Deepfake Law in the Netherlands

The Netherlands regulates deepfakes through the EU AI Act combined with specific provisions of the Dutch Criminal Code (Wetboek van Strafrecht) and GDPR enforced by the Autoriteit Persoonsgegevens (AP).

Key provisions

EU AI Act. Directly applicable. The AP is the lead supervisory authority for AI compliance in the Netherlands.

Criminal Code Article 139h — Non-consensual sexual imagery. Introduced 2020 and expanded in 2024 to explicitly cover AI-generated sexual content of identifiable persons. Penalties up to two years; aggravated for minors up to six years.

Article 240b — Child sexual abuse material. Covers AI-generated CSAM; penalties up to four years (unaggravated) to eight years (aggravated).

Article 261 — Defamation. Deepfakes that falsely attribute statements or actions are prosecutable under standard defamation law.

Article 262 — Libel. Aggravated form of defamation involving knowingly false statements.

AP enforcement

The AP has been particularly active on AI-generated content:

• Guidance published on generative AI and GDPR compliance.
• Several investigations into deepfake services and non-consensual imagery distribution.
• Cooperation with Belgian and German DPAs on cross-border cases.

Cybercrime prosecution capacity

The Netherlands has a specialized cybercrime prosecution team within the Public Prosecution Service (Openbaar Ministerie) that handles deepfake cases. The Hague and Amsterdam courts have heard a number of deepfake-related prosecutions since 2023.

Practical implications

For organizations operating in the Netherlands:

• AI service providers: AP compliance is expected; strong guidance framework supports clear compliance paths.
• Platforms: NL-specific obligations layered on top of Digital Services Act and AI Act.
• Enterprises: moderate-to-high compliance burden relative to other EU member states, but enforcement is predictable and well-documented.

Related reading

• EU deepfake laws
• Germany deepfake laws
• Ireland deepfake laws