Deepfake legislation in 2026 is less about a single new global rule than about a patchwork that is only now taking shape. The clearest deadline comes from the EU, where the AI Act requires clear labels on covered deepfakes from August 2, 2026, and providers of generative AI must mark AI-generated content in a machine-readable format so it can be detected. That is a disclosure rule. It tells viewers what they are looking at, but it does not decide who controls the face or voice being copied. If you publish under your own name, that distinction matters more than the headlines suggest.
Across the Atlantic, the picture is narrower but more immediate for victims. The U.S. TAKE IT DOWN Act, enacted in May 2025, requires covered platforms to remove nonconsensual intimate depictions and to make reasonable efforts to take down known identical copies within 48 hours of a valid request. State laws and a proposed federal bill are moving in different directions. Which protections apply to your work depends on where you live and where your audience is, and the differences are larger than most people expect.
Key Takeaways
- If you are a victim of nonconsensual intimate deepfakes in the United States, the TAKE IT DOWN Act (Public Law 119-12, enacted May 19, 2025) already requires covered platforms to remove those depictions and make reasonable efforts to take down known identical copies within 48 hours of a valid request.
- The proposed NO FAKES Act of 2026 (Senate Bill 4591) was reported with an amendment on June 24, 2026, but it is still only a bill, so you should not rely on it in a takedown request or lawsuit until it passes both chambers and is signed.
- Under the EU AI Act, covered deepfakes must carry clear labels from August 2, 2026, but those labels only disclose AI origin and do not decide who controls your face or voice, so in the EU your leverage comes mainly from labelling and platform rules.
- Washington’s Substitute Senate Bill 5886, effective June 11, 2026, lets you treat your forged digital likeness as a commercial asset, because personality rights there can be transferred, assigned, or licensed.
- A creator-tier monitoring plan, which generally costs around $60 a month, can alert you to copies of your image, but that service cannot create a right you can enforce in court or pay you when someone misuses your likeness.
What Has Changed in Deepfake Law in 2026?
In 2026, deepfake law is changing fast, but there is still no single global system that gives you ownership or control over your digital likeness. Protection depends on where you live, where your audience is, and which harm is involved, so the rules form a patchwork rather than a unified standard.
In the United States, Washington moved first among the states this year. Substitute Senate Bill 5886, effective June 11, 2026, adds forged digital likeness to the personality-rights protections under state law and allows those rights to be transferred, assigned, or licensed. That last point matters if you earn money from your face or voice, because it treats your likeness as something you can deal with commercially, not only something you can complain about.
Maryland took a criminal route. Senate Bill 8 takes effect October 1, 2026, and prohibits specified harmful uses of AI or deepfake representations. Penalties reach five years in prison and a $10,000 fine when there is one victim, and up to 10 years and $15,000 when there are two or more victims.
At the federal level, the picture is less settled. The proposed NO FAKES Act of 2026 was reported with an amendment on June 24, 2026. It would create federal protections for individuals’ voice and visual likenesses, but it is still a bill, so it should not be treated as current law.
The United Kingdom has enacted new measures through the Crime and Policing Act 2026. Platforms must remove reported nonconsensual intimate images as soon as reasonably practicable and no later than 48 hours after a valid report. Some prosecution deadlines are extended to three years from the offence, or six months from the point sufficient evidence is available. Some provisions are still waiting to be commenced, so check the commencement dates before relying on them.
Queensland is moving in the same direction. On October 27, the state introduced the Criminal Code (Non-consensual Creation of Intimate Images and Audio Material) Amendment Bill 2026. It proposes a maximum prison term of three years for creating a nonconsensual intimate image or intimate audio, including material generated with digital technology. Because it is a bill, it is not yet in force.
Australia already has a federal offence in place. The Criminal Code Amendment (Deepfake Sexual Material) Act 2024 applies its transmission offences whether the material is unaltered or was created or changed using technology. The covered adult-material offence carries a maximum of six years’ imprisonment.
The scale of the problem explains why lawmakers are acting. The UK Government Office for Science reported that around eight million deepfakes were shared in 2025, compared with about 500,000 in 2023. A 2026 International AI Safety Report survey of more than 16,000 people across 10 countries found that 2.2% said someone had generated nonconsensual intimate images of them.
If you are weighing paid protection, keep the legal and commercial pieces separate. Entry-level monitoring tools can be free, while creator-tier plans generally cost around $60 a month. A monitoring feature can alert you to copies of your image, but it does not create a right you can enforce in court, and it does not pay you if someone misuses your likeness.
How Are US States and Congress Responding?
At the federal level, the TAKE IT DOWN Act is the enacted law you can point to, while the NO FAKES Act is still a bill. Individual states are writing their own rules, and those rules differ widely. The TAKE IT DOWN Act became law as Public Law 119-12 on May 19, 2025. “Enacted” means it has passed both chambers of Congress and been signed, so its platform duties are in force now rather than pending. If you have ever reported a nonconsensual intimate image and been ignored, this is the federal law that gives you a formal request to make. The NO FAKES Act of 2026, Senate Bill 4591, is a different situation. It was reported with an amendment on June 24, 2026, which means a Senate committee approved it with changes and sent it onward. It would create federal protections for individuals’ voice and visual likenesses, but it still has to pass the full Senate and the House and be signed before it becomes law. Until then, you cannot rely on it in a takedown request or a lawsuit.
A simple test can help you sort the two. An enacted law usually carries a public law number and an effective date, while a bill carries a number such as S. 4591 and a status showing where it sits in the legislative process. If a website describes a proposal as “the new rule,” check the official record before you act on it.
States have moved faster and in more varied directions. Washington has treated a forged digital likeness as part of personality rights, a civil route built around property you control. Maryland has taken a criminal approach, with penalties that rise when there are multiple victims. Those two choices show the range: one state gives you a claim you can bring, while another gives prosecutors a tool to pursue the person who created the material.
Because the state patchwork is so uneven, you will need to check more than one jurisdiction. Your state of residence may differ from where your audience lives, and the state where a platform’s servers sit may not match either. Trackers that follow state legislation on deepfakes can give you a starting point, but they summarize bills and enacted texts, so read the actual statute before relying on it. Pay attention to three things in each state: what kind of content is covered, whether the remedy is civil or criminal, and when the law takes effect.
What Penalties Do Deepfake Creators Face?
Deepfake creators can face prison terms, fines, or both, and the size of the penalty depends on the jurisdiction, the kind of material involved, and how many people were harmed. Penalties show how seriously a government treats the act itself, so it is worth comparing them before you assume your situation is covered.
Maryland’s approach shows how penalties can rise with harm. Senate Bill 8 sets a ceiling of five years and $10,000 where there is one victim, and up to 10 years and $15,000 where two or more people are harmed. If a single person’s likeness is misused, the exposure is lower than in a case that affects several people, and the law is written to reflect that difference.
Australia has the broadest federal reach in this comparison. The Criminal Code Amendment (Deepfake Sexual Material) Act 2024 applies its transmission offences whether the material is unaltered or was created or altered using technology. That means sharing a digitally modified image is treated under the same offence as sharing a genuine one.
Queensland is taking a different route. Its Criminal Code (Non-consensual Creation of Intimate Images and Audio Material) Amendment Bill 2026 focuses on the creation of the material, not only its sharing. It proposes a maximum prison term of three years for making a nonconsensual intimate image or intimate audio, including material generated with digital technology. Since this is still a bill, the final wording and penalty could change as it moves through parliament, so treat the three-year figure as a proposal.
The United Kingdom has focused on time limits as well as punishment. Under the Crime and Policing Act 2026, certain prosecution deadlines extend to three years from the date of the offence, or six months from the point when sufficient evidence is available. That matters because deepfakes are often discovered long after they were made, and a short limitation period could let a case expire before anyone realises the material exists. You can read the government’s explanation of these measures in its intimate image abuse factsheet.
Lawmakers are responding to the scale of the problem, and the numbers help explain why. The UK Government Office for Science estimated that around eight million deepfakes were shared in 2025, up from about 500,000 in 2023. That is a sharp rise over just two years, and it suggests that the volume of material has outpaced the informal ways people once dealt with it.
The personal dimension is just as striking. A 2026 International AI Safety Report cites a survey of more than 16,000 people across 10 countries, in which 2.2% said someone had generated nonconsensual intimate images of them. A percentage that small can still represent a large number of individuals once it is applied across populations the size of those countries.
For you as a creator, the key takeaway is that criminal penalties are only one part of the protection picture. A prison sentence or fine punishes the person who made the material, but it does not automatically remove copies from the internet or compensate you for the harm. Penalties also differ sharply by place. Conduct that carries a multi-year sentence in one jurisdiction might be treated as a civil matter in another, or be covered only by a proposal that has not yet become law. Before relying on any of these rules, check the statute itself, its commencement date, and whether the offence covers creating the material, sharing it, or both.
Do Platforms Have to Remove Deepfakes and Label Them?
Platforms do have to act in some cases, but the duty depends on the kind of content and the country where it appears. Some laws set firm removal deadlines for intimate images, while others focus on labels and machine-readable marking. Knowing which rule applies tells you what you can realistically ask a platform to do.
The fastest timelines apply to nonconsensual intimate images. Under the UK’s Crime and Policing Act 2026, a platform must remove a reported image as soon as reasonably practicable and no later than 48 hours after a valid report. Because the clock depends on a valid report, make your request specific. Include the exact web address, the account name, the date you found the material, and a short statement that the image was made or shared without the consent of the person shown.
The EU takes a different approach. The AI Act requires clear labels on covered deepfakes from August 2, 2026, and providers of generative AI must mark AI-generated content in a machine-readable format so it can be detected. A label tells the viewer that the content was made or altered by AI. It does not require the file to come down, and it does not establish who controls the face or voice in it.
Machine-readable marking works behind the scenes. An embedded mark lets detection tools recognize AI-generated material, which can make copies easier to find. The duty sits with the provider of the generative AI system, not with you, so you cannot demand that a mark be added to an image someone else has already posted.
Timing matters here too. For AI systems placed on the EU market before August 2, 2026, the marking and detection duty has a limited transition period that runs until December 2, 2026. A tool you come across this year may therefore produce content without a complete mark. The Code of Practice on Transparency of AI-generated Content is a voluntary compliance tool, so providers can choose to follow it. Signing up to it is not the same as a legal guarantee that your image will be taken down.
Labelling does not remove copies, and that is the gap that catches many creators. A label on one copy does nothing for the others, which is why the US rule asks platforms to make reasonable efforts to remove known identical copies. A label also does not identify the person who made the material, stop it from being reposted, or pay you for misuse. If you are a victim, the useful steps are practical. Save the web address, take dated screenshots, report each copy under the platform’s intimate-image or impersonation category, and keep a record of every response so you can show what was taken down and how long it took.
Can You Legally Control Your Own Digital Likeness?
Partly. In most places you cannot own your face or voice the way you own a song, but some jurisdictions give you a right to control commercial uses of your identity, and in Washington that right can now be passed to someone else. The answer depends on where you live, where your audience is, and what you want to control.
A personality right protects your name, likeness, and voice from being used for commercial gain without your permission. It is different from copyright. If you took a photo, you may own the copyright in that photo, but a deepfake built from your face may not copy that photo at all, which is why copyright alone often leaves you exposed.
Ownership, licensing, and assignment are three separate ideas. Ownership would mean full control over the right itself. An assignment hands that control to someone else, usually permanently. A licence is narrower: it gives another party permission to use your likeness in defined ways, for a set period, while you keep the underlying right. For most creators building a personal brand, a licence is the more useful tool because it lets you earn from your identity without giving it away.
Washington’s Substitute Senate Bill 5886 is the clearest recent example of transferability. It adds forged digital likeness to the state’s personality-rights protections and allows those rights to be transferred, assigned, or licensed. That means a creator there can treat likeness as a commercial asset rather than only a grievance.
Protection changes sharply across borders. A creator with a strong personality-rights claim in Washington may have only a takedown request or a criminal complaint elsewhere. Maryland’s Senate Bill 8, effective October 1, 2026, takes a criminal route instead, so the same deepfake could be a civil matter in one place and a prosecution in another.
The European Union works differently. The AI Act focuses on disclosure: covered deepfakes must carry clear labels from August 2, 2026, and generative AI providers must mark their output in a machine-readable form. That tells viewers what they are seeing. It does not give you a right to decide who uses your face, so in the EU your leverage comes mainly from labelling and platform rules rather than personal control.
The proposed NO FAKES Act of 2026, Senate Bill 4591, would create federal protections for voice and visual likenesses. It was reported with an amendment on June 24, 2026, but it is not law until it passes both chambers and is signed. Until then, do not write a contract or a takedown request that assumes it applies.
You can still use licensing terms as a brand strategy now. Specify the permitted media, the territory, the duration, and whether the licensee may sublicense. Decide in advance whether synthetic versions of your voice or face may be generated, whether AI training is allowed, and whether you must approve any edit. Add a payment structure tied to each use, a clear way to end the licence, and a requirement that the licensee report where your likeness appears. Vague terms are where creators lose control.
Which Protection Services and Insurance Options Are Worth Comparing?
Monitoring services and insurance can help you find misuse sooner and limit the financial fallout, but neither one gives you a legal right to your likeness. Their value depends on what they do after a copy is found, and on whether the law where you live gives you something to enforce.
Monitoring tools scan the web for copies of images, audio, or video you register with them, then alert you to possible matches. Pricing varies. Across the wider market, entry tiers are often free and creator-level plans generally cost around $60 a month, so that range is a useful benchmark when you compare options.
A monitoring feature does not do everything a reader might assume. It does not create a right you can enforce, it does not remove a file from a website, and it does not pay you if someone uses your likeness. A free tier may be enough to test whether the alerts are accurate, but it is unlikely to cover a full library of photos and clips.
The real comparison begins after a match. Ask each service whether it sends takedown requests for you or only tells you about the match. Ask whether it keeps a record of each detection, including the web address, the date, and the account name, and whether you can export that record. A service that stops at an alert leaves the hardest work to you.
Takedown success depends on the platform and the law behind the request. In the EU, a label on a copy does not stop that copy from spreading, so a label alone is not a removal. In the UK, a valid report starts a statutory clock, so a service that helps you write a complete, specific report can save you time that matters.
Legal recourse depends most on jurisdiction. In Washington, a forged digital likeness now falls under personality-rights protections, which means a claim may be civil and the right may be licensed or assigned to someone you trust. In Maryland, the route is criminal, so you report the conduct to the authorities rather than filing a claim yourself. A monitoring service cannot tell you which route fits your case, but a lawyer in the relevant state can.
Insurance for deepfake harm is a newer and less standardized product, so read the policy wording before you assume anything is covered. Check whether the policy names digital impersonation or reputational harm, whether it pays legal defense costs or only third-party liability, what the exclusions are, and how quickly you must notify the insurer after discovering a problem. Then check the jurisdiction. A policy written under one country’s law may respond differently to a claim involving a platform or audience in another.
Documentation links all of these options together. Keep a dated log of every copy you find, with the web address, screenshots, account names, and every response from a platform or authority. That log supports a takedown request, a police report, a civil claim, and an insurance claim alike, so a monitoring service that helps you keep it is worth more than one that only sends alerts.
When you weigh cost against rights, start with the harm you most want to prevent. A monthly plan that finds copies quickly may be worth more to you than an expensive policy with narrow wording, and a licence you draft yourself may earn more than either. Before you pay for any service or policy, test it against that one scenario and see what you would actually receive.
How Are Political and Minor-Related Deepfakes Treated?
Political deepfakes and synthetic media involving minors raise concerns of their own, and the rules that cover them are not uniform from place to place. Before relying on any specific rule, read the enacted text in each place where your content reaches an audience, because a summary may leave out exceptions or effective dates.
Synthetic media involving minors raises its own concerns, and a deepfake of a young person may be treated differently from one involving an adult. If you create content with or about young people, check whether your local law adds penalties beyond the general offence.
Penalties also tend to rise with the size of the harm or the kind of material involved. Maryland’s Senate Bill 8 is the clearest example here: the ceiling is five years and $10,000 for one victim, and 10 years and $15,000 for two or more. Queensland’s proposed amendment ties its three-year maximum to the nature of the material, namely a nonconsensual intimate image or intimate audio, including material made with digital technology. Because it is only a bill, confirm the final wording before you rely on it.
Evidence matters as much as the penalty. Investigators need to establish whether a file is authentic or was altered, and that question is easier to answer when the content carries a machine-readable mark. The EU AI Act requires providers of generative AI to mark AI-generated content so it can be detected, which gives investigators a practical starting point when they trace a file. Keep original files, any available metadata, and dated copies of every version you find, because a re-compressed or stripped copy is much harder to trace back to its source.
Choosing Your Protection Path for 2026
Start by naming the one harm you most want to prevent. A creator whose face appears in fake sponsorship ads faces a different problem than a performer whose voice is cloned, and the right protection follows from that choice.
Then take three practical steps this month. First, list every place where you live, work, or reach an audience, and read the enacted text for each. If Washington is one of them, confirm you are reading the version of Substitute Senate Bill 5886 that took effect on June 11, 2026. If Maryland is one of them, mark October 1, 2026 on your calendar, because Senate Bill 8 does not take effect until then.
Second, build your evidence file before you need it. A simple spreadsheet with columns for the web address, the date you found the copy, the account name, a screenshot, and the platform’s response will do. Keep your original photos and recordings with their metadata intact.
Third, if you plan to license your likeness, draft the terms yourself and have a lawyer in the relevant state review them before you sign. If you are also considering a monitoring tool, test its free tier, if one exists, on your most important files. Check whether it sends takedown requests for you or only sends alerts, because that difference will decide how much work lands on you.
Frequently Asked Questions
1. Can I use the TAKE IT DOWN Act to remove a non-intimate deepfake of me?
No. The federal takedown duty under the TAKE IT DOWN Act covers nonconsensual intimate visual depictions, not deepfakes in general. For other likeness misuse, you would need a state personality-rights claim where one exists, or a platform’s impersonation report. The proposed NO FAKES Act would address voice and visual likeness only if it becomes law.
2. Does the TAKE IT DOWN Act apply to deepfakes on small personal websites?
The Act places its duties on covered platforms, so whether a small personal site falls within that term depends on how the statute defines it. You can check the wording in Public Law 119-12 on GovInfo before assuming your site is covered or exempt. Either way, keep a dated record of every request you send in case the site’s obligations are later disputed.
3. Do free monitoring plans find deepfakes posted on websites outside the United States?
Coverage varies by service, so check the provider’s own list of platforms and countries it scans before you rely on a free plan. Even when a copy is found abroad, the removal duty you can invoke depends on that country’s law, such as the UK rule for reported intimate images. A free plan can alert you to a copy, but it does not give you the legal power to remove it.
4. What should I do if a deepfake of me appears in a state that has no specific deepfake law?
If the material is a nonconsensual intimate image, start with the federal TAKE IT DOWN Act, since its platform duties apply regardless of state. Report each copy under the platform’s intimate-image or impersonation category and keep a dated record of every response. Then check whether your state or the state where your audience lives has a civil personality-rights or criminal law that could reach the conduct, and ask a lawyer in that state which claim fits.
