No Justice for the Deepfaked

Laws are crucial for addressing deepfakes because they can govern the creation, distribution, and malicious use of deepfakes. Legislation provides a framework to combat this growing threat. Clare McGlynn, a law professor specialising in issues related to pornography and online abuse, emphasises the critical role of legislation in shaping societal norms – it not only deters individuals from creating deepfakes but also sends a clear message about the wrongfulness and harm of such activities. However, the evolution of deepfake technology is outpacing the ability of legal systems to keep up. In the US, no federal legislation currently exists to address the potential threats of deepfakes (Princeton Legal Journal, 2023). In the EU as well, there is no law specifically addressing the regulation of deepfakes (van der Sloot & Wagensveld, 2022). 

Last year, NBC reported what happened to internet celebrity QTCinderella who was the subject of hundreds of deepfake pornography videos. She was advised that she would not be successful in taking legal action against the person(s) who had stolen her likeness due to lack of existing legislation. This is not only true for celebrities – only a few months ago GQ reported the case of Owen, a victim of deepfake sextortion: “All they [the police] told me to do was ignore the scammers, even if they harass me non-stop. I can’t do anything about it.” The feeling of hopelessness Owen experienced at the time is widespread among victims of deepfakes, who lack legal protection. The negative consequences of sextortion are exacerbated in the case of deepfakes, because often the police are not actively trying to find the perpetrator (Leukfeldt, Notté, & Malsch, 2019). 

This does not mean that a victim has zero recourse: they can potentially bring defamation or harassment lawsuits. But deepfakes are typically posted and consumed by anonymous users, making redressability difficult, if not impossible. Moreover, monetary compensation would not undo damage to mental well-being and reputation. In the EU, the General Data Protection Regulation  (GDPR) is generally strict about privacy, but when deepfakes merge images or voices of two or more persons, it is unclear whether the final result would also be subject to the law (van der Sloot & Wagensveld, 2022). Even if citizens have rights through which they can block or remove unlawful content, in practice, it is hard to get platforms to remove content, let alone prevent copies from being shared on other parts of the internet. Legal proceedings often cost money and time that the average person does not have, and may even attract more attention to the content they want removed. 

Clearly, stricter and more specific laws are needed. Why does that present such a challenge? Recently, the Dutch Ministry of Justice and Security commissioned a report on the legal challenges of deepfakes. They found a number of difficulties in developing and enforcing laws for deepfake sextortion. First, technology develops rapidly, so technology-specific rules become outdated quickly. Another paper by Yönt (2024) discussing the ‘deepfake menace’ also points out that many judges, prosecutors and lawyers find it difficult to understand technological crimes. Second, due to the cross-border nature of technology, parties are often subject to multiple legal regimes, and tend to locate in the jurisdiction with the lowest regulatory burden. This too was backed by Yönt (2024) – laws are made nationally, while deepfakes are borderless. Third, there is a complex web of parties involved with the production and distribution of deepfakes, and it is not always clear who can be held accountable. Yönt (2024) added that the anonymity of many malicious actors makes them difficult to trace. 

Given this legal situation, one can no doubt imagine the overwhelming helplessness that a victim would experience. Leukfeldt et al. (2019) found that when threats are carried out online, their consequences are aggravated. This is because the online space is more omnipresent, and victims feel that nowhere is safe and that their only option is to withdraw from society altogether. When such crimes go unpunished, victims continue to live in fear, vulnerability and distrust (Altholz, 2020; Morris & Scott, 2022). In the case which GQ reported, Owen said that he “was lost for words” and “wanted to bury [himself] alive.” For months, he was scared to leave his house, fearing that people might have seen the video and recognise him. Another victim reported last November by The Times of India was left “mentally disturbed” and was considering suicide. Many such victims experience trauma guilt and emotional dysregulation, both of which mediate PTSD and depression levels (Holladay, 2016). 

Even the family members of victims are at increased risk for depression, anxiety, and PTSD due to the lack of closure and resolution (Altholz, 2020; Connolly & Gordon, 2015; Mastrocinque, et al, 2015). Without legal protection, a victim’s fear and uncertainty turn into strong feelings of anger, frustration, general distrust, and hopelessness (Altholz, 2020; Connolly & Gordon, 2015; Reed & Caraballo, 2022). Victims also find themselves coping with feelings of blame, resentment, and guilt – all of which puts additional strain on their relationships (Armour, 2002; Connolly & Gordon, 2015).

Lives, careers, and relationships can be ruined, all with just a decently powerful computer. If left unchecked, deepfakes can lead to cybercrimes with life-wrecking consequences that are unfortunately, all too real.