulate content constituting a deep fake to disclose that the content has been artificially generated or manipulated, subject to limited exceptions where use is authorised by law for the detection of criminal offences, and to a modified obligation where the work is evidently artistic, satirical, or fictional.²³ By promoting transparency rather than prohibition, the Act seeks to reduce deception while preserving innovation and freedom of expression. It complements existing EU legislation, including the General Data Protection Regulation and the Digital Services Act, which strengthen the protection of personal data and impose responsibilities on online platforms to address illegal digital content.²⁴

In the United Kingdom, the government has adopted a combination of criminal and regulatory measures. The Online Safety Act 2023 places duties on digital platforms to minimise the dissemination of illegal and harmful material, including AI-generated content that may facilitate abuse or exploitation.²⁵ The same Act amended the Sexual Offences Act 2003 to criminalise the sharing of, or threatening to share, intimate images without consent, expressly including images that have been digitally manipulated.²⁶ The United Kingdom has since gone further: section 138 of the Data (Use and Access) Act 2025, which came into force on 6 February 2026, inserted new offences of creating, or requesting the creation of, a purported intimate image of an adult without consent.²⁷ Publication is not required, and the offence therefore reaches the harm at the point of creation rather than distribution.

These legislative responses have developed quickly, in part because the courts have had so little opportunity to address the problem directly.

III. Case Law Analysis

The emergence of deepfake technology has exposed significant challenges for courts worldwide. Because deepfakes are a relatively recent development, few judicial decisions have dealt directly with AI-generated synthetic media. Courts have consequently relied on existing legal principles relating to privacy, defamation, intellectual property, fraud, and freedom of expression to resolve disputes involving manipulated digital content.²⁸ This suggests that while traditional legal doctrines remain relevant, they are often inadequate to address the complexities presented by artificial intelligence.

One of the most influential decisions concerning AI-generated works is Thaler v Perlmutter, in which the United States District Court for the District of Columbia held that copyright protection under United States law requires human authorship and cannot extend to works created entirely by artificial intelligence. The Court of Appeals for the District of Columbia Circuit affirmed that holding in March 2025, and the Supreme Court declined to review the decision in March 2026.²⁹ Although the litigation did not concern deepfakes directly, it reaffirms the principle that existing legal frameworks were developed on the assumption of human creativity and decision-making. The judgment illustrates the broader difficulty of applying traditional legal concepts to rapidly evolving AI technologies.

In the United Kingdom, courts have generally addressed harms arising from manipulated digital content through the established principles of privacy, misuse of private information, and defamation rather than through AI-specific legislation.³⁰ That approach places considerable weight on doctrines designed for a different technological era, and the legislative interventions described above are best understood as an acknowledgment that judicial adaptation alone has proved insufficient. In South Africa, no reported decision has yet considered a deepfake, although the Constitutional Court’s treatment of a digitally manipulated image in Le Roux v Dey offers a useful starting point for the assessment of dignity-based harm.³¹

IV. Critical Evaluation

The increasing sophistication of deepfake technology has exposed significant shortcomings in existing legal frameworks. Although South African law provides several remedies through constitutional rights, privacy legislation, cybercrime laws, and common-law actions, these mechanisms remain fragmented and reactive rather than preventative.³² Victims are often required to rely on multiple legal avenues to address a single incident, resulting in lengthy litigation, increased costs, and inconsistent outcomes.

The principal weakness of the current framework is that no South African statute defines or regulates deepfake technology as such.³³ Courts must therefore interpret legislation enacted before the emergence of generative artificial intelligence. The Cybercrimes Act 19 of 2020 goes further than is sometimes appreciated, because the definition of an intimate image in section 16 extends to simulated depictions and so reaches non-consensual deepfake pornography. Its protection is nonetheless partial in three respects. First, the offence is directed at disclosure, and does not criminalise the creation or possession of synthetic intimate imagery that is never distributed. Second, it is confined to intimate images, and leaves fraudulent, defamatory, and politically deceptive deepfakes to be prosecuted, if at all, under general offences whose elements they may not satisfy. Third, it requires that the person depicted retained a reasonable expectation of privacy, a requirement that sits awkwardly with content that is fabricated rather than recorded.³⁴ These gaps allow certain forms of harmful synthetic media to evade criminal liability despite causing substantial reputational, emotional, and financial harm.

Similarly, although POPIA protects personal information and gives effect to the constitutional right to privacy, its application to AI-generated content remains uncertain.³⁵ Deepfakes frequently involve the unauthorised use of an individual’s facial features, voice, or likeness without necessarily processing personal information in the manner contemplated by the Act. Victims may therefore struggle to establish liability where AI-generated content falls outside the traditional understanding of personal information, or where the creator of the deepfake cannot easily be identified.

The rapid dissemination of deepfakes through social media platforms presents a further challenge. Harmful content can reach millions of users within hours, while legal proceedings often take months or years to conclude.³⁶ Although victims may eventually obtain civil remedies or criminal sanctions, those remedies frequently arrive after the reputational damage has become irreversible. Existing legal mechanisms are, in this sense, largely reactive, and fail to provide effective preventative protection against the widespread distribution of malicious deepfakes.

V. Recommendations

The analysis undertaken in this article demonstrates that South Africa’s existing legal framework provides only fragmented protection against the harms caused by deepfake technology. Although constitutional rights, common-law remedies, and legislation such as the Cybercrimes Act 19 of 2020 and POPIA offer certain forms of recourse, they do not adequately address the challenges posed by AI-generated synthetic media. Legislative reform is accordingly necessary to ensure that the law remains responsive to technological developments while safeguarding fundamental rights.

First, Parliament should enact legislation that specifically defines and regulates deepfake technology. A statutory definition would provide greater legal certainty and enable courts to distinguish between legitimate uses of artificial intelligence—such as education, satire, artistic expression, and scientific research—and malicious uses intended to deceive, defraud, or harm. The definition of a deep fake in article 3(60) of the EU Artificial Intelligence Act offers a workable model.³⁷ Such legislation should clearly identify the circumstances in which the creation, publication, or distribution of harmful deepfakes constitutes a civil wrong or a criminal offence. It should also close the creation gap left by section 16 of the Cybercrimes Act, along the lines recently adopted in the United Kingdom.

Second, lawmakers should introduce mandatory transparency requirements for AI-generated content. Individuals and organisations that create or distribute synthetic media should be required to disclose clearly when content has been generated or materially altered through artificial intelligence. Limited exemptions would be justified for law enforcement and national security purposes, and for evidently artistic or satirical works.³⁸ Such measures would reduce the risk of deception while preserving legitimate innovation.

Third, digital platforms should bear greater responsibility for addressing malicious deepfakes circulated through their services. Online platforms should be required to establish efficient reporting mechanisms, to remove unlawful synthetic media promptly once notified, and to cooperate with law enforcement authorities in identifying those responsible for creating or distributing harmful content.³⁹ Obligations of this kind would strengthen victim protection while promoting responsible digital governance.

VI. Conclusion

Deepfake technology represents one of the most significant legal challenges arising from the rapid advancement of artificial intelligence. While AI-generated synthetic media offers substantial benefits for education, entertainment, healthcare, and innovation, its misuse has created serious risks to privacy, dignity, reputation, electoral integrity, and cybersecurity. The analysis undertaken in this article has demonstrated that South Africa’s existing legal framework—including the Constitution, POPIA, the Cybercrimes Act 19 of 2020, and common-law remedies—provides important protections but remains fragmented and incomplete in addressing the challenges posed by malicious deepfakes.⁴⁰

A comparative examination of international developments further illustrates that many jurisdictions have recognised the need for AI-specific regulatory measures to supplement traditional legal principles. The European Union’s Artificial Intelligence Act and the United Kingdom’s Online Safety Act 2023 and Data (Use and Access) Act 2025 provide useful examples of how transparency obligations, platform accountability, and targeted legislative intervention can strengthen protection against harmful synthetic media while respecting fundamental rights.⁴¹

The question posed at the outset must therefore be answered in the negative. Existing legislation is not sufficient to protect victims of malicious deepfakes. It is not that South African law offers nothing; it is that what it offers is scattered across several instruments, directed at harms conceived before generative artificial intelligence existed, and capable of being invoked only after the damage has been done. A statutory definition of deepfake technology, mandatory transparency obligations, and enforceable duties on digital platforms would not eliminate that harm, but they would give victims a coherent remedy rather than a collection of imperfect ones. The longer reform is deferred, the further the law will fall behind the technology it is required to govern.

Endnote(S):

1. Dan Rosenzweig-Ziff, ‘Nude Taylor Swift Deepfakes Built with AI Spread Online This Week’ Washington Post (26 January 2024) https://www.washingtonpost.com/technology/2024/01/26/ai-deepfakes-taylor-swift-nude/ accessed 17 September 2026.
2. European Parliamentary Research Service, Deepfakes and Disinformation: Impact on Society and Fundamental Rights (European Parliament 2021) 7–15.
3. Constitution of the Republic of South Africa, 1996 s 14; Protection of Personal Information Act 4 of 2013; Cybercrimes Act 19 of 2020.
4. European Parliamentary Research Service (n 2) 1–8.
5. UNESCO, Guidance for the Governance of Digital Platforms (UNESCO 2023) 34–37.
6. Europol, Facing Reality? Law Enforcement and the Challenge of Deepfakes (Publications Office of the European Union 2022) 9–16.
7. ibid 17–24.
8. European Parliamentary Research Service (n 2) 20–28.
9. Constitution of the Republic of South Africa, 1996; Cybercrimes Act 19 of 2020; Protection of Personal Information Act 4 of 2013.
10. South African Law Reform Commission, Project 124: Privacy and Data Protection — Report (SALRC 2009).
11. Constitution of the Republic of South Africa, 1996 s 14. See Bernstein v Bester NO 1996 (2) SA 751 (CC); NM v Smith 2007 (5) SA 250 (CC).
12. Constitution of the Republic of South Africa, 1996 s 10.
13. Constitution of the Republic of South Africa, 1996 s 16.
14. Protection of Personal Information Act 4 of 2013.
15. Protection of Personal Information Act 4 of 2013 ss 1, 26.
16. Cybercrimes Act 19 of 2020 ss 8–10.
17. Cybercrimes Act 19 of 2020 s 16(1)–(2).
18. Films and Publications Act 65 of 1996 ss 18F–18G, as inserted by the Films and Publications Amendment Act 11 of 2019.
19. Le Roux v Dey 2011 (3) SA 274 (CC); Grütter v Lombard 2007 (4) SA 89 (SCA).
20. UNESCO, Recommendation on the Ethics of Artificial Intelligence (adopted 23 November 2021).
21. Organisation for Economic Co-operation and Development, OECD Digital Economy Outlook 2024 (OECD Publishing 2024).
22. Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act).
23. Artificial Intelligence Act (EU) 2024/1689 art 50(4).
24. Regulation (EU) 2016/679 (General Data Protection Regulation); Regulation (EU) 2022/2065 (Digital Services Act).
25. Online Safety Act 2023 (UK).
26. Sexual Offences Act 2003 (UK) ss 66A–66B, as inserted by the Online Safety Act 2023 s 188.
27. Data (Use and Access) Act 2025 (UK) s 138, inserting ss 66E–66H into the Sexual Offences Act 2003.
28. European Parliamentary Research Service (n 2) 20–28.
29. Thaler v Perlmutter 687 F Supp 3d 140 (DDC 2023), aff’d 130 F 4th 1039 (DC Cir 2025), cert denied (2 March 2026).
30. Nicole Moreham, Mark Warby and Iain Christie (eds), Tugendhat and Christie: The Law of Privacy and the Media (3rd edn, Oxford University Press 2016).
31. Le Roux v Dey 2011 (3) SA 274 (CC).
32. Constitution of the Republic of South Africa, 1996; Cybercrimes Act 19 of 2020; Protection of Personal Information Act 4 of 2013.
33. ibid.
34. Cybercrimes Act 19 of 2020 s 16(2)(b)(ii).
35. Protection of Personal Information Act 4 of 2013 ss 1, 11.
36. Europol (n 6) 25–31.
37. Artificial Intelligence Act (EU) 2024/1689 art 3(60).
38. Artificial Intelligence Act (EU) 2024/1689 art 50(4).
39. Regulation (EU) 2022/2065 (Digital Services Act) arts 16–23; Online Safety Act 2023 (UK).
40. Constitution of the Republic of South Africa, 1996; Protection of Personal Information Act 4 of 2013; Cybercrimes Act 19 of 2020.
41. Regulation (EU) 2024/1689 (Artificial Intelligence Act); Online Safety Act 2023 (UK); Data (Use and Access) Act 2025 (UK).

Bibliography

Legislation

• Constitution of the Republic of South Africa, 1996
• Cybercrimes Act 19 of 2020
• Films and Publications Act 65 of 1996
• Films and Publications Amendment Act 11 of 2019
• Protection of Personal Information Act 4 of 2013
• Data (Use and Access) Act 2025 (UK)
• Online Safety Act 2023 (UK)
• Sexual Offences Act 2003 (UK)
• Regulation (EU) 2024/1689 (Artificial Intelligence Act)
• Regulation (EU) 2022/2065 (Digital Services Act)
• Regulation (EU) 2016/679 (General Data Protection Regulation)

Cases

• Bernstein v Bester NO 1996 (2) SA 751 (CC)
• Grütter v Lombard 2007 (4) SA 89 (SCA)
• Le Roux v Dey 2011 (3) SA 274 (CC)
• NM v Smith 2007 (5) SA 250 (CC)
• Thaler v Perlmutter 687 F Supp 3d 140 (DDC 2023), aff’d 130 F 4th 1039 (DC Cir 2025)

Books and Reports

• European Parliamentary Research Service, Deepfakes and Disinformation: Impact on Society and Fundamental Rights (European Parliament 2021)
• Europol, Facing Reality? Law Enforcement and the Challenge of Deepfakes (Publications Office of the European Union 2022)
• Moreham N, Warby M and Christie I (eds), Tugendhat and Christie: The Law of Privacy and the Media (3rd edn, Oxford University Press 2016)
• Organisation for Economic Co-operation and Development, OECD Digital Economy Outlook 2024 (OECD Publishing 2024)
• South African Law Reform Commission, Project 124: Privacy and Data Protection — Report (SALRC 2009)
• UNESCO, Guidance for the Governance of Digital Platforms (UNESCO 2023)
• UNESCO, Recommendation on the Ethics of Artificial Intelligence (adopted 23 November 2021)

News Sources

• Rosenzweig-Ziff D, ‘Nude Taylor Swift Deepfakes Built with AI Spread Online This Week’ Washington Post (26 January 2024) https://www.washingtonpost.com/technology/2024/01/26/ai-deepfakes-taylor-swift-nude/ accessed 17 September 2026