A plain-English round-up of the deepfake laws now shaping platform duties in the UK, US and EU — what each requires, who enforces it, and what to build.
Photo via Unsplash
Ask a founder which deepfake laws apply to their platform and you usually get one statute name, confidently. There are at least nine distinct obligations in play across the UK, US and EU right now, arriving from four different directions, enforced by different bodies with different remedies.
This is the round-up, in plain English. Each entry covers what it requires, who enforces it, and the single thing to build in response. It is written for teams who need to make architecture decisions this quarter rather than for lawyers.
Key takeaways
- Four families: intimate-image offences, removal duties, transparency rules, publicity rights.
- The overlapping core is small — prevent, remove fast, evidence both.
- Labelling satisfies the least demanding family and none of the others.
- "A user did it" is no longer a complete answer anywhere that matters.
- Build notice-and-removal plus authorisation records first. Everything else is cheaper afterwards.
Requires: risk assessment, illegal-content duties, children's safety duties, highly effective age assurance for pornographic content, and reporting routes usable by non-users. Enforced by: Ofcom. Teeth: up to £18m or 10% of qualifying worldwide revenue, plus business disruption powers aimed at payment providers. Build: a fail-closed age gate and a reporting route that works without an account. Full detail in the OSA deep-dive. Text at legislation.gov.uk.
Requires: the UK has progressively criminalised sharing intimate images without consent and has extended into the creation of sexually explicit synthetic images of identifiable people. Enforced by: police and prosecutors, not a regulator. Teeth: criminal liability for individuals; platforms feel it through the illegal-content duties above. Build: platform-wide prohibitions that no user setting can switch off. LikeWard has four, and they are evaluated before creator rules and before the age gate.
Requires: a published notice channel, removal of reported non-consensual intimate imagery within 48 hours of a valid request, and reasonable efforts to remove known identical copies. Enforced by: the FTC, as an unfair or deceptive practice. Teeth: civil penalties, per violation. Build: a takedown queue somebody can actually resolve, with timestamps. Detail in the compliance guide; bill text at congress.gov.
Requires: varies — many states criminalise non-consensual intimate imagery and have extended to synthetic depictions. Enforced by: state prosecutors; several statutes also create civil claims. Teeth: criminal and civil, with private litigation the harder one to predict. Build: the same prohibitions as above. State-by-state variation rarely changes what you build, only how bad the worst outcome is.
Requires: consent to commercial use of a person's name, image or likeness — with several states now addressing AI-generated replicas specifically, including in employment and performance contexts. Enforced by: private parties. This is a litigation risk, not a regulatory one. Teeth: damages, injunctions, and the legal costs of being right slowly. Build: documented, scoped, revocable consent. A generic release does not scope anything, which is the argument we made in the card network guide.
Search interest here is genuinely tiny — "right of publicity AI" runs at roughly 10 US searches a month on Keyword Planner data from August 2026 — which tells you it is a lawyer's term rather than an operator's. The exposure is not tiny.
Requires: disclosure or prohibition of synthetic political content in defined windows before elections, in a growing number of jurisdictions. Enforced by: election authorities and state AGs. Teeth: varies; reputational exposure often exceeds the legal penalty. Build: treat political endorsement as a first-class refusable category rather than a moderation edge case. It is one of the most commonly forbidden depictions creators select, for good reason.
Requires: disclosure that content is artificially generated or manipulated, with deepfakes named specifically, plus machine-readable marking obligations for providers of generative systems. Enforced by: national authorities under the EU framework. Teeth: administrative fines on the EU scale. Build: labelling and machine-readable provenance. Labelling alone satisfies this entry and nothing else on the list — see the watermark versus provenance comparison.
Requires: notice-and-action mechanisms, risk assessments for large platforms, and protection of minors. Enforced by: the European Commission and national coordinators. Teeth: up to 6% of global turnover for the largest platforms. Build: the same notice-and-action pipeline the TAKE IT DOWN Act requires. Build once.
Requires: documented consent from every identifiable person, verified age, pre-publication review, complaints handling, and removal within a stated window. Enforced by: acquirers, on behalf of the networks. Teeth: loss of payment processing — faster and more terminal than any fine here. Build: a retrievable per-output consent record. Detail in the card network consent rules guide.
Rather than reading nine statutes, answer five questions about your product. Each one switches a group of obligations on or off.
Do users encounter content created by other users? If yes, entries 1 and 8 attach, and entry 3 almost certainly does. This is the broadest trigger on the list and the one teams most often talk themselves out of.
Can output depict an identifiable real person? If yes, 2, 4 and 5 come into play. Note that identifiability rather than naming is the test, so "we never used anyone's name" does not answer it.
Is any of that output intimate or sexual? If yes, 2, 3, 4 and 9 all bite at once, and 9 — the card networks — will reach you first.
Do you serve the UK, the US or the EU? Practically everyone answers yes to at least one, and reach rather than incorporation is what counts.
Do you take card payments for any of it? Then entry 9 applies regardless of what the statutes say, because your acquirer's contract is enforceable without a hearing.
A platform answering yes to the first three is looking at seven of the nine, which sounds worse than it is — the controls overlap heavily, as the table below shows.
Nine obligations, one small core:
| Control | Satisfies |
|---|---|
| Refuse before producing | 1, 2, 4, 6 |
| Notice-and-removal pipeline, non-users included | 1, 3, 8, 9 |
| Per-output authorisation record | 3, 5, 9 |
| Age assurance, fail-closed | 1, 9 |
| Labelling and machine-readable marking | 7 |
| Non-waivable prohibitions | 2, 4, 6 |
Table: six controls mapped against the nine obligations above. Notice-and-removal and the authorisation record between them touch six of the nine, which is why they come first.
Our compliance desk's rule of thumb:
"Nobody has ever been sanctioned for having too good a removal pipeline. Build that, build the record of what authorised each output, and most of the list stops being nine problems and starts being one."
The uncomfortable part is that none of this is satisfied by policy documents. Every entry above asks for a capability you can demonstrate — which is the whole reason content provenance keeps turning up as the answer to questions that were not obviously about metadata.
Where to go next: the TAKE IT DOWN Act compliance guide for the tightest deadline on the list, the age verification law round-up for the fastest-moving area, or LikeWard's compliance position for how one platform implements the overlap.