Deepfake Law in the United Kingdom
The UK criminalizes sharing, threatening to share, creating, and requesting non-consensual intimate deepfakes through the Online Safety Act and Data (Use and Access) Act framework.
- Status
- enacted
- Jurisdiction
- United Kingdom
- Effective
- Jan 2024
- Statute
- Online Safety Act 2023 + Data (Use and Access) Act 2025
The United Kingdom has one of the more assertive regulatory frameworks for deepfakes among Western democracies. The Online Safety Act 2023 criminalized sharing and threatening to share intimate deepfake imagery; section 138 of the Data (Use and Access) Act 2025 went further by criminalizing creation or requesting creation even without distribution.
Key provisions
Online Safety Act 2023 (effective January 2024). Sharing non-consensual sexual deepfake imagery is a criminal offense carrying up to two years' imprisonment. Platforms bear duty-of-care obligations enforced by Ofcom — including proactive detection and removal. Platforms failing to comply face fines up to £18M or 10% of global revenue.
Data (Use and Access) Act 2025, section 138. Added the creation/request offense — making or requesting a purported intimate image of an adult without consent is itself criminal, independent of whether it is shared. The offense came into force on February 6, 2026. This is among the most aggressive positions in any jurisdiction.
Electoral law. Existing false-statement offenses in the Representation of the People Act 1983 apply to deepfakes. Electoral Commission rules require paid political content to be clearly identified, including AI-generated content.
Fraud Act 2006. Deepfake-enabled fraud (impersonation, CEO scam calls) is prosecutable under existing fraud statutes.
Ofcom enforcement
Ofcom, the UK communications regulator, is the primary enforcement body for the Online Safety Act. Active areas in 2026:
- Mandatory risk assessments for large platforms covering deepfake content.
- Proactive detection obligations — platforms must demonstrate detection capability, not just reactive takedowns.
- Fines and executive liability for non-compliance.
Practical implications
For UK-based organizations:
- Platforms: duty-of-care obligations under OSA include proactive deepfake detection. Ofcom compliance expectations are rising.
- Individuals: creation of non-consensual sexual deepfakes is criminal. Possession prosecutions have begun.
- Political actors: deepfake content in electoral contexts falls under both electoral law and OSA; dual liability risk.
- Financial institutions: Fraud Act prosecution paths apply; UK Financial Conduct Authority expectations on fraud prevention now include deepfake-specific controls.
Enforcement trajectory
The creation/request offense is now live, and CPS guidance treats purported intimate images, including AI-generated images, as part of the communications-offense framework. The UK framework is often cited in other jurisdictions' legislative debates as a reference model.