Deepfake Technology and the Law: Is Existing Legislation Sufficient to Protect Victims?

I. Introduction

The rapid advancement of artificial intelligence (AI) has transformed digital content creation, making it possible to generate highly realistic synthetic media, commonly referred to as ‘deepfakes’. Although these technologies present significant opportunities for innovation in entertainment, education, and communication, they also facilitate the creation of deceptive content capable of causing serious harm to individuals and society. In January 2024, sexually explicit AI-generated images falsely depicting the American singer Taylor Swift circulated widely across social media platforms, highlighting the inadequacy of existing legal and regulatory frameworks in responding effectively to malicious deepfake content.¹

The legal challenges posed by deepfakes arise because they blur the distinction between authentic and manipulated media, giving rise to issues relating to privacy, defamation, identity fraud, intellectual property, election interference, and cybersecurity.² Existing legal frameworks, including privacy, cybercrime, and data protection laws, provide certain legal remedies; however, they were not specifically designed to regulate AI-generated synthetic media and often fail to address the unique harms associated with deepfake technology.³

This article argues that existing legal frameworks are insufficient to comprehensively address the harms caused by malicious deepfakes, and that targeted legislative reform is necessary to protect victims while safeguarding innovation and freedom of expression. It first examines the legal framework governing deepfakes, then analyses relevant legislation and case law, critically evaluates the shortcomings of existing legal mechanisms, compares approaches adopted in selected foreign jurisdictions, and concludes by proposing reforms suitable for South Africa.

II. Legal Framework

A. Understanding Deepfake Technology

Deepfakes are a form of synthetic media generated through deep learning algorithms and machine learning techniques to create or manipulate images, videos, and audio recordings that closely resemble authentic content.⁴ Unlike traditional digital editing, deepfake technology enables the realistic imitation of a person’s facial expressions, voice, and mannerisms, making it increasingly difficult to distinguish fabricated media from genuine recordings.

Deepfake technology has numerous legitimate applications, including in education, filmmaking, healthcare, and scientific research.⁵ Its misuse, however, has become a growing legal and societal concern. Malicious deepfakes have been used to create non-consensual intimate images, commit financial fraud through voice cloning, spread political misinformation, manipulate public opinion, and damage individuals’ reputations.⁶ The rapid dissemination of such content through digital platforms significantly increases the potential harm to victims, often before legal remedies can be effectively pursued.⁷

The increasing accessibility of generative AI tools has further complicated the regulation of deepfakes. Creating convincing synthetic media once required specialised technical expertise and significant computing resources. Today, freely available AI applications enable individuals with little or no technical knowledge to produce realistic deepfakes within minutes.⁸ This rapid technological advancement has outpaced the development of legal frameworks, leaving many jurisdictions—including South Africa—without legislation specifically designed to regulate AI-generated synthetic media.⁹

The legal implications of deepfake technology extend across multiple areas of law, including privacy, defamation, intellectual property, cybercrime, and constitutional rights. Rather than falling within a single legal category, deepfakes frequently engage several legal principles simultaneously, creating uncertainty regarding the most appropriate legal remedies available to victims. Whether existing legal frameworks adequately address the harms associated with deepfakes has therefore become an increasingly important question for lawmakers, courts, and legal scholars—and it is to the South African position that this article now turns.

B. The Existing South African Legal Framework

South Africa does not currently have legislation that specifically regulates deepfake technology. Instead, victims of malicious deepfakes must rely on a combination of constitutional rights, statutory provisions, and common-law remedies to seek protection.¹⁰ While these mechanisms provide some degree of protection, they were enacted before the emergence of generative artificial intelligence and therefore do not adequately address the unique challenges posed by synthetic media.¹¹

The Constitution of the Republic of South Africa, 1996, provides the foundation for protecting individuals affected by malicious deepfakes. Section 14 guarantees the right to privacy, safeguarding individuals against the unlawful collection, use, and dissemination of personal information.¹² This right is particularly relevant where deepfakes involve the unauthorised use of a person’s image, voice, or likeness. At the same time, section 16 protects the right to freedom of expression, including artistic creativity and the freedom to receive or impart information.¹³ The coexistence of these rights requires courts to balance the protection of individual dignity and privacy against the preservation of freedom of expression when disputes involving deepfakes arise.

The Protection of Personal Information Act 4 of 2013 (POPIA) further strengthens the constitutional right to privacy by regulating the processing of personal information.¹⁴ Under POPIA, personal information includes data that can identify an individual, such as photographs and biometric information, and section 99 permits a data subject to institute civil proceedings for damages.¹⁵ Where deepfake technology is used to manipulate or distribute identifiable images without consent, POPIA may therefore provide a civil remedy. The Act was not, however, drafted with AI-generated synthetic media in mind and does not expressly regulate the creation or dissemination of deepfakes.

Criminal protection is more targeted than is often assumed. Section 16 of the Cybercrimes Act 19 of 2020 criminalises the unlawful and intentional disclosure, by means of an electronic communications service, of a data message containing an intimate image of a person without that person’s consent. Significantly, the Act defines an intimate image as a depiction of a person that may be real or simulated and made by any means.¹⁶ A sexually explicit deepfake therefore does not escape liability merely because it was artificially generated. The Films and Publications Act 65 of 1996, as amended by the Films and Publications Amendment Act 11 of 2019, likewise prohibits the distribution of private sexual photographs and films without consent where the intention is to cause harm, although its focus on whether the underlying image was private is a limitation where a deepfake is built from publicly available photographs.¹⁷

Beyond the sexual context, victims must assemble remedies from general law. The Electoral Act 73 of 1998 prohibits the publication of false information intended to influence an election. The Protection from Harassment Act 17 of 2011 enables a victim to obtain a protection order against ongoing online harassment. At common law, the actio iniuriarum protects dignity, reputation, and identity: the Supreme Court of Appeal has confirmed that a person’s identity is protected against unauthorised exploitation, and the High Court has held that the use of a person’s likeness to suggest a false endorsement is actionable.¹⁸

C. The International Legal Framework

The regulation of deepfake technology has become an international concern, with many jurisdictions recognising that existing legal frameworks are insufficient to address the risks associated with synthetic media.¹⁹ Although no universally accepted framework currently governs deepfakes, several jurisdictions have introduced legislative and regulatory measures aimed at promoting transparency, protecting individual rights, and reducing the misuse of artificial intelligence.²⁰ These developments provide valuable guidance for South Africa as it considers future reform.

The European Union has adopted one of the world’s most comprehensive approaches to regulating artificial intelligence through the Artificial Intelligence Act.²¹ The AI Act introduces a risk-based regulatory framework and requires deployers of AI systems that generate or manipulate content constituting a deepfake to disclose that the content has been artificially generated or manipulated. A narrow exception applies where use is authorised by law to detect, prevent, investigate, or prosecute a criminal offence, and a lighter disclosure obligation applies where the work is evidently artistic, creative, satirical, or fictional.²² By promoting transparency, the Act seeks to reduce deception while preserving innovation and freedom of expression. It complements existing EU legislation, including the General Data Protection Regulation and the Digital Services Act, which strengthen the protection of personal data and impose responsibilities on online platforms to address illegal digital content.²³

In the United Kingdom, the government has adopted a combination of criminal and regulatory measures. The Online Safety Act 2023 places duties on digital platforms to minimise the dissemination of illegal and harmful material, and amended the Sexual Offences Act 2003 to criminalise the sharing of, or threat to share, intimate images without consent, expressly including deepfakes.²⁴ That reform addressed distribution but not creation. Section 138 of the Data (Use and Access) Act 2025 closed the remaining gap with effect from 6 February 2026, making it an offence to create, or to request the creation of, a purported intimate image of an adult without consent—an offence committed even where the image is never produced or shared.²⁵

The United States has moved along a similar path. The TAKE IT DOWN Act of 2025 became the first federal statute to criminalise non-consensual intimate deepfakes, and obliges platforms to remove reported content within forty-eight hours. At state level, Tennessee’s ELVIS Act of 2024 extended publicity rights expressly to AI-generated voice clones.²⁶ Taken together, these measures illustrate a clear international trend: general-purpose law is being supplemented, not replaced, by targeted statutory intervention.

III. Case Law Analysis

The emergence of deepfake technology has exposed significant challenges for courts worldwide. Because deepfakes are a relatively recent development, few judicial decisions have dealt directly with AI-generated synthetic media. Courts have consequently relied on existing principles relating to privacy, defamation, intellectual property, fraud, and freedom of expression to resolve disputes involving manipulated digital content.²⁷ Traditional legal doctrines remain relevant, but they are often inadequate to address the complexities presented by artificial intelligence.

One of the most influential decisions concerning AI-generated works is Thaler v Perlmutter, in which the United States District Court for the District of Columbia held that copyright protection under United States law requires human authorship and cannot extend to works created entirely by artificial intelligence. The Court of Appeals for the District of Columbia Circuit affirmed that holding in March 2025, and the Supreme Court declined to review the matter in March 2026.²⁸ Although the case did not concern deepfakes directly, it reaffirms that existing legal frameworks were developed on the assumption of human creativity and decision-making, and it illustrates the broader difficulty of applying traditional legal concepts to rapidly evolving AI technologies.

South African courts have not yet decided a case concerning AI-generated synthetic media, but they are not without relevant authority. In Le Roux v Dey, the Constitutional Court considered a digitally manipulated photograph depicting the deputy principal of a school in a compromising position, and upheld an award of damages on the basis that the publication injured his dignity and reputation.²⁹ The decision confirms that South African law already recognises the harm caused by fabricated imagery—although it also demonstrates the limits of a remedy that operates only after publication, and only where the author can be identified and sued.

In the United Kingdom, courts have generally addressed harms arising from manipulated digital content through established principles of privacy, misuse of private information, and defamation rather than AI-specific legislation.³⁰ The enactment of the Online Safety Act 2023 represents a legislative response to the increasing misuse of digital technologies, imposing greater responsibilities on online platforms to remove harmful content and protect users from abuse.³¹ Although the Act does not comprehensively regulate deepfakes, it reflects an acknowledgment that existing legal mechanisms require adaptation to address emerging technological threats.

IV. Critical Evaluation

The increasing sophistication of deepfake technology has exposed significant shortcomings in existing legal frameworks. Although South African law provides several remedies through constitutional rights, privacy legislation, cybercrime laws, and common-law actions, these mechanisms remain fragmented and reactive rather than preventative.³² Victims are often required to rely on multiple legal avenues to address a single incident, resulting in lengthy litigation, increased costs, and inconsistent outcomes.

The principal weakness of the current framework is not a complete absence of protection, but its uneven coverage. The Cybercrimes Act reaches sexually explicit deepfakes because its definition of an intimate image extends to simulated depictions.³³ That protection is nevertheless narrow in three respects. First, section 16 criminalises disclosure rather than creation, so a person who generates a non-consensual intimate deepfake commits no offence under that section until the content is shared—a gap the United Kingdom has now closed and South Africa has not. Second, the provision applies only to intimate images; political deepfakes, fraudulent voice clones, and fabricated endorsements must be forced into general offences such as cyber fraud, cyber extortion, or cyber forgery, which were not designed with synthetic media in mind.³⁴ Third, the Act contains no transparency, labelling, or platform takedown obligations of the kind now found in the European Union and the United States.

Similarly, although POPIA protects personal information and promotes the constitutional right to privacy, its application to AI-generated content remains uncertain.³⁵ Deepfakes frequently involve the unauthorised use of an individual’s facial features, voice, or likeness without necessarily processing personal information in the manner contemplated by the Act. Victims may therefore struggle to establish liability where synthetic content falls outside the traditional understanding of personal information, or where the creator of the deepfake cannot easily be identified.³⁶

The rapid dissemination of deepfakes through social media platforms presents a further difficulty. Harmful content can reach millions of users within hours, while legal proceedings often take months or years to conclude.³⁷ Victims may eventually obtain civil remedies or criminal sanctions, but those remedies frequently arrive after the reputational damage has become irreversible. That mismatch in timing is the clearest indication that existing mechanisms are largely reactive and fail to provide effective preventative protection. Addressing it requires more than incremental judicial interpretation; it requires legislative intervention of the kind considered below.

V. Recommendations

The analysis undertaken in this article shows that South Africa’s existing legal framework provides only fragmented protection against the harms caused by deepfake technology. Constitutional rights, common-law remedies, and legislation such as the Cybercrimes Act 19 of 2020 and the Protection of Personal Information Act 4 of 2013 offer meaningful recourse in particular situations, but they do not adequately address the challenges posed by synthetic media as a whole.³⁸ Legislative reform is accordingly necessary to ensure that the law remains responsive to technological developments while safeguarding fundamental rights.

First, Parliament should enact legislation that specifically defines and regulates deepfake technology. A statutory definition would provide greater legal certainty and enable courts to distinguish between legitimate uses of artificial intelligence—education, satire, artistic expression, and scientific research—and malicious uses intended to deceive, defraud, or harm.³⁹ Such legislation should identify clearly when the creation, publication, or distribution of a harmful deepfake constitutes a civil wrong or a criminal offence, and should extend beyond the intimate-image context to which existing criminal protection is largely confined.

Second, lawmakers should introduce mandatory transparency requirements for AI-generated content. Individuals and organisations that create or distribute synthetic media should be required to disclose clearly when content has been generated or materially altered through artificial intelligence, subject to limited exemptions for law enforcement and national security purposes, and to a proportionate obligation where the work is evidently artistic or satirical.⁴⁰ Such measures would reduce the risk of deception while preserving legitimate innovation.

Third, digital platforms should bear greater responsibility for malicious deepfakes circulated through their services. Platforms should be required to establish efficient reporting mechanisms, remove unlawful synthetic media promptly once notified, and cooperate with law enforcement in identifying those responsible. The forty-eight-hour removal obligation adopted in the United States offers a workable model of what promptness might mean in practice.⁴¹ Obligations of this kind would strengthen victim protection while promoting responsible digital governance.

These reforms should be pursued alongside, and not in place of, the national policy process already under way. Cabinet approved a draft National Policy on Artificial Intelligence for public comment in March 2026, although the draft was subsequently withdrawn after it emerged that parts of it relied on fabricated references generated by artificial intelligence.⁴² That episode is an instructive one for the present discussion: it demonstrates that the difficulty of distinguishing authentic from synthetic material is not confined to social media, and that the state itself is not immune to it.

VI. Conclusion

Deepfake technology represents one of the most significant legal challenges arising from the rapid advancement of artificial intelligence. While synthetic media offers substantial benefits for education, entertainment, healthcare, and innovation, its misuse has created serious risks to privacy, dignity, reputation, electoral integrity, and cybersecurity. The analysis undertaken in this article has shown that South Africa’s existing legal framework—including the Constitution, the Protection of Personal Information Act 4 of 2013, the Cybercrimes Act 19 of 2020, the Films and Publications Act 65 of 1996, and common-law remedies—provides important protections but remains fragmented, uneven, and inadequate in addressing the challenges posed by malicious deepfakes.⁴³

A comparative examination of international developments further illustrates that many jurisdictions have recognised the need for AI-specific regulatory measures to supplement traditional legal principles. The European Union’s Artificial Intelligence Act, the United Kingdom’s Online Safety Act 2023 and Data (Use and Access) Act 2025, and the United States’ TAKE IT DOWN Act provide useful examples of how transparency obligations, platform accountability, and targeted legislative intervention can strengthen protection against harmful synthetic media while respecting fundamental rights.⁴⁴

The question posed at the outset of this article therefore admits of a qualified answer. Existing legislation is not wholly insufficient: a victim of a sexually explicit deepfake in South Africa is not without recourse, and the common law has long protected dignity, reputation, and identity against fabricated depictions. What existing legislation cannot do is act quickly enough, reach widely enough beyond the intimate-image context, or impose the preventative obligations on creators and platforms that the technology now demands. Until Parliament addresses those three deficiencies directly, victims will continue to rely on remedies that arrive, if they arrive at all, long after the harm has been done.⁴⁵

Note(S):

1. Reuters, ‘Taylor Swift Deepfake Images Trigger Online Safety Debate’ (Reuters, 26 January 2024) <https://www.reuters.com/world/us/taylor-swift-deepfake-images-trigger-online-safety-debate-2024-01-26/> accessed 5 August 2026.
2. European Parliamentary Research Service, Deepfakes and Disinformation: Impact on Society and Fundamental Rights (European Parliament 2021) 7–15.
3. Constitution of the Republic of South Africa, 1996 s 14; Protection of Personal Information Act 4 of 2013; Cybercrimes Act 19 of 2020.
4. European Parliamentary Research Service (n 2) 1–8.
5. UNESCO, Guidance for the Governance of Digital Platforms (UNESCO 2023) 34–37.
6. Europol, Facing Reality? Law Enforcement and the Challenge of Deepfakes (Publications Office of the European Union 2022) 9–16.
7. Europol (n 6).
8. Europol (n 6).
9. South African Law Reform Commission, Discussion Paper 158: Project 94 – Privacy and Data Protection (SALRC 2023).
10. Constitution of the Republic of South Africa, 1996; Cybercrimes Act 19 of 2020; Protection of Personal Information Act 4 of 2013; Films and Publications Act 65 of 1996; Protection from Harassment Act 17 of 2011; Electoral Act 73 of 1998.
11. South African Law Reform Commission (n 9).
12. Constitution of the Republic of South Africa, 1996 s 14.
13. Constitution of the Republic of South Africa, 1996 s 16.
14. Protection of Personal Information Act 4 of 2013.
15. Protection of Personal Information Act 4 of 2013 ss 1, 99.
16. Cybercrimes Act 19 of 2020 s 16.
17. Films and Publications Act 65 of 1996, as amended by the Films and Publications Amendment Act 11 of 2019.
18. Grütter v Lombard 2007 (4) SA 89 (SCA); Kumalo v Cycle Lab (Pty) Ltd [2011] ZAGPJHC 56.
19. UNESCO, Recommendation on the Ethics of Artificial Intelligence (adopted 23 November 2021).
20. Organisation for Economic Co-operation and Development, OECD Digital Economy Outlook 2024 (OECD Publishing 2024).
21. Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act).
22. Artificial Intelligence Act (EU) 2024/1689 art 50(4).
23. Regulation (EU) 2016/679 (General Data Protection Regulation); Regulation (EU) 2022/2065 (Digital Services Act).
24. Online Safety Act 2023 (UK), amending the Sexual Offences Act 2003.
25. Data (Use and Access) Act 2025 (UK) s 138, amending the Sexual Offences Act 2003 (in force 6 February 2026).
26. TAKE IT DOWN Act 2025 (US); ELVIS Act 2024 (Tennessee).
27. European Parliamentary Research Service (n 2) 20–28.
28. Thaler v Perlmutter 687 F Supp 3d 140 (DDC 2023), affirmed No 23-5233 (DC Cir, 18 March 2025); certiorari denied (US Supreme Court, 2 March 2026).
29. Le Roux v Dey 2011 (3) SA 274 (CC).
30. NA Moreham and Sir Mark Warby (eds), Tugendhat and Christie: The Law of Privacy and the Media (3rd edn, Oxford University Press 2016).
31. Online Safety Act 2023 (UK).
32. Constitution of the Republic of South Africa, 1996; Cybercrimes Act 19 of 2020; Protection of Personal Information Act 4 of 2013.
33. Cybercrimes Act 19 of 2020 s 16(3)(b).
34. Cybercrimes Act 19 of 2020 ss 8–10, 16.
35. Protection of Personal Information Act 4 of 2013 s 1.
36. South African Law Reform Commission (n 9).
37. Europol (n 6).
38. Constitution of the Republic of South Africa, 1996; Cybercrimes Act 19 of 2020; Protection of Personal Information Act 4 of 2013.
39. South African Law Reform Commission (n 9).
40. Artificial Intelligence Act (EU) 2024/1689 art 50(4).
41. TAKE IT DOWN Act 2025 (US); Online Safety Act 2023 (UK).
42. Department of Communications and Digital Technologies, Draft National Policy on Artificial Intelligence (2026).
43. Constitution of the Republic of South Africa, 1996; Protection of Personal Information Act 4 of 2013; Cybercrimes Act 19 of 2020; Films and Publications Act 65 of 1996.
44. Regulation (EU) 2024/1689 (Artificial Intelligence Act); Online Safety Act 2023 (UK); Data (Use and Access) Act 2025 (UK); TAKE IT DOWN Act 2025 (US).
45. UNESCO (n 19).

Bibliography

Legislation

• Constitution of the Republic of South Africa, 1996.
• Cybercrimes Act 19 of 2020.
• Electoral Act 73 of 1998.
• Films and Publications Act 65 of 1996.
• Films and Publications Amendment Act 11 of 2019.
• Protection from Harassment Act 17 of 2011.
• Protection of Personal Information Act 4 of 2013.
• Data (Use and Access) Act 2025 (UK).
• Online Safety Act 2023 (UK).
• Sexual Offences Act 2003 (UK).
• Regulation (EU) 2016/679 (General Data Protection Regulation).
• Regulation (EU) 2022/2065 (Digital Services Act).
• Regulation (EU) 2024/1689 (Artificial Intelligence Act).
• ELVIS Act 2024 (Tennessee).
• TAKE IT DOWN Act 2025 (US).

Cases

• Grütter v Lombard 2007 (4) SA 89 (SCA).
• Kumalo v Cycle Lab (Pty) Ltd [2011] ZAGPJHC 56.
• Le Roux v Dey 2011 (3) SA 274 (CC).
• Thaler v Perlmutter 687 F Supp 3d 140 (DDC 2023), affirmed No 23-5233 (DC Cir, 18 March 2025).

Books

• Moreham NA and Warby M (eds), Tugendhat and Christie: The Law of Privacy and the Media (3rd edn, Oxford University Press 2016).

Reports and Policy Documents

• Department of Communications and Digital Technologies, Draft National Policy on Artificial Intelligence (2026).
• European Parliamentary Research Service, Deepfakes and Disinformation: Impact on Society and Fundamental Rights (European Parliament 2021).
• Europol, Facing Reality? Law Enforcement and the Challenge of Deepfakes (Publications Office of the European Union 2022).
• Organisation for Economic Co-operation and Development, OECD Digital Economy Outlook 2024 (OECD Publishing 2024).
• South African Law Reform Commission, Discussion Paper 158: Project 94 – Privacy and Data Protection (SALRC 2023).
• UNESCO, Guidance for the Governance of Digital Platforms (UNESCO 2023).
• UNESCO, Recommendation on the Ethics of Artificial Intelligence (adopted 23 November 2021).

News Reports

• Reuters, ‘Taylor Swift Deepfake Images Trigger Online Safety Debate’ (Reuters, 26 January 2024).