Authored By: Kgauhelo Selebano
University of Johannesburg
Introduction
In 2024, a well known South African news anchor’s voice was manipulated using generative artificial intelligence to promote fraudulent trading apps on social media.[1] Shortly after, a realistic deepfake of a business figure was used to lure citizens into a financial scam. These incidents are not just random occurrences, they serve as early warnings of a looming digital exception era. Face changing AI supported by evolving models that can create convincing faces, expressions and voices, now generates scams that are visually and audibly convincing. The technology’s dual nature; allowing for creative expression and enabling malicious impersonation, highlights gaps in South Africa’s legal framework. This article argues that although the Constitution and the Protection of Personal Information Act 4 of 2013(POPIA) provide a solid foundation for privacy and dignity, the current laws drastically fail in addressing the unique mechanics and scale of threats posed by identity technologies.[2] Closing this gap will require focused statutory reforms, increased accountability for platforms and enhanced technical capabilities for regulators and law enforcement.
South Africa’s Constitutional and Statutory Framework
(A) Constitutional framework
The legal landscape in South Africa is rooted in its constitutional framework, which recognizes privacy as a fundamental right. Section 14 specifically guards against the unlawful collection, retention and use of personal information, while section 10 upholds human dignity and Section 16 champions freedom of expression.[3] These principles have been further defined through the Constitutional Court, emphasizing that dignity is at the heart of our constitutional order and that privacy protections safeguard the “inner sanctum” of individuals.[4]
(B) Statutory framework
On the statutory side, the POPIA regulates how personal data is processed, categorizing biometric information as “special personal information” that requires stricter safeguards and limited processing options.[5] The Cybercrimes Act addresses various online threats, including fraud, identity theft and the non consensual sharing of intimate images and it even considers “simulated” representations.[6] The RICA Act oversees interception and access to communications, while other legal frameworks, such as criminal procedure rules, classification systems, and common-law delicts such as defamation and invasion of privacy, offer additional protections.[7] The Constitutional Court’s privacy rulings, particularly in cases like Case and Another v Minister of Safety and Security and Curtis v Minister of Safety and Security, highlight the boundaries of state interference in personal autonomy and private property.[8]
Together, these legal instruments create a protective framework. However, they were not designed for a reality where synthetic faces and voices can be easily created, shared worldwide in an instant and used to bypass biometric security or fabricate convincing evidence of consent.
III. How face changing AI reveals gaps in our legal and enforcement systems
Scams and identity fraud are now on the rise, and with deepfakes, a new wave of financial fraud has emerged. Fraudsters can use voice cloning and face synthesis to impersonate bank officials, family members, or even public figures, all to extract money or sensitive information. Traditional anti-fraud measures like transaction monitoring, two-factor authentication and biometric checks are becoming less effective, especially when the biometric signals can be easily faked. The legal challenges here are two-fold in nature: first, there’s an issue of attribution, like tracing synthetic media back to its creator and second, the speed at which these scams spread, often outpacing criminal investigations. While civil remedies and common law actions are still options, they tend to be slow, costly and often out of reach for everyday victims. The Supreme Court of Appeal’s acknowledgement of personality-based delicts in Grutter v Lombard shows that a civil law path exists, but it also shows how there are evidentiary challenges in the digital space.[9]
When it comes to non-consensual intimate imagery (NCII) and defamation, the Cybercrimes Act’s ban on sharing simulated intimate images is a significant step forward. However, enforcement is complicated by issues like delays in content taken down by platforms and difficulty of proving non-consent when the content is publicly accessible. Victims often find themselves in a game of “whack a mole”, because removing content on one site does not stop it from being reposted on another site and pursuing criminal charges becomes close to impossible as perpetrators can just make their accounts anonymous.
Policing, surveillance and algorithmic risk are among the most debated topics these days. Law enforcement’s growing interest in biometric tools, like facial recognition, automated matching with government databases and detecting synthetic media, brings up serious constitutional issues. When biometric searches are conducted without strong judicial oversight, they can lead to false positives and racial discrimination. Research shows that many facial recognition systems struggle with darker skin tones, which increases the risk of misidentification in South Africa’s diverse population.[10] Laws like RICA and other surveillance regulations need to be updated to ensure that any invasion of privacy is backed by clear warrant standards, independent oversight and the ability to audit. South African privacy and surveillance law stresses that any intrusive powers exercised by the state must be justified, proportionate, and accompanied by proper safeguards.
When it comes to mass data collection and training models, the datasets that “empower” face changing mechanisms are often gathered by scraping public social media profiles and image repositories. This kind of mass collection often goes against the purpose limitation and consent principles outlined in POPIA. And this means that users who share images for social interaction do not agree to have their likeness used to train synthetic AI models.[11] While the Information Regulator’s guidance on prior authorization and high-risk processing is important, the reality is that enforcement and technical capabilities are still quite limited.
Suggested Legal Reforms
Establish a secure registry that holds verified likenesses of public figures who have consented, along with authorized spokesperson channels, making it easier to spot impersonation. Public figures and institutions can voluntarily enroll; cryptographic attestations will be issued upon registration and limited access for law enforcement and platforms will be granted under warrant, with audit logs being published quarterly.
Treat extensive biometric datasets as if they are held in fiduciary trusts, managed by licensed stewards who must adhere to governance, audit and benefit sharing obligations.[12] A licensing system for dataset custodians; a mandatory public register detailing dataset purpose and penalties will be enforced for unauthorized resale or cross-border transfers.
Mandate that commercial users of biometric matching maintain remediation bonds or insurance to fund relief for victims for services such as identity restoration, counselling, and financial losses when misidentification or synthetic impersonation leads to harm. This can be achieved through a set minimum bond level based on the scale of deployment. Insurers will then create forensic claim processes and regulators will publish claims data to guide policy decisions.
Conclusion
South Africa’s Constitution and POPIA lay down strong principles regarding privacy, dignity and freedom of expression. However, the unique nature of face-changing AI and its ability to mimic human identities quickly and on a large scale reveals significant gaps in both doctrine and enforcement. This could turn our constitutional protections into mere “justice on paper”. To address this, we need a response that focuses on harm and is informed by technology: we should classify biometric processing as high risk, make the creation of malicious synthetic identities a crime, ensure judicial oversight of biometric surveillance, require clear provenance and quick takedown of harmful content on platforms and empower regulators with the tools they need for forensic analysis. These reforms will help maintain a space for genuine creativity and innovation, safeguarding individuals from the new and damaging threats posed by digital deception. The urgency of this task cannot be overstated, if we do not adapt our laws effectively, the right to truly be oneself could be undermined by the very technologies that are meant to enhance human expression.
Bibliography
Constitution
Constitution of the Republic of South Africa, 1996.
Legislation
Protection of Personal Information Act 4 of 2013
Cybercrimes Act 19 of 2020
Regulation of Interception of Communications and Provision of Communication‑Related Information Act 70 of 2002 (RICA)
Take It Down Act of 2025, H.R. ___, 119th Cong. (2025).
Cases
S v Makwanyane and Another, 1995 (3) SA 391 (CC).
Bernstein and Others v Bester NO and Others, 1996 (2) SA 751 (CC).
Case and Another v Minister of Safety and Security; Curtis v Minister of Safety and Security, 1996 (3) SA 617 (CC).
Grütter v Lombard and Another, 2007 (4) SA 89 (SCA).
Secondary sources
Information Regulator (South Africa), Guidance Note on Application for Prior Authorisation (Mar. 11, 2021).
Proposal for a Regulation Laying Down Harmonised Rules on Artificial Intelligence (EU AI Act) (Draft 2023).
Leo S.F. Lin, Examining the Role of Deepfake Technology in Organized Fraud: Legal, Security, and Governance Challenges, 4 Frontiers in L. 6 (2025).
Nomalanga Mashinini, Deepfakes and South African Law (Wits Univ. Research Paper, Oct. 3, 2025).
Pumeza Ndobeni, Legal Implications of the Misuse of Deepfakes on SA Social Media Platforms, De Rebus 30 (Apr. 1, 2026).
[1] Coalition for Women in Journalism, ‘South Africa: Crypto Scam Features Deepfakes of TV Anchors Bongiwe Zwane and Francis Herd’ (Coalition for Women in Journalism, [date of publication]) <https://www.womeninjournalism.org/threats-all/south-africa-crypto-scam-features-deepfakes-of-tv-anchors-bongiwe-zwane-and-francis-herd> accessed 5 August 2026
[2] Constitution of the Republic of South Africa, 1996
[3] Ibid 45
[4] S v Makwanyane [1995] SA 391
[5] Protection of Personal Information Act 2013
[6] The Cybercrimes Act 2020
[7] Regulation of Interception of Communications and Provision of Communication-Related Information Act 2002
[8] Case and Another v Minister of Safety and Security; Curtis v Minister of Safety and Security [1996] SA 617
[9] Grütter v Lombard and Another, [2007] SA 89
[10] Nomalanga Mashinini, Deepfakes and South African Law (Wits Univ. Research Paper, Oct. 3, 2025).
[11] Information Regulator (South Africa), Guidance Note on Application for Prior Authorisation (Mar. 11, 2021).
[12] Leo S.F. Lin, Examining the Role of Deepfake Technology in Organized Fraud: Legal, Security, and Governance Challenges, 4 Frontiers in L. 6 (2025).
