Authored By: Asemahle Zimba
Cape Peninsula University of Technology
Introduction
Artificial intelligence has transformed the creation of digital content, with deepfakes emerging as one of its most controversial developments. Deepfakes are highly realistic images, audio recordings and videos generated or manipulated using artificial intelligence to imitate real individuals. Although the technology has legitimate applications in education, entertainment and digital innovation, it also presents significant legal risks, including identity theft, fraud, misinformation, reputational harm and violations of privacy.
South Africa has experienced rapid technological advancement without adopting legislation specifically regulating deepfakes. Instead, disputes involving AI-generated synthetic media are addressed through constitutional rights, legislation of general application and common-law principles. Whether these existing legal mechanisms provide adequate protection against the unique challenges posed by deepfakes remains uncertain.
This article argues that South Africa’s current legal framework offers partial protection against the harms associated with deepfakes but remains fragmented and insufficient to regulate AI-generated synthetic media effectively. It is submitted that the absence of dedicated legislation creates legal uncertainty and limits the ability of existing laws to respond proactively to emerging technological risks. The discussion first examines the current legal framework before evaluating its shortcomings and proposing the need for AI-specific regulation.
South Africa’s Existing Legal Framework and Its Application to Deepfakes
South Africa does not currently have legislation specifically regulating deepfakes or other forms of AI-generated synthetic media. Consequently, legal disputes arising from the creation and distribution of deepfakes must be addressed through existing constitutional rights, legislation of general application and common-law remedies. While this framework provides a degree of protection, it was not designed to regulate the unique risks posed by artificial intelligence.
The Constitution of the Republic of South Africa, 1996, forms the foundation of this legal framework. Section 10 protects every person’s right to human dignity, while section 14 guarantees the right to privacy. These rights may be infringed where a person’s image or voice is manipulated without consent to create false or misleading content. Deepfakes may also affect the right to equality under section 9 if they are used to target vulnerable groups or facilitate discriminatory conduct. At the same time, section 16 protects freedom of expression, requiring any regulatory response to balance the prevention of harm against the protection of legitimate speech, artistic expression and technological innovation.
Statutory protection is primarily found in the Protection of Personal Information Act 4 of 2013 (POPIA) and the Cybercrimes Act 19 of 2020. POPIA regulates the lawful processing of personal information and may apply where facial images, voice recordings or other personal data are collected and used to generate deepfakes without a lawful basis. Similarly, the Cybercrimes Act criminalises various forms of unlawful online conduct, including offences involving fraud and cyber-related communications, which may be committed through the misuse of deepfake technology. However, neither statute specifically regulates the creation, distribution or labelling of AI-generated synthetic media.
South African common law also provides remedies where deepfakes result in defamation, invasion of privacy or other forms of legally recognised harm. Victims may institute civil proceedings to protect their personality rights or claim damages where the requirements of the law of delict are satisfied. Although these remedies remain important, they generally become available only after the harm has already occurred.
Accordingly, the existing legal framework offers meaningful protection against some of the consequences of harmful deepfakes. Nevertheless, its reliance on laws enacted before the rapid development of generative artificial intelligence raises an important question: whether these measures are sufficient to address the increasingly complex challenges posed by synthetic digital media.
Why the Current Legal Framework Is Insufficient?
Although South Africa’s existing legal framework provides several avenues for addressing harms caused by deepfakes, it remains inadequate because it responds primarily to the consequences of unlawful conduct rather than regulating the technology itself. This reactive approach creates legal uncertainty and limits the effectiveness of existing remedies in an increasingly digital society.
A significant limitation is that current legislation does not establish clear legal obligations for the creation, disclosure or distribution of AI-generated synthetic media. For example, neither POPIA nor the Cybercrimes Act requires creators to identify or label AI-generated content. As a result, manipulated videos and audio recordings may circulate widely before victims become aware of their existence or are able to seek legal protection. Once such content is shared across multiple digital platforms, removing it completely becomes extremely difficult, even where legal remedies are available.
Existing remedies are also largely dependent on victims taking legal action after harm has occurred. A person whose reputation has been damaged by a malicious deepfake may institute proceedings for defamation or seek compensation under the law of delict. However, litigation is often costly and time-consuming, and judicial relief may come long after the false content has been viewed, copied and redistributed. In many cases, the reputational, emotional or financial harm cannot be fully reversed.
Deepfakes also present new challenges for law enforcement and the administration of justice. The increasing sophistication of artificial intelligence makes it more difficult to distinguish authentic digital evidence from manipulated content. This may complicate criminal investigations and civil litigation by requiring greater reliance on digital forensic expertise to establish authenticity. Without clear legal standards governing AI-generated evidence, courts may face increasing uncertainty when evaluating the reliability of electronic material.
Furthermore, the absence of AI-specific legislation leaves uncertainty regarding the responsibilities of technology developers, online platforms and individuals who create or knowingly distribute harmful deepfakes. While existing laws may impose liability in particular circumstances, they do not provide a comprehensive regulatory framework capable of preventing misuse before substantial harm occurs.
For these reasons, the current legal framework cannot be regarded as a complete or future-oriented response to deepfake technology. Although constitutional rights, legislation and common-law principles remain essential, they were enacted to regulate traditional forms of unlawful conduct rather than the distinctive risks created by rapidly evolving artificial intelligence. A more coherent and proactive legal framework is therefore required to provide greater legal certainty, strengthen accountability and enhance public protection.
Conclusion
Deepfakes represent one of the most significant legal challenges created by the rapid development of artificial intelligence. While South Africa’s Constitution, existing legislation and common-law principles provide important protection against harms such as privacy violations, reputational damage and cyber-related offences, these measures were not designed to regulate AI-generated synthetic media directly. Consequently, the current legal framework addresses many of the consequences of deepfakes but does not provide a comprehensive or proactive response to the technology itself.
This article has argued that the absence of AI-specific legislation creates legal uncertainty and limits the effectiveness of existing legal remedies. As deepfake technology continues to evolve, relying solely on traditional legal principles is unlikely to provide adequate protection for individuals, institutions and the broader public.
It is therefore submitted that South Africa should develop a dedicated regulatory framework that addresses the creation and misuse of deepfakes while respecting constitutional rights, encouraging responsible innovation and promoting public confidence in digital technologies. A balanced and forward-looking legal response will enable the law to keep pace with technological development and strengthen the protection of fundamental rights in the digital age.
