computer law & security review 46 (2022) 105716

Available online at www.sciencedirect.com

journal homepage: www.elsevier.com/locate/CLSR

Deepfakes: regulatory challenges for the synthetic

society

Bart van der Sloot∗, Yvette Wagensveld

Tilburg Institute for Law, Technology & Society, Tilburg University

a r t i c l e i n f o a b s t r a c t

Keywords: With the rise of deepfakes and synthetic media, the question as to what is real and what is
Deepfake not will become increasingly important and politized. Deepfakes can be used to spread fake
synethetic media news, influence elections, introduce highly realistic fake evidence in courts and make fake
post-truth era porno movies. Each of these applications potentially has a big impact on society, social re-
Privacy lationships, democracy and the rule of law. The question this article shall assess is whether
freedom of expression the current regulatory regime suffices to address these potential harms and if not, which
rule of law additional rules and principles should be adopted. It will discuss several potential amend-
democracy ments to the privacy and data protection regime, limitations to the freedom of expression
social equality and ex ante rules on the distribution of use of deepfake-technologies.
fake news © 2022 Bart van der Sloot and Yvette Wagensveld. Published by Elsevier Ltd.
non-consensual fake porn This is an open access article under the CC BY license
(http://creativecommons.org/licenses/by/4.0/)

for a few years; its quality has improved dramatically since

1. Introduction then.2

A deepfake is content (video, audio or otherwise) that is wholly

or partially fabricated or existing content (video, audio or
otherwise) that has been manipulated. There are currently
dozens of apps on the market that citizens can download, for
example, to portray themselves in a well-known Hollywood
film, to put words in the mouths of politicians or friends or
to generate their own version of the CNN news bulletin.1 Fa- Using Artificial Neural Networks, which are based on ’real’
cial expressions can be manipulated per frame, pitch, timbre or biological neural networks that, systems can learn how to
and language can be adjusted; identities of two or more people
can be merged, for example by fusing the faces of two people
or by giving a figure the face of a well-known person and the
voice of another. Deepfake technology has only been around
2
Feng, J. et al. (2020). Generative adversarial networks based
on collaborative learning and attention mechanism for hyper-
spectral image classification. Remote Sensing, 12(7), 1149. Goyal
S. (2019). GANs — A Brief Introduction to Generative Adversar-
ial Networks. Medium. <https://medium.com/analytics-vidhya/
∗
Corresponding author. gans- a- brief- introduction- to- generative- adversarial- networks-
E-mail address: b.vdrsloot@uvt.nl (B. van der Sloot). f06216c7200e>. Last accessed 14 March 2022. <https://meraju.
1
<https://beebom.com/best- deepfake- apps- websites/>. Last com/fakelab- a- deepfake- audio- detection- tool/>. Last accessed
accessed 14 March 2022. 14 March 2022.

https://doi.org/10.1016/j.clsr.2022.105716
0267-3649/© 2022 Bart van der Sloot and Yvette Wagensveld. Published by Elsevier Ltd. This is an open access article under the CC BY
license (http://creativecommons.org/licenses/by/4.0/)
2 computer law & security review 46 (2022) 105716
perform tasks by looking at examples.3 Several technologies
can be used for this, but the most popular is based on what is
known as Generative Adversarial Networks (GAN)4 and Vari-
ational AutoEncoders.5 GANs consist of two competing net-
works, a generator G (x) and a discriminator D (x). Two compet-
ing models are trained simultaneously to synthesise images.
The algorithms reflect the content and produce realistic fake
images.6 The goal is to assign random noise to samples and to
distinguish real and generated samples.7 The two competing
networks G and D both play a hostile game where the gener-
ator tries to mislea the discriminator by generating data that
is comparable to that in the existing training set. The discrim-
inator tries not to be fooled by identifying fake data based on
real data. The generator and the discriminator work simulta-
neously to learn to generate and recognise complex tasks and
outputs.8
With this technique, by looking at, say, a thousand pho-
tographs of Donald Trump, a new photograph can be produced
that is not an exact copy of one of those, making it appear to
be a completely new photograph.9 This also applies to audio
and video.10 Although the technique was initially complex, in-
volved significant costs and required specialised equipment
and programmes, it is now possible for anyone to create a
deepfake within seconds.11 Deepfakes videos can be manu-
factured from a single still image12 and a Japanese company,
3
Maras, M. H., & Alexandrou, A. (2019). Determining au-
thenticity of video evidence in the age of artificial intelligence
and in the wake of deepfake videos. The International Journal
of Evidence & Proof, 23(3), 255-262. <https://www.allaboutlaw.
co.uk/commercial-awareness/legal- spotlight/how- can-
the- law- deal- with- deepfake- >. Last accessed 14 March 2022.
4
Mann, A. (2019). Deepfake AI: Our Dystopian Present. Livescience.
<https://www.livescience.com/deepfake-ai.html> Last accessed
14 March 2022.
5
Durall, R., Keuper, M., Pfreundt, F. J., & Keuper, J. (2019). Unmask-
ing deepfakes with simple features. arXiv preprint arXiv:1911.00686.
6
Goodfellow, I. et al. (2014). Generative adversarial net-
works. arXiv preprint arXiv:1406.2661.
7
Brock, A., Donahue, J., & Simonyan, K. (2018). Large scale GAN
training for high fidelity natural image synthesis. arXiv preprint
arXiv:1809.11096, p. 2.
8
Goyal, S. (2019). GANs — A Brief Introduction to Gener-
ative Adversarial Networks. Medium. <https://medium.com/
analytics- vidhya/gans- a- brief- introduction- to- generative-
adversarial-networks-f06216c7200e>. Last accessed 14 March
2022.
9
McDonald, G. (2018). Seeing Isn’t Believing: This New AI Sys-
tem Can Create “Deep Fake” Videos. Seeker. <https://www.seeker.
com/artificial- intelligence/this- new- ai- system- can- create-
convincing- deep- fake- videos>. Last accessed 14 March 2022.
10
Bansal, A., Ma, S., Ramanan, D., & Sheikh, Y. (2018). Recycle-gan:
Unsupervised video retargeting. In Proceedings of the European
conference on computer vision (ECCV) (pp. 119-135), introduc-
tion. <https://www.youtube.com/watch?v=ehD3C60i6lw&amp&
feature=youtu.be>. Last accessed 14 March 2022.
11
Hurst, E. (2019). How can the law deal with Deepfake?. Allabout-
law. <https://www.allaboutlaw.co.uk/commercial-awareness/
legal- spotlight/how- can- the- law- deal- with- deepfake- >. Last
accessed 14 March 2022.
12
Zakharov, E., Shysheya, A., Burkov, E., & Lempitsky, V. (2019).
Few-shot adversarial learning of realistic neural talking head mod-
els. In Proceedings of the IEEE/CVF International Conference on Com-
puter Vision (pp. 9459-9468), par 5. Chan, C., Ginosar, S., Zhou, T.,
DataGrid, has even managed to create high-resolution whole-
body images of non-existent people.13
Since the inception of the technology, automatic deepfake
detection systems have been developed.14 Initially, detection
was fairly simple, for example because deepfake technology
did not make people’s eyes blink.15 Although this glitch has
since been remedied, deepfakes are still not perfect, partly be-
cause they often contain artefacts, i.e. traces that can reveal
image or audio manipulation.16 At the same time, deepfake
detection techniques are only able to detect 65% of the deep-
fakes, and often are not able to indicate precisely what has
been manipulated and how, let alone assess whether the ma-
nipulation was relevant or significant.17 Experts believe this
figure to go down rather than go up in time.
‘The real problem to come will not be individual deep- or
cheapfakes, but the ease with which a whole ecosystem of
false information can be created. A fake video, but also fake
twitter accounts that link to the video, fake accounts on dis-
cussion forums that discuss the content of the video, fake
websites that host the video and produce fake news reports
on that what is shown in the video, fake Instagram accounts
that produce memes of the fake video, etc. It will be very hard
to pierce through a multi-layered environment of deception.
& Efros, A. A. (2019). Everybody dance now. In Proceedings of the
IEEE/CVF International Conference on Computer Vision (pp. 5933-5942).
13
Burt, C. (2019). DataGrid develops AI to generate whole-
body images of nonexistent people. Biometricupdate.com. <https:
//www.biometricupdate.com/201905/datagrid-develops-
ai- to- generate- whole- body- images- of- nonexistent- people>.
Last accessed 14 March 2022.
14
Durall, R., Keuper, M., Pfreundt, F. J., & Keuper, J. (2019). Unmask-
ing deepfakes with simple features. arXiv preprint arXiv:1911.00686.
15
Li, Y., Chang, M.-C. and Lyu, S. In ictu oculi: Exposing ai gen-
erated fake face videos by detecting eye blinking. arXiv preprint
arXiv:1806.02877, 2018.
16
<https://www.forensischinstituut.nl/forensisch-onderzoek/
prnu-compare-professional>. Last accessed 14 March 2022. Marra,
F., Gragnaniello, D., Verdoliva, L., & Poggi, G. (2019, March). Do gans
leave artificial fingerprints?. In 2019 IEEE Conference on Multimedia
Information Processing and Retrieval (MIPR) (pp. 506-511). IEEE, Intro-
duction. Cozzolino, D., & Verdoliva, L. (2018). Noiseprint: a CNN-
based camera model fingerprint. arXiv preprint arXiv:1808.08396,
par. 2. <https://www.albany.edu/news/92306.php>. Last accessed
14 March 2022. Brock, A., Donahue, J., & Simonyan, K. (2018). Large
scale GAN training for high fidelity natural image synthesis. arXiv
preprint arXiv:1809.11096. Amerini, I., and Caldelli, R. (2020, June).
Exploiting prediction error inconsistencies through LSTM-based
classifiers to detect deepfake videos. In Proceedings of the 2020 ACM
Workshop on Information Hiding and Multimedia Security (pp. 97-102).
Korshunov, P., & Marcel, S. (2019). Vulnerability assessment and
detection of deepfake videos. In The 12th IAPR International Confer-
ence on Biometrics (ICB), pp. 1-6. X. Yang, Y. Li, and S. Lyu. Exposing
deep fakes using inconsistent head poses. In ICASSP 2019-2019
IEEE International Conference on Acoustics, Speech and Signal Pro-
cessing (ICASSP), pages 8261–8265. IEEE, 2019. Durall, R., Keuper,
M., Pfreundt, F. J., & Keuper, J. (2019). Unmasking deepfakes with
simple features. arXiv preprint arXiv:1911.00686, par. 2. Nguyen,
T. T., Nguyen, C. M., Nguyen, D. T., Nguyen, D. T., & Nahavandi, S.
(2019). Deep Learning for Deepfakes Creation and Detection: A
Survey. arXiv preprint arXiv:1909.11573.
17
Canton Ferrer C. et al. (2020). Deepfake Detection Chal-
lenge Results: An open initiative to advance AI. Ai.Facebook.
<https://ai.facebook.com/blog/deepfake- detection- challenge-
results- an- open- initiative- to- advance- ai/>. Last accessed 14
 computer law & security review 46 (2022) 105716
Technology may be part of the solution. Digital signatures,
public-private key encryption, authentication systems, etc. In
addition, there is deepfake detection technology. However, this
is most likely only part of the solution. Detection programs are
unable to detect all deepfakes and it will be difficult to impos-
sible to ensure that all online content is authenticated via a
secure and trustworthy system.’18
Deepfake technology has a lot to offer. It can be used
for satire, for example by putting Nick Cage in even more
films than the ones already played19 or creating an alterna-
tive Christmas speech for the head of state.20 Historical fig-
ures, such as Salvador Dalí,21 Mona Lisa22 or Napoleon may
be brought back to live in order to give a virtual tour around a
museum or teach a history lesson in high school.23 Deceased
family members can also be brought back to life.24 Deepfakes
are also increasingly being used in the film industry, either
by having deceased actors finish a movie25 or by having an
March 2022. Schroepfer M. (2019). Creating a dataset and a
challenge for deepfakes. Ai.Facebook. <https://ai.facebook.com/
blog/deepfake- detection- challenge/>. Last accessed 14 March
2022. Burt T. (2020). New Steps to Combat Disinformation. Mi-
crosoft. <https://blogs.microsoft.com/on- the- issues/2020/09/01/
disinformation- deepfakes- newsguard- video- authenticator/>.
Last accessed 14 March 2022. Rossler, A. et al. (2019).
Faceforensics++: Learning to detect manipulated facial images.
In Proceedings of the IEEE/CVF International Conference on Computer
Vision (pp. 1-11). Dolhansky, B., Bitton, J., Pflaum, B., Lu, J., Howes,
R., Wang, M., & Ferrer, C. C. (2020). The deepfake detection chal-
lenge dataset. arXiv preprint arXiv:2006.07397. SentinelOne (2019).
What is a Hash? (And How Does It Work?). SentinelOne. <https:
//www.sentinelone.com/blog/what- is- hash- how- does- it- work/>.
Last accessed 14 March 2022. Ozdemir D. (2021). Teenager’s AI
project for detecting Deepfak videos wins Award. Interesting
Engineering. <https://interestingengineering.com/teenagers-ai-
system- for- detecting- deepfake- videos- wins- award>. Last ac-
cessed 14 March 2022. Vaccari, C., & Chadwick, A. (2020). Deepfakes
and disinformation: Exploring the impact of synthetic political
video on deception, uncertainty, and trust in news. Social Media+
Society, 6(1).
18
Van der Sloot, B., Wagensveld Y. & Koops, B-J., ’Deepfakes: de
juridische uitdagingen van een synthetische samenleving’, WODC
2022, p. 390.
19
<https://www.youtube.com/watch?v=BU9YAHigNx8>. Last ac-
cessed 14 March 2022.
20
<https://www.youtube.com/watch?v=IvY-Abd2FfM>. Last ac-
cessed 14 March 2022.
21
Lee D. (2019). Deepfake Salavador Dalí takes selfies with mu-
seum visitors. The Verge. <https://www.theverge.com/2019/5/10/
18540953/salvador- dali- lives- deepfake- museum>. Last accessed
14 March 2022.
22
<https://www.youtube.com/watch?v=P2uZF-5F1wI>. Last ac-
cessed 14 March 2022. BBC (2019). Mona Lisa ‘brought to
life’ with deepfake AI. BBC News. <https://www.bbc.com/news/
technology-48395521>. Last accessed 14 March 2022.
23
<https://www.cereproc.com/en/jfkunsilenced>. Last accessed
14 March 2022.
24
<https://blog.myheritage.com/2021/02/
deep- nostalgia- goes- viral/>. Last accessed 14 March 2022.
Berthelot, D., Milanfar, P., & Goodfellow, I. (2020). Creating high res-
olution images with a latent adversarial generator. arXiv preprint
arXiv:2003.02365. Wan, Z. et al. (2020). Bringing old photos back to
life. In Proceedings of the IEEE/CVF Conference on Computer Vision and
Pattern Recognition (pp. 2747-2757).
25
<https://www.hollywoodreporter.com/behind-screen/
how- furious- 7- brought- late- 845763>. Last accessed 14 March
2022.
3
actor’s deepfake perform stunts.26 Deepfake influencers exist
and get sponsorship contracts.27 Deepfake technology can be
used when people speak in a different language over Zoom or
Skype in order for their words to be translated live and have
their lips synchronised to match the translation.28
Deepfakes can also be used to safeguard the privacy of in-
dividuals.29 They can be used for medical applications,30 for
forensic research31 and for creating a virtual fitting room, al-
lowing customers to try on clothes based on data about their
gender, length and weight.32 Charities use deepfakes, for ex-
26
<https://www.imdb.com/title/tt1821641/>. Last accessed 14
March 2022.
27
<https://influencermatchmaker.co.uk/blog/
virtual- influencers- what- are- they- how- do- they- work>. Last
accessed 14 March 2022.
28
KR, P., et al. (2019, October). Towards automatic face-to-face
translation. In Proceedings of the 27th ACM International Conference
on Multimedia (pp. 1428-1436).
29
Zhu, B., Fang, H., Sui, Y., & Li, L. (2020, February). Deep-
fakes for Medical Video De-Identification: Privacy Protec-
tion and Diagnostic Information Preservation. In Proceed-
ings of the AAAI/ACM Conference on AI, Ethics, and Society.
<https://github.com/iperov/DeepFaceLab/issues/892>. Last ac-
cessed 14 March 2022. <https://mrdeepfakes.com/forums/thread-
legacy- guide- deepfacelab- 1- 0- guide>. Last accessed 14 March
2022. <https://www.wired.com/story/deepfakes- getting- better-
theyre- easy- spot/>. Last accessed 14 March 2022. <https://www.
storypick.com/mr- bean- and- trump- funny- deepfake- video/>.
Last accessed 14 March 2022.
30
Snow J. (2018). Deepfakes for good: Why researchers
are using AI to fake health data. Fast Company. <https:
//www.fastcompany.com/90240746/deepfakes- for- good-
why-researchers-are-using-ai-for-synthetic-health-data>. Last
accessed 14 March 2022. Baur, C., Albarqouni, S., & Navab, N.
(2018). Generating highly realistic images of skin lesions with
GANs. In OR 2.0 Context-Aware Operating Theaters, Computer As-
sisted Robotic Endoscopy, Clinical Image-Based Procedures, and Skin
Image Analysis. Springer, Cham. Frid-Adar, M., et al. (2018). GAN-
based synthetic medical image augmentation for increased CNN
performance in liver lesion classification. Neurocomputing, 321,
321-331. <https://teamgleason.org> Last accessed 14 March
2022. <https://www.logopedie.nl/kennis/dysartrie/>. Last ac-
cessed 14 March 2022. Creer S. et al. (2013). Building personalised
synthetic voices for individuals with severe speech impair-
ment. Science Direct. <https://www.sciencedirect.com/science/
article/abs/pii/S0885230812000836>. Last accessed 14 March
2022. <https://www.filmacademie.ahk.nl/lichting/2020/projecten/
deepfake-therapy/>. Last accessed 14 March 2022. Zhao, Y. (2018).
Enabling people with visual impairments to navigate virtual
reality with a haptic and auditory cane simulation. In Proceedings
of the 2018 CHI conference on human factors in computing systems (pp.
1-14). Eng, K. et al. (2007). Cognitive virtual-reality based stroke
rehabilitation. In World Congress on Medical Physics and Biomedical
Engineering 2006. Springer, Berlin, Heidelberg.
31
Schwartz M. (2018). Who Killed the Kiev Protesters? A 3-D
Model Holds the Clues. New York Times.<https://www.nytimes.
com/2018/05/30/magazine/ukraine-protest-video.html>. Last
accessed 14 March 2022. <https://www.terredeshommes.nl/nl/
programmas/sweetie>. Last accessed 14 March 2022. Van der Hof,
S., Georgieva, I., Schermer, B., & Koops, B. J. (Eds.). (2019). Sweetie
2.0: Using artificial intelligence to fight webcam child sex tourism. TMC
Asser Press.
32
Baron K. (2019). Digital Doubles: The Deepfake Tech Nour-
ishing New Wave Retail. Forbes. <https://www.forbes.com/
sites/katiebaron/2019/07/29/digital-doubles-the-deepfake-tech-
nourishing- new- wave-retail/?sh=c4ce31f4cc7b>. Last ac-
4 computer law & security review 46 (2022) 105716
ample, by having a celebrity seemingly call out in all the lan-
guages of the world to support their cause,33 or by giving peo-
ple a general idea of what a destroyed city looks like, by giving
famous cities a ’remake’, in order to increase support for tak-
ing in refugees.34 As a final example, deepfake technology al-
lows politicians to deliver messages in any language to reach
out to domestic minorities or get their message across more
effectively abroad.35
The examples, illustrations and sources provided through-
out the text were compiled for a governmental study, on which
this article is based.36 What becomes clear from the exam-
ples provided above is that deepfake technology is likely to
grow speed and quality, it will be democratised and deepfake-
detection technologies will only be able to detect a percent-
age of the deepfakes. Deepfake technology also holds several
promises, such as its use for satire, for privacy-enhancement,
for gaming and the entertainment industry, for retail and for
law enforcement agencies when infiltrating networks via a
fake persona or fake child pornography, and for bringing back
historical figures or deceased loved ones. At the same time,
it is important to stress that although the examples provided
above are real and will have concrete and considerable im-
pact on society, but that at the moment deepfake technology
is by and large used for but one application: generating non-
consensual porn.
This article will explain, however, that there are several risk
attached as well (section 2) and will analyse whether the cur-
rent regulatory rime is sufficiently equipped to tackle those
problems. It will also discuss potential solutions for three ar-
eas of law: privacy and data protection law (section 3), free-
dom of expression (section 4) and ex ante forms of regula-
tion (section 5).37 Finally, a conclusion is offered (section 6), in
which it will be stressed that the main problem with respect
to the regulation of deepfakes is not so much the absence of
rules, but the lack of proper enforcement of the existing and
potential additional rules.
cessed 14 March 2022. <https://www.charlietemple.com/
nl- nl/virtuele- paskamer>. Last accessed 14 March 2022. Ap-
parel Resources News-Desk (2020). Virtual fitting room mar-
ket forecast to double by 2025: Report. Apparel Resources.
<https://in.apparelresources.com/technology- news/retail- tech/
virtual- fitting- room- market- forecast- double- 2025- report/>.
Last accessed 14 March 2022.<https://www.cereproc.com/en/
jfkunsilenced>. Last accessed 14 March 2022.
33
Chandler S. (2020). Why Deepfakes Ara A Net Positive For Hu-
manity. Forbes. <https://www.forbes.com/sites/simonchandler/
2020/03/09/why- deepfakes- are- a- net- positive- for- humanity/
?sh=61c55ef02f84>. Last accessed 14 March 2022. Also deepfakes
can be used to incite anger: <https://www.youtube.com/watch?
v=8o0iOm-2sLw>. Last accessed 14 March 2022.
34
<Deepempathy.mit.edu>. Last accessed 14 March 2022.
35
Christopher N. (2020). We’ve Just Seen the First Use of
Deepfakes in an Indian Election Campaign. Vice. <https:
//www.vice.com/en/article/jgedjb/the- first- use- of- deepfakes-
in- indian- election- by- bjp>. Last accessed 14 March 2022.
36
Van der Sloot, B., Wagensveld Y., & Koops, B-J., ’Deepfakes: de
juridische uitdagingen van een synthetische samenleving’, WODC
2022.
37
Other legal regimes, such as tort law and criminal, will only be
discussed in the margin.
There is no generally accepted definition of deepfake. Both
from the literature reviewed and the interviews conducted
for this study a disunified picture emerges. Some define the
concept very narrowly, for example: mixing two existing im-
ages through Generative Adversarial Networks. Others opt for
a broader definition, seeing a deepfake as any form of manip-
ulation or fabrication of audio, video or other signals by means
of Artificial Intelligence or Machine Learning. This article opts
for a broad definition, both because this is in line with the pop-
ular understanding of deepfakes and because the technical
means with which an image, video or audio file is manipu-
lated is less relevant for the legal and policy context than the
result. What matters is the extent to which the manufactured
material appears real and/or is taken to be true.
It is best to take ‘deepfake’ as an ideal type. The most typ-
ical deepfake is a video that has been created with advanced
technical means in which an existing person appears to be
doing or saying something that she did not actually do or say,
where it is hardly possible for either a natural person or an
AI deepfake detection system to discover the manipulation.
Around this archetypical deepfake, numerous peripheral ap-
plications could be placed. It can be videos that look real, but
are not generated with high-tech means; it can be high-quality
videos of non-existent people; it may concern a fake audio
or text fragment or a manipulated satellite signal. It may in-
volve minor manipulations, which are sometimes inherent in
the technique, such as smoothing a person’s skin or compres-
sion on audio messages; etc. Consequently, at least six factors
could be relevant when determining the extent to which ma-
terial should be qualified a deepfake:
• The type of data carrier
• How advanced the technology used for the creation of fake
material is
• The degree of manipulation
• The extent to which the manipulation is material to the
information being conveyed
• The question of whether the deepfake concerns an existing
or non-existent person
• The extent to which the consumer takes the content to be
true
The working definition of deepfakes used in this article is:
Image, sound or other material that is wholly or partly fabricated
or existing image, sound or other material that has been manipulated
with the help of advanced technical means and that is impossible or
difficult to distinguish from the authentic material
It should finally be underlined that deepfakes are the most
advanced and realistic form of a more general move towards
what is called synthetic media. Synthetic media concern con-
tent that is wholly or partially created or manipulated through
the use of AI or other technologies. Synthetic media is the
family to which deepfakes are a subbranch. Many of the prob-
lems described in this article with respect to deepfakes also
apply to the substantially bigger amount of synthetic media.
Although a fake video may not formally be a deepfake, has
not been produced with highly advanced techniques and can
be distinguished from authentic media when assessed care-
fully, most consumers do not scrutinize videos they see for
authenticity in detail. Similarly, even although an AI detection
 computer law & security review 46 (2022) 105716
technique is able to filter out many non-deepfake (cheapfake)
material, the prediction that in a couple of years, more than
90% of all digital material may concern synthetic media may
mean that the post-truth era has in fact materialised. Deep-
fakes could and perhaps should be treated as the clearest ex-
ample and advanced form of synthetic media, as the canary
in the coal mine.
2. Risk to personal and societal interests
The term deepfake was first used by citizens in 2017 on
the platform Reddit, where faces of celebrities, such as Tay-
lor Swift, were put on the bodies of porn actresses. Subse-
quently, the popularity of this practice exploded, with thou-
sands of users sharing creations on the platform. As of Febru-
ary 2018, major platforms responded by restricting applica-
tions of deepfakes. Reddit banned the deepfakes subreddit, a
forum dedicated to this particular topic on Reddit’s website.
‘Reddit does not allow content that impersonates individuals
or entities in a misleading or deceptive manner. This not only
includes using a Reddit account to impersonate someone, but
also encompasses things such as domains that mimic oth-
ers, as well as deepfakes or other manipulated content pre-
sented to mislead, or falsely attributed to an individual or en-
tity. While we permit satire and parody, we will always take
into account the context of any particular content.’38 This was
followed by several websites, including gaming site Discord
and Gfycat, because the posting of pornographic deepfakes
was against the website’s policy,39 a choice wich was honoured
by Pornhub, Twitter40 and Facebook.41 Still, research showed
that 96 percent of all deepfake videos are currently porno-
graphic in nature and made without mutual consent.42
A second problem may arise when a deceased person does
not want to be brought back to live, either by relatives or by
institutions.43 ‘What does it mean to resurrect the dead, and
not only bring them back to life to communicate with them,
38
<https://www.reddithelp.com/hc/en-us/articles/
360043075032>. Last accessed 14 March 2022.
39
Fink D., Diamond S. (2020). Deepfakes:2020 and Beyond.
Law.com. <https://www.law.com/therecorder/2020/09/03/
deepfakes- 2020- and- beyond/?slreturn=20210014101012>. Last
accessed 14 March 2022.
40
Hern A. (2018). ‘Deepfake’ face-swap porn videos banned
by Pornhub and Twitter. The Guardian. <https://www.
theguardian.com/technology/2018/feb/07/twitter- pornhub- ban-
deepfake- ai- face- swap- porn- videos- celebrities- gfycat- reddit>.
Last accessed 14 March 2022.
41
Bickert M. (2020). Enforcing Against Manipulated Media.
Facebook. <https://about.fb.com/news/2020/01/enforcing-against-
manipulated-media/>. Last accessed 14 March 2022.
42
Sensity (2019). The State of Deepfakes: Landscape,
Threats, and Impact. Medium. <https://medium.com/sensity/
mapping- the- deepfake- landscape- 27cb809e98bc>. Last ac-
cessed 14 March 2022. Melville K. (2019). The insidious rise
of deepfake porn videos – and one woman who won’t be si-
lenced. ABC News. <https://www.abc.net.au/news/2019- 08- 30/
deepfake-revenge-porn-noelle-martin-story-of-image-based-
abuse/11437774>. Last accessed 14 March 2022.
43
Harbinja, E. (2017). Post-mortem privacy 2.0: theory, law,
and technology. International Review of Law, Computers & Technol-
ogy, 31(1).
5
but to speak through them? Digital communications are of-
ten meant to be short-term, real-time, and immediate, but
through what I think of as “platform temporality,” they can be
collected and preserved, and potentially passed on to loved
ones and future descendants. There is also some amount of
anxiety attached to the capacity for data to live on past peo-
ple’s physiological selves; it is hard to control data during life
and it is nearly impossible to do so after one’s death. Liv-
ing on through social media accounts is one thing, but actu-
ally using A.I. to replicate a person’s personality in perpetuity
is something different entirely, especially when it comes to
deepfakes.’44 In addition, deepfakes can be used for commer-
cial exploitation and may so undermine a person’s exploita-
tion rights.45
Deepfakes can also be used for financial gain, such as ma-
nipulating markets. After a fake message circulated on What-
sapp in 2019, stating that Metro Bank was out of liquidity, peo-
ple flocked to Metro Bank to claim all their money and jew-
ellery. This eventually led to the share falling by 9%. Criminals
can use deepfakes to impersonate the CEO of a listed com-
pany, for example, by making statements that are harmful to
the company, causing the share price to fall, or to have an
employee transfer a large sum of money because she thinks
her boss is ordering her to do so.46 Europol therefore consid-
ers deepfakes to be significant to ’perpetrating extortion and
fraud, facilitating document fraud, falsifying online identities
and fooling KYC [Know Your Customer] mechanisms, falsify-
ing or manipulating electronic evidence for criminal justice
investigations, disrupting financial markets’ and, for example,
the theft of trade secrets.47 Deepfakes may obviously also be
used for these types of reasons on a smaller scale, for exam-
ple to have a parent or friend transfer money quickly, having
them believe that their child or friend is asking them to do so
via skype.
Deepfakes can and are applied in the political realm as
well.48 Trump supposedly called on Belgium to withdraw from
the Paris Agreement,49 Obama seemingly called Trump a "to-
44
<https://slate.com/technology/2020/11/
robert- kardashian- joaquin- oliver- deepfakes- death.html>. Last
accessed 14 March 2022.
45
<https://www.youtube.com/watch?v=m7u-y9oqUSw>.
Last accessed 14 March 2022. <https://www.theverge.com/
2020/4/28/21240488/jay- z- deepfakes- roc- nation- youtube-
removed- ai- copyright- impersonation>. Last accessed 14 March
2022.
46
Stupp C. (2019). Fraudsters Used AI to Mimic CEO’s
Voice in Unusual Cybercrime Case. The Wall Street Journal.
<https://www.wsj.com/articles/fraudsters- use- ai- to- mimic-
ceos- voice- in- unusual- cybercrime- case- 11567157402>. Last
accessed 14 March 2022.
47
<https://www.europol.europa.eu/cms/sites/default/
files/documents/malicious_uses_and_abuses_of _artificial_
intelligence_europol.pdf>, p. 56. Last accessed 14 March 2022.
48
See however: Thomas D. (2020). Deepfakes: a threat to democ-
racy or just a bit of fun?. BBC News. <https://www.bbc.com/news/
business-51204954>. Last accessed 14 March 2022.
49
Schwartz O. (2018). You thought fake news was bad?
Deep fakes are where truth goes to die. The Guardian.
<https://www.theguardian.com/technology/2018/nov/12/
deep- fakes- fake- news- truth>. Last accessed 14 March 2022.
6 computer law & security review 46 (2022) 105716
tal and complete dipshit"50 and former Italian Prime Minis-
ter Matteo Renzi seemed to insult about any colleague.51 ‘The
deepfake video refers to Renzi’s decision Sept. 17 to leave the
Democratic Party and form his own party. In the parody, the
supposed Renzi is seen talking when he thinks he is off air. He
discusses the reaction of various politicians, including Prime
Minister Giuseppe Conte; Luigi Di Maio, leader of the Five
Star Movement; and Italy’s president, Sergio Mattarella. The
video is so outrageous that it is clearly a parody, but deepfake
technology makes it look incredibly realistic. So when peo-
ple started sharing it online, claiming that it was a real video,
quite a few social media users fell for it and were outraged
by what they saw as Renzi’s bad behaviour.’52 Public unrest
may arise when a video, showing a politician to be alive and
kicking, is believed to be fake,53 and deepfakes may lead to
tensions between countries.54
This also means that besides personal interests, societal
interests may be at stake with the rise of deepfakes.
• First, deepfakes may be used for spreading misinfor-
mation. Deepfakes may accelerate the move to a post-
truth era55 and increase segregation and stratification, be-
cause different deepfakes will circulate in different echo-
chambers or filter bubbles on the Internet.56 Europol also
fears that deepfakes will be used for ‘distributing disinfor-
mation and manipulating public opinion, inciting acts of
violence toward minority groups, supporting the narratives
of extremist or even terrorist groups, and, stoking social
unrest and political polarization’.57 Due to the expected
considerable increase in the number of fake messages and
deepfakes, the truth and authentic reporting may eventu-
ally become snowed under, certainly among groups that
have difficulty with reporting by the so-called Mainstream
50
Fagan K. (2018). A viral video that appeared to show Obama
calling Trump a ‘dips—‘ shows a disturbing new trend called
‘deepfakes’. Business Insider. <https://www.businessinsider.nl/
obama- deepfake- video- insulting- trump- 2018- 4?international=
true&r=US>. Last accessed 14 March 2022.
51
The Observers (2019). Deepfake video of former Ital-
ian PM Matteo Renzi sparks debate in Italy. The Observers.
<https://observers.france24.com/en/20191008-deepfake-video-
former- italian- pm- matteo- renzi- sparks- debate- italy>. Last
accessed 14 March 2022.
52
<https://observers.france24.com/en/20191008-deepfake-
video- former- italian- pm- matteo- renzi- sparks- debate- italy>.
Last accessed 14 March 2022.
53
<https://www.motherjones.com/politics/2019/03/
deepfake-gabon-ali-bongo/>. Last accessed 14 March 2022.
54
BBC (2020). Australia demands China apologise for posting
‘repugnant’ fake image. BBC News. <https://www.bbc.com/news/
world-australia-55126569>. Last accessed 14 March 2022.
55
McIntyre, Lee. Post-truth. MIt Press, 2018. Higgins, K. (2016). Post-
truth: a guide for the perplexed. Nature News, 540(7631), 9. Suiter, J.
(2016). Post-truth politics. Political Insight, 7(3), 25-27.
56
Vaccari, C., & Chadwick, A. (2020). Deepfakes and disinforma-
tion: Exploring the impact of synthetic political video on decep-
tion, uncertainty, and trust in news. Social Media+ Society, 6(1),
2056305120903408. Pariser, E. (2011). The filter bubble: How the new
personalized web is changing what we read and how we think. Penguin.
57
<https://www.europol.europa.eu/cms/sites/default/
files/documents/malicious_uses_and_abuses_of _artificial_
intelligence_europol.pdf>, p. 52. Last accessed 14 March 2022.
Media. In a world where any citizen has access to deepfake
technology and can disseminate a fake video, photo or au-
dio file on the Internet within seconds, the question is how,
in practical terms, the media can ensure that the news they
report is accurate. Quality media that invest in procedures
not only run the risk of being less profitable because of the
costs concerned, but also of becoming ’outdated’, because
other media, with fewer due diligence requirements, will
always be quicker to report sensational news.
• Second, both the spread of fake news, the expected in-
crease in echo chambers on the internet and the possibil-
ity for interfering in foreign elections through trolls and
fake news may have an impact on democratic elections.
Importantly, Western democracies are now aware of this
risk and some are adopting laws and non-legal measures to
counter such activities. But another problem is that coun-
tries such as Russia, China and Iran would not so much tar-
get Western democracies, but the Global South. This could
be done for all kinds of purposes, such as influencing con-
crete decision-making (a Russian state-owned company
getting a contract instead of an British one), influencing
elections there (for example to put a Xi-friendly regime in
power) or influencing decisions at the international level
(for example by getting them to vote in favour of lifting
sanctions against Iran). Obviously, deepfakes will not only
be used by foreign powers, but also by domestic political
opponents.
• Third, deepfakes are and increasingly will be introduced in
courts as fake evidence.58 This may have an impact on the
rule of law. (1) Trials will last longer because parties can
always claim that the evidence against them is fake and
fabricated. (2) Deepfakes increase the risk that a court will
falsely assume evidence to be true. (3) A convicted person
can always publicly maintain her innocence, stating that
the court took fake evidence to be real. (4) With respect
to certain offences, the suggestion or prosecution alone
may have a big impact on a person’s life and professional
career. Even if it becomes abundantly clear that a person
was wrongfully prosecuted for sexual acts with children
because the videos were fake, the harm may already been
done. Importantly here and with other sensational news,
even if it is later debunked, groups may claim that the
specific message was fake, but that the underlying truth
(there is a worldwide network of pederasts) is true. In the
case of fake news that is distributed to a wider public, but
later debunked, the initial (often sensational) fake message
will generate significantly more attention than the subse-
quent rectification. And, even if the story debunking the
fake news reaches a person, she is often left with a ’wasn’t
there something with..’ feeling.59
• Fourth and finally, there is already a practice, offline and
certainly online, to share disrespectful statements towards
58
Swerling G. (2020). Doctored aufio evidence used
to damn father in custody battle. The Telegraph.
<https://www.telegraph.co.uk/news/2020/01/31/deepfake-
audio- used- custody- battle- lawyer- reveals-doctored-evidence/>.
Last accessed 14 March 2022.
59
Pfefferkorn, R. (2020). "Deepfakes" in the courtroom. Boston Uni-
versity Public Interest Law Journal, 29(2).
 computer law & security review 46 (2022) 105716
women and young girls,60 with either a misogynistic or
sexual undertone. Slut-shaming and revenge porn can
have very serious consequences, especially for young adult
girls but also for female politicians.61 Deepfakes will in-
crease this problem, not only because of their quantity and
quality, but also because deepfake technology allows a per-
son to create a nude picture or porn video of someone
based on a photo of her where she is fully dressed. Impor-
tantly, when a deepfake porn video is shared on Whatsapp,
depicting a classmate from high school, even if her whole
class knows the video to be fake, the social consequences
may be no less. In addition, even if she herself knows the
video to be false, her self-image may nevertheless be dis-
torted.
3. Privacy and data protection law
In the EU, there is no law specifically addressing the regulation
of deepfakes, although a proposal for an AI regulation is cur-
rently pending.62 Article 52 of that proposal lays down trans-
parency obligations for certain AI systems. Paragraph 3 speci-
fies that users of an AI system that generates or manipulates
image, audio or video content that appreciably resembles ex-
isting persons, objects, places or other entities or events and
would falsely appear to a person to be authentic or truthful
(‘deep fake’), shall disclose that the content has been artifi-
cially generated or manipulated. Recital 70 further explains
that users, who use an AI system to generate or manipulate
image, audio or video content that appreciably resembles ex-
isting persons, places or events and would falsely appear to a
person to be authentic, should disclose that the content has
been artificially created or manipulated by labelling the artifi-
cial intelligence output accordingly and disclosing its artificial
origin. Given the significant risks to both personal and societal
interests, the question is whether a transparency obligation is
sufficient, even if it would be respected by users and platforms.
In addition, the provision leaves open a number of questions,
such as, but not limited to: Does this provision also apply to a
deepfake smiley-faced sun? Does this provision apply to fully
AI generated deepfake persons? To whom should information
be disclosed, the general public, the person depicted, the plat-
form on which the deepfake is posted? How and in what form
should the information be disclosed? Should the information
merely state that it concerns a deepfake or specify which part
of the video, picture or audio fragment has been manipulated
and how?
In addition, the General Data Protection Regulation might
apply to deepfakes. The fact that the information conveyed
through a deepfake is incorrect does not bear on the GDPR’s
60
<https://www.groene.nl/artikel/misogynie- als- politiek- wapen>.
Last accessed 14 March 2022.
61
<https://www.youtube.com/watch?v=B5eMz4JpYu0>. Last ac-
cessed 14 March 2022. <https://www.youtube.com/watch?v=
4b79yBzyRHs>. Last accessed 14 March 2022.
62
Proposal for a Regulation of the European Parliament and of the
Council Laying Down Harmonised Rules on Artificial Intelligence
and Amending Certain Union Legislative Acts {SEC(2021) 167 final}
- {SWD(2021) 84 final} - {SWD(2021) 85 final}.
7
applicability, as long as a person can be recognised through
the deepfake.63 Thus, the GDPR applies both to the data used
to render the deepfake and, in most cases, to the deepfake it-
self. If a famous person is appearing to do or say things she
had never done or said, such is still treated as personal data
because the data concern that person. If a person writes on a
blog ‘Boris Johnson has brown eyes and a big beard’, such is
clearly untrue, but writing the blog will still be qualified or en-
tailing the processing personal data because what matters for
the applicability of the GDPR is whether data relate to an iden-
tifiable individual, not whether those data are correct. Mutatis
mutandis, this means that whether video, audio or other ma-
terial about a person is faked or not through GAN or similar
technologies is not relevant, what is relevant is whether a per-
son can be reasonably identified.
Consequently, the vast majority of deepfakes will involve
the processing of personal data. Nevertheless, there are five
borderline areas:
• First, deepfakes can be used to conduct live anonymous
conversations, e.g. an anonymous witness, where a person
assumes the voice and/or face of a non-existent person.
• Second, the GDPR does, in principle, not apply to deceased
persons. Thus, when a porno is made of two long gone fig-
ures or when a deepfake is created of a deceased grand-
parent holding a funeral speech, such falls outside the data
protection framework.64
• Third, the GDPR does, in principle, not apply to deepfakes
about organisations and states.65 Thus, when a deepfake
paints a very bleak and deceptive picture of the state of
Monaco or Shell, the GDPR does not apply.
• Fourth, deepfakes can be used to merge images or voices
of two or more persons.66 Although the production of such
deepfakes involves the use of personal data of several peo-
ple and will be subject to the GDPR (provided that the other
conditions have been met), it is unclear whether the final
result also is. In the case of two faces being merged into
one, this may be the case when both are still clearly recog-
nisable. The more data from the more people are used, the
more unlikely it is that the result will be a processing of
personal data of one or more of them. However, even then
it may involve a recognisable element of one of them, for
example someone with a large birthmark on the nose.
• Fifth, through the use of deepfake technology, an entirely
new but fictitious person can be created, for example
trough the website ’This Person Does not Exist’. The GDPR,
63
<https://ec.europa.eu/justice/article-29/documentation/
opinion-recommendation/files/2007/wp136_en.pdf>. Last ac-
cessed 14 March 2022.
64
Recital 27 GDPR.
65
Recital 14 GDPR.
66
Albahar, M., & Almalki, J. (2019). Deepfakes: Threats and coun-
termeasures systematic review. Journal of Theoretical and Applied
Information Technology, 97(22), 3242-3250
8 computer law & security review 46 (2022) 105716

in principle, does not apply to data processing about ficti- Because deepfakes are by definition fake, it seems plausible
tious persons.67 that data subjects always have the right to correct the mate-
rial, if the freedom of expression (including satire) does not
prevail (see section 4). The question is who ultimately has the
last word on what is correct and what is not. In some cases
data subjects may have an interest in providing incorrect data,
or there is debate on what is correct and what is not. The GDPR
is silent on where the burden of proof lies for proving that per-
sonal data is correct or incorrect, and what standard of proof
should be used. Ultimately, in matters of conflict between the
data subject and the controller, the DPA or a judge may need
to resolve the matter.
If the controller honours a request to rectify or supplement
data, an additional obligation applies: ‘The controller shall
When the Regulation does apply, it sets strict limits on the
communicate any rectification [] to each recipient to whom
creation and sharing deepfakes. For example, because infor-
the personal data have been disclosed, unless this proves im-
mation about a person’s sexual life and political activities is
possible or involves disproportionate effort. The controller
qualified as sensitive data, deepfakes seemingly containing
shall inform the data subject about those recipients if the data
data about such aspects will be prohibited, unless she ex-
subject requests it.’74 Consequently, if a data controller re-
plicitly consents,68 which will generally not be the case with
ceives a request to rectify a deepfake, i.e. to remove the fake
deepfakes. When non-sensitive information is processed, e.g.
element, she will have to comply in almost all cases, and if
a funny deepfake of a friend or a public figure, such will be
she has distributed the deepfake, there are two scenario’s. If
deemed legitimate only when she consents or when the in-
she knows to whom she has forwarded the deepfake or can
terest served by producing and sharing the deepfake is higher
easily find out who has a copy, she should reach out, inform-
than the interest of the person concerned not to.69 Though
ing them that they must too rectify the deepfake. This also ap-
satire is deemed a legitimate interest, when the data subject’s
plies to situations in which she has made the deepfake public,
interests are significantly affected, it is clear that no legitimate
but can easily find out who has made a copy or downloaded
ground for processing the personal data will exist. In addition,
the material. Only when it is not reasonably possible to find
the GDPR contains a number of restrictive principles. Many
out who possesses the deepfake, she is exempted from this
deepfakes of public figures are based on data found on the in-
obligation. The reasonable, in this sense, is contextual. An ex-
ternet which were collected and processed for different pur-
ception to the obligation to inform will be accepted quicker
poses, which may conflict with the purpose limitation princi-
with relatively innocent deepfakes than with fake messages
ple.70 And there is the obligation to inform the data subject
that contain pornographic content, for example; what matters
of the fact that a deepfake about her has been produced and
is the ’proportionality’ of the effort. Proportionality is related,
shared.71
among other things, to the damage that the data subject ex-
Special mention should be made of the obligation to only
periences from the continued existence of the processing of
process correct personal data; the question what this means
incorrect data.
for purposeful deceit through deepfakes.72 The GDPR empha-
Perhaps more importantly, a data controller does not have
sises the processing of data that is correct and complete. Thus,
a duty merely to rectify data at the request of the data subject,
the data subject has the right to ‘obtain from the controller
but has an independent duty to ensure the quality of the data
without undue delay the rectification of inaccurate personal
it processes. Personal data must be ‘accurate and, where nec-
data concerning him or her. Taking into account the purposes
essary, kept up to date; every reasonable step must be taken
of the processing, the data subject shall have the right to have
to ensure that personal data that are inaccurate, having re-
incomplete personal data completed, including by means of
gard to the purposes for which they are processed, are erased
providing a supplementary statement.’73 If data are incorrect,
or rectified without delay.’75 A strict reading of this duty would
the data subject may ask for them to be adjusted. This could
imply that all deepfakes are prohibited by definition, since the
concern her age, for example, or an address that has been in-
controller knows that it is processing incorrect data. The data
correctly entered into the system or has become outdated. The
quality principles does not refer to the correctness or suit-
right to rectify incorrect data should in principle always be
ability of the data in relation to the purpose (the creation of
honoured, unless the data subject cannot be identified, or the
a deepfake), but to the accurateness of the data themselves.
data subject asks the controller to correct a small or meaning-
Also, the GDPR does not mention a possibility for the data sub-
less detail each and every week.
ject to exempt the controller from this duty, which may partly
have to do with the fact that data protection law does not only
67
<www.thispersondoesnotexist.com>. Last accessed 14 March serve the interests of the data subject, but also general inter-
2022. ests that are related, inter alia, to processing data only when
68
Article 9 GDPR.
69
they are correct and accurate.
Article 6 GDPR.
70
Article 5 para 1 sub b GDPR.
71
Article 13 and 14 GDPR.
72 74
Article 5 para 1 sub d GDPR. Article 19 GDPR.
73 75
Article 16 GDPR. Article 5 para 1 sub D GDPR.
 computer law & security review 46 (2022) 105716
This means that many of the deepfakes that are currently
produced violate the GDPR and should be deemed unlawful,
provided that the GDPR applies and the data controller can-
not successfully invoke the freedom of speech (section 4). Still,
there are two issues that may become problematic with re-
spect to deepfakes: the scope of personal data and the house-
hold exemption.
Especially with respect to two legal lacunas, namely deep-
fakes about deceased and virtual persons, additional regula-
tion might be considered.
Post-mortem privacy has been discussed for decades,76
but deepfakes take this discussion to a new dimension, both
morally and commercially. The legal regime in most coun-
tries does offer protection to the rights/interests of the dead,
for instance, by regulating in detail what can and cannot be
done with a body. Such rules concern the physical body, but
there are no rules on the virtual body or the realistic repro-
duction of a person’s psyche. There are numerous applications
that could be the subject of legal and political debate. For ex-
ample, to what extent is it desirable and permissible to have
long gone historical figures teach in schools? To what extent
is it desirable and permissible to have deceased artists give
a tour of a museum? To what extent is it desirable and per-
missible to have deceased actors feature in films? To what ex-
tent is it desirable and permissible to have a deceased per-
son star in a porno film? To what extent is it desirable and
permissible to have deceased artists give concerts? To what
extent can family members communicate with a deceased
loved one even against the will of that person; what does such
communication do to trauma processing (is it actually helpful
or detrimental to trauma processing)? Answering these ques-
tions might require the introduction of a post-mortem privacy
regime or an extension of the substance and scope of applica-
tion of personality rights.
Similar questions could be asked with respect to the cre-
ation of virtual persons. There are very few legal limitation to
creating such persons and having them perform certain activi-
ties. But the creation of non-existent persons through AI raises
numerous ethical and legal dilemmas. The police may infil-
trate a criminal network using a fake person, pederasts can be
traced using fake child pornography and traffickers in women
can be identified using fake customer profiles. For these ap-
plications as well as for others, more clarity is needed as to
what is or is not permitted. In addition, the question is to what
extent virtual but highly realistic persons can be used by the
entertainment industry, by the porn industry or for medical
applications. For example, there are therapies for the treat-
ment of paedophiles through the display of fake child pornog-
raphy, but is that desirable? What are the moral boundaries to
producing fake personalities and the activities that they can
76
Edwards, L., & Harbina, E. (2013). Protecting post-mortem pri-
vacy: Reconsidering the privacy interests of the deceased in a
digital world. Cardozo Arts & Ent. LJ, 32, 83. Harbinja, E. (2017).
Post-mortem privacy 2.0: theory, law, and technology. Interna-
tional Review of Law, Computers & Technology, 31(1), 26-42. Buite-
laar, J. C. (2017). Post-mortem privacy and informational self-
determination. Ethics and Information Technology, 19(2), 129-142.
Lopez, A. B. (2016). Posthumous privacy, decedent intent, and post-
mortem access to digital assets. Geo. Mason L. Rev., 24, 183.
9
perform? On both points, the EU could consider adopting new
regulation.
A second important point for legislative reconsideration is
the household exemption. The GPDR does not apply to pro-
cessing of personal data ‘by a natural person in the course of a
purely personal or household activity’.77 ‘This Regulation does
not apply to the processing of personal data by a natural per-
son in the course of a purely personal or household activity
and thus with no connection to a professional or commercial
activity. Personal or household activities could include corre-
spondence and the holding of addresses, or social network-
ing and online activity undertaken within the context of such
activities. However, this Regulation applies to controllers or
processors which provide the means for processing personal
data for such personal or household activities.’78 The Euro-
pean Court of Justice,79 as well as the Working Party 29,80 has
interpreted the exemption in a narrow manner, meaning that
it is only said to apply to a limited number of cases.
When the GDPR was under discussion, the Working Party
argued for a revised version of the household exemption. ‘WP
29 urges the legislature to use the process of introducing new
data protection law as an opportunity to reduce as far as pos-
sible the legal uncertainty that currently surrounds various
aspects of individuals’ personal or household use of the in-
ternet. Access to the internet and more functional ICT has
brought many positive new possibilities to individuals – for ex-
ample instant access to knowledge, services and the possibil-
ity of contact with other people worldwide. However, data pro-
tection authorities are also experiencing an increasing num-
ber of complaints emanating from individuals’ personal use
of the internet. A typical complaint might be that a pupil has
used a social networking site to say post a derogatory, inaccu-
rate or hurtful message about a teacher. Currently some data
protection authorities would reject any complaints about the
pupil on the grounds that the processing of personal data in-
volved would fall within the personal or household process-
ing exemption. Some data protection authorities also take the
view that other elements of the law – for example those relat-
ing to libel or harassment – are more appropriate instruments
for dealing with issues such as ‘cyber-bullying’. It is the case
though that some DPAs [Data Protection Authorities] do – in-
creasingly – take on the role of mediating individuals’ internet
postings.’81
The exemption, which dates back to the 1995 EU Data Pro-
tection Directive, was left virtually unchanged in the GDPR.
77
Article 3 para 3 sub c GDPR.
78
Recital 18 GDPR.
79
EUCJ 6 november 2003, C-101/01, ECLI:EU:C:2003:596
(Bodil Lindqvist). EUCJ EU 11 december 2014, C-212/13,
ECLI:EU:C:2014:2428 (František Ryneš v Úřad pro ochranu os-
obních údajů). EUCJ Sergejs Buivids, zaak C–345/17, 14 februari
2019.
80
Article 29 Data Protection Working Party, Opinion 5/2009 on on-
line social networking, 01189/09/EN WP 163, 12 June 2009, Brussels,
Ec.europa.eu 9 April 2020.
81
Annex 2 Proposals for Amendments regarding exemption
for personal or household activities. The situation under Di-
rective 95/46/EC, p. 3. <https://ec.europa.eu/justice/article-29/
documentation/other-document/files/2013/20130227_statement_
dp_annex2_en.pdf>.
10 computer law & security review 46 (2022) 105716
But, as the Working Party 29 suggests, there are good reasons
to reconsider that exemption. When the 1995 Directive was
adopted, the primary reason given for the need of a house-
hold exemption was keeping an address book. Such does con-
cern processing personal data of third parties, but only in-
volves their name, address, and telephone number. Keeping
such data is socially accepted and usually desired by the third
parties in question. Currently, however, citizens have access
to a wealth of information and can use various advanced data
processing technologies. This means that the type of data that
can be processed about others with the use of a private com-
puter is incomparable to those thought of when drafting the
1995 Directive. In addition, the household exemption made
sense in a world in which the private sphere was more or less
closed off from the public sphere. In the current data-driven
environment, the boundary between the two spheres has be-
come increasingly blurry. A click of a button is enough to dis-
seminate thousands of photos or videos stored on a private
computer online through social media or digital platforms.
The household exemption raises the following problem.
Suppose an ex-partner stores private photographs of his ex-
girlfriend on his computer, with which he then produces a
deepfake video in which she performs all kinds of perverse
sexual acts. He tells his friends about it, who also communi-
cate this to her. This is just one of the many possible examples
of deepfake applications that cannot be addressed under the
GDPR. The production of compromising material and the pos-
session of it, is not covered by the GDPR. Once the material is
on the internet or distributed to large groups of friends it is,
but by then it is too late. The damage has already been done;
compromising videos can attract thousands or millions (in the
case of celebrities) of viewers within a few hours. It may often
be impossible to take that video down permanently, because
of the ease with which a copy of the video can be produced.
Consequently, it could be considered to limit the household
exemption.
It might be argued that this legal gap could also be closed
with reference to tort law. Most countries have regimes in
place that allow citizens to go to court when they are harmed
by others and some have specific tort grounds that could di-
rectly apply to the type of cases discussed. An example might
be the American ‘intrusion upon seclusion’ tort.82 This is cer-
tainly true, but at least three obstacles exist in this respect.
First, these types of regimes generally require harm being in-
flicted on the claimant. Though with some of the more ex-
treme (pornographic) deepfakes, such harm will be obvious,
for others such will be less evident (see for more on this point
section 4). The question is precisely whether the generation of
a deepfake porno, for example, without the person distribut-
ing that fake does harm and how such harm is distinguishable
82
Tutaj, A. J. (1998). Intrusion Upon Seclusion: Bringing an Other-
wise Valid Cause of Action into the 21st Century. Marq. L. Rev., 82,
665. Meltz, E. A. (2014). No Harm, No Foul: Attempted Invasion
of Privacy and the Tort of Intrusion upon Seclusion. Fordham
L. Rev., 83, 3431. Zhu, B. (2014). A traditional tort for a modern
threat: applying intrusion upon seclusion to dataveillance obser-
vations. NYUL Rev., 89, 2381. Palyan, T. (2008). Common Law Privacy
in a Not So Common World: Prospects for the Tort of Intrusion
Upon Seclusion in Virtual Worlds. Sw. L. REv., 38, 167.
from person A privately fantasising about person B or mak-
ing sexual drawings of B in the privacy of her home. Second,
citizens are often unequipped to engage in long and compli-
cated legal battles and third, even if they win, the compensa-
tion granted, at least under European legal regimes, is often
negligible (see for more on this point section 5). Third, obvi-
ously, in order to start a tort claim, person B has to be aware
of the fact that A made a deepfake about her, while this will
often not be the case.
4. Freedom of expression
Within the framework of the European Convention on Human
Rights, deepfakes should be discussed in the interplay be-
tween Article 8 ECHR, the right to privacy, and Article 10 ECHR,
the right to freedom of expression. The European Court of Hu-
man Rights has ruled that the right to privacy also includes
the right to the protection of one’s honour and reputation.83
On the other hand, the Court has ruled that the freedom of ex-
pression must be understood very broadly and also includes
the right to shock, offend and disturb.84 This includes sharing
personal opinions and characterisations85 and satire.86 Free-
dom of expression may also cover publishing a fictitious inter-
view.87 Thus, in the case of deepfakes of a potentially unlawful
nature, two parties will often be able to invoke two different
human rights. Because the Court sets few general rules and as-
sesses each individual case on its own merits, taking account
of the circumstances of the case, it is not possible to say in
general terms which one of these rights shall prevail when
deepfakes are published.88 Therefore, the framework of the
freedom of expression is in itself flexible enough to address
problematic deepfakes. Nevertheless, three issues deserve at-
tention.
• First, under the European Convention of Human Rights,
public figures can invoke their right to privacy in order
to protect their name, honour and reputation, even when
they actively seek the limelight. Yet the European Court
of Human Rights has also ruled that public figures must
tolerate greater intrusion into their private lives than or-
dinary citizens and must accept that they will be mocked
and ridiculed. This principle is widely supported and there
is no reason to alter it, yet with deepfakes, it might be con-
sidered to set out which types of deepfakes in general will
be deemed legitimate and which ones would not. This pro-
vides legal certainty to both citizens that want to ridicule
83
ECtHR, Pfeifer v. Austria, appl.no. 12556/03, 15 November
2007.ECtHR, A. v. Norway, appl.no. 28070/06, 09 April 2009. ECtHR,
Bogomolova v. Russia, appl.no. 13812/09, 20 June 2017.
84
ECtHR, Handyside v. the UK, appl.no. 5493/72, 07 December
1976.
85
ECtHR, Dink v. Turkey, appl.nos. 2668/07, 6102/08, 30079/08,
7072/09 and 7124/09, 14 September 2010.
86
ECtHR, Leroy v. France, appl.no. 36109/0302 October 2008.
87
ECtHR, Nikowitz and Verlagsgruppe News GMBH v. Austria,
appl.no. 5266/03, 22 Frebruary 2007.
88
Van der Sloot, B., ’Expectations of Privacy: The Three Tests De-
ployed by the European Court of Human Rights’, In: Hallinan, D.
Leenes, R. & De Hert, P., ’Data Protection and Privacy Enforcing
Rights in a Changing World’, Hart, Oxford, 2022.
 computer law & security review 46 (2022) 105716
politicians and to public figures that want to know whether
they stand a chance when going to court. In addition, it
should be borne in mind that although satire and ridicule
of public figures has been around for ages, the fact that
deepfakes can be highly realistic might have an impact be-
yond what was common before. It is already known that
many women avoid public office because they do not want
to be subject to misogynist and sexual statements on the
internet; the rise of deepfakes might aggravate this, which
might have the effect that qualified women relinquish op-
portunities to their male peers.
• Second, a fear is that deepfakes will take the post-truth
era to the next level, as it will be so easy for any citizen
around the world to create and disseminate a highly real-
istic deepfake within a minute or two. An untrue, inaccu-
rate or misleading statement can be addressed under the
current legal regime, but only if damage has been caused,
for example to personal interests (under tort law) or to cer-
tain social interests (under criminal law). Deepfakes chal-
lenge this regime on at least three points. First, it can be
difficult to substantiate the causal relationship between
an untrue, false, or misleading statement and the (fore-
seeable) harm it causes (e.g. the hatred a deepfake has in-
cited against minority groups). Second, untrue, inaccurate,
or misleading expressions can be problematic per sé be-
cause they blur the line between fact and fiction, even if
they do no concrete harm. Even if, say, a million deepfakes
spreading through social networks do no harm to personal
or societal interests, they certainly do deepen the post-
truth era, which may be deemed problematic in and by it-
self. Third, there are untrue, inaccurate, or misleading ex-
pressions that do cause harm, but that are very difficult to
link to a specific legal provisions. For example, fake satel-
lite images may be produced in which Russia appears to
move its nuclear missiles near the Latvian border. Or, fake
news may be distributed on Covid-19, leading to a decline
in people that want to get vaccinated. Or, a political leader
may distribute a video, making it look like there are thou-
sands of supporters at her rallies, while there were a hand-
ful only. These developments may force the European leg-
islator to choose between Skyla and Charybdis, between
staying clear from these complicated issues, which may
mean that the problem of misinformation will grow, and
adopting regulation on untrue, false or misleading state-
ments.
• Third, several states of the U.S.A. have passed laws on the
dissemination of misinformation during elections.89 Texas
was the first States to pass legislation on this point. It was
accepted that while this ‘technology likely cannot be con-
stitutionally banned altogether, but it can be narrowly lim-
ited to avoid what may be its greatest potential threat: the
electoral process.’90 That is why a new criminal offence
was created for creating and publishing a deepfake video
within 30 days of an election, where that person has the
intention of injuring a candidate or of influencing the re-
89
See also: <https://www.congress.gov/bill/117th-congress/
house-bill/1/actions>.
90
<https://capitol.texas.gov/tlodocs/86R/analysis/html/
SB00751F.htm>.
11
sult of an election. California allows politicians to file ac-
tion against a person who has created and disseminated a
deepfake within 60 days of an election with intent to injure
the candidates reputation, or to deceive a voter into voting
against the candidate.91 Because European countries are
just as vulnerable against foreign interference of elections
through the use of deepfakes, either national parliaments
or the EU should consider similar rules.
5. Ex ante regulation
Although specific additional provisions should be considered
in light of deepfakes, the main challenge lies in the oversight
and enforcement of the prevailing rules. Experts predict that
in four or five years’ time, more than 90% of all online con-
tent well be manipulated in whole or in part.92 Such often
concerns relatively minor manipulations: video call services
that equalise a person’s skin tones, audio that loses some of
its higher sound registers through compression, photo cam-
era’s that filter out red tones when burning forests are cap-
tured, because they ‘know’ that forests are green. Yet even
these smaller manipulations can be of great importance, for
example in the identification of a suspect or in an online med-
ical consultation with a dermatologist. In addition, there are
deepfakes that create a truly false picture of the world, where
the perpetrator has malignant intend.
Deepfake technology is expected to get cheaper, faster and
better over time. This will make it even more difficult for au-
tomated deepfake-detection programmes to filter out deep-
fakes. Currently, such systems have a hit score of about 65%;
experts expect this number to go down rather than up, not
only because the deepfakes themselves get increasingly more
realistic, but also because the ease with witch whole fake
media-environments can be generated. Not only can a deep-
fake video be created, but also fake twitter accounts that link
to the video, fake accounts on discussion forums that discuss
the content of the video, fake websites that host the video
and produce fake news reports on that what is shown in the
video, fake Instagram accounts that produce memes of the
fake video, etc. This makes it more difficult for both humans
and AI to detect deepfakes through contextual information.
Importantly, detection technologies will often only give an
’authenticity percentage’: e.g. the chance that this video is au-
thentic/not manipulated is 73%. This may create additional
problems, such as, but not limited to: at what ‘truth percent-
age’ can a newspaper or judge accept the reliability of the
source? Should there be different thresholds for public broad-
casters than for private ones and should there be different
standards for criminal law and civil law courts? Can internet
providers automatically block content that is presumably fake
and if so, at what percentage, or should personnel manually
check content, and if so at what percentage? It should also be
kept in mind that these detection programmes are not always
able to indicate what has been manipulated and how nor as-
91
California Elections Code – Division 20 Election Campaigns –
Chapter 1 Endorsement of Candidates - § 20010.
92
Schick, N. (2020). Deep Fakes and the Infocalypse: What You
Urgently Need To Know. Hachette UK.
12 computer law & security review 46 (2022) 105716
sess whether that manipulation is relevant to the context in
which it is shared. It may well be, for example, that a photo
shared online of a politician clearly drunk has been manipu-
lated, but it matters whether the fact that she appears clearly
drunk is due to manipulation or that the manipulation con-
cerns a detail in the picture. It will be difficult for anyone to
assess what has been manipulated, how and why when the
authentic photo, video, audio or other signal is absent.
Finally, it is clear that deepfake technology will be
democratised over the years. Currently, advanced deepfake
technology is mostly in the hands of commercial parties such
as the entertainment industry, the retail sector and the porn
business and of some state actors, for example to cause con-
fusion in other countries. However, already, consumers can
download deepfake apps and tools that are freely available.
Given the easy with which a deepfake can be produced, ex-
perts expect that in time, a deepfake app will be a standard
application on anyone’s phone, giving millions and millions
of people the opportunity to produce and spread false infor-
mation with the click of a button.
Although most problematic deepfakes will be prohibited,
either through the GDPR or through national criminal and
tort law, the question is how these rules can actually be en-
forced. Citizens have rights through which they can block or
remove unlawful content, but in practice, it is hard to get plat-
forms to remove content, let alone prevent copies from being
shared on other parts of the internet.93 Citizens often do not
even know that a malicious deepfake of them exists and is
available, for example on a dodgy porn website, and if they
know, legal proceedings often cost money and time they don’t
have, and may even attract more attention to the content they
want removed.94 The same holds true for law enforcement au-
thorities, such as the Public Prosecutor and the Data Protec-
tion Authority, who are already overburdened and often focus
on data processing operations by governmental organisations
and commercial parties, and not on data processing by citi-
zens.95 It is also questionable to what extent it is desirable for
such an authority to assess the veracity of content produced
93
Markou, C. (2015). The ‘Right to Be Forgotten’: Ten reasons why
it should be forgotten. In Reforming European Data Protection Law (pp.
203-226). Springer, Dordrecht. Urban, J. M., Schofield, B. L., & Kara-
ganis, J. (2017). Takedown in Two Worlds: An Empirical Analysis. J.
Copyright Soc’y USA, 64, 483. Jhaver, S., Bruckman, A., & Gilbert, E.
(2019). Does transparency in moderation really matter? User be-
havior after content removal explanations on reddit. Proceedings of
the ACM on Human-Computer Interaction, 3(CSCW), 1-27.
94
Van der Sloot, B. & Van Schendel, S., ’Procedural law for the
data-driven society’, Information & Communications Technology
Law, 2021. Schwartz, P., ’The Computer in German and American
Constitutional Law: Towards an American right of informational
self-determination’, The American Journal of Comparative Law, 37(4),
1989, 675-701. Cate, F. H. & Mayer-Schönberger, V. ‘Notice and con-
sent in a world of Big Data’, International Data Privacy Law, 3(2), 2013,
67-73. Barocas, S. & Nissenbaum, H., ‘On notice: The trouble with
notice and consent’, In Proceedings of the engaging data forum: The
first international forum on the application and management of personal
electronic information, 2009. Reidenberg, J. R., Russell, N. C., Callen, A.
J., Qasir, S., & Norton, T. B. (2015). Privacy harms and the effective-
ness of the notice and choice framework. ISJLP, 11, 485.
95
Graham, G., & Hurst, A. (2019). GDPR enforcement: How are EU
regulators flexing their muscles?. IQ: The RIM Quarterly, 35(3), 20-
by citizens, as it would significantly extent their power and
require them to determine what is true and what is not.
In addition, both for these authorities and for internet in-
termediaries, there is a number of complex legal questions
with deepfakes, such as, but not limited to: Are personal data
processed? Is there a legitimate basis for processing of the
data? Does an exception to the privacy and data protection
regime apply in the context of freedom of expression? How
should conflicting interests of citizens be assessed and are
there general, societal interests at stake with the free flow of
information? Which legal regime applies to the publication of
a deepfake when multiple jurisdiction may play a role (e.g.
data controller in the EU, internet site based in the U.S.A and
the data subject based in China) and how should such a party
deal with conflicting rules and requirements?
It should be kept in mind that under the current regu-
latory regime for internet intermediary liability under the
e-Commerce Directive,96 there is no filtering obligation and
there is even a prohibition for countries to apply monitoring
duties to these intermediaries. This is confirmed by the pro-
posed for the Digital Services Act,97 that will replace the e-
Commerce regime in time. Though there are additional rules,
standards and requirements for hosting providers, the DSA is
still primarily based on a notice and action (formerly known
as notice and take down) regime. In addition, it reaffirms the
prohibition on monitoring obligations: ‘No general obligation
to monitor the information which providers of intermediary
services transmit or store, nor actively to seek facts or circum-
stances indicating illegal activity shall be imposed on those
providers.’98 This means that although some internet plat-
forms do scan for deepfakes, states cannot oblige them to. In
addition, providers only have to take action when there are
signs that content is unlawful, which again places a large bur-
den on citizens or trusted flaggers.99
This means that it cannot be excluded that indeed, the pre-
diction that in a few years’ time, more than 90% of all on-
line content will be wholly or partly manipulated may well
come true. Given not only the significant personal interests at
stake, but the risks for democracy, the rule of law, the well-
functioning of the press and an inclusive society (section 2),
such may be found undesirable. But in order to tackle this is-
sue, a core approach to the regulation of technology should be
reconsidered. In general, the choice is for ex post regulation in
a dual way. Technology, in general, is not prohibited or banned
from the market and the use of technology is generally not as-
sess before or when it is used, but after. This means that there
are very few hurdles before producing a deepfake and sharing
it online; only then may the deepfake be assessed on legiti-
macy and legal action be taken. This means not only that the
24. Koops, B. J. (2014). The trouble with European data protection
law. International data privacy law, 4(4), 250-261.
96
Directive 2000/31/EC of the European Parliament and of the
Council of 8 June 2000 on certain legal aspects of information so-
ciety services, in particular electronic commerce, in the Internal
Market.
97
Proposal for a Regulation of the European Parliament and of the
Council on a Single Market For Digital Services (Digital Services
Act) and amending Directive 2000/31/EC COM/2020/825 final.
98
Article 7 DSA.
99
Article 19 DSA.
 computer law & security review 46 (2022) 105716
harm has already materialised; it is precisely the choice for ex
post regulation that allows the quantity of deepfakes that are
produced and shared on the internet to rise to a point where
no one is able to adequately assess but the extreme and clearly
unlawful ones.
Though it is clear that the current regulatory approach is
unable to adequately address the problems concerned with
deepfakes specifically and synthetic media in general and in a
certain sense is the cause of those problems, a solution would
mean the introduction of ex ante regulation, which is politi-
cally sensitive. Yet, three regulatory alternatives should be se-
riously considered.
• First, banning technologies and products is a sensitive is-
sue. Every technology has positive use cases; it is precisely
through the frequent use of a technology that previously
unforeseen possibilities can be explored and both citizens
and companies usually want technologies to be available to
them. This will not be different with deepfakes. Yet, there
may be an argument for prohibiting deepfake technologies
and applications from the consumer market. This would
allow organisations and professionals to use the technol-
ogy for specific means, such as the retail sector, the enter-
tainment industry and video-call applications, but prevent
billions of citizens from the possibility of creating deep-
fakes. This would prevent the digital environment from be-
coming synthetic and limit the use of deepfakes to specific
controlled environments such as a movie, a business call
and a webstore. It would allow the commercial value of
the technology to be utilised in full. Though it might be re-
garded as stifling, there is only one type of use of deepfakes
by citizens that is valuable and positive, and that is its used
for satire and humour. Though it is a loss that they cannot
produce funny fake video’s, given the societal interests at
stake, this may be considered a minor loss. An additional
reason for such a ban is that 96% of all deepfakes current
concern non-consensual porn, which is clearly unlawful,
in addition to other malignant uses for fraud, identity theft
and slander. Technologies are not neutral, they enable cer-
tain practices and when a tool such as deepfake technology
is almost certainly to be used for unlawful practices, such
may be considered a reason for limiting access to it.100
• Second, instead of or in addition to this option, an ex
ante test for the legitimacy could be introduced. Such a
test could be imposed on citizens, for example by requir-
ing them to perform a Data Protection Impact Assess-
ment when producing a Deepfake.101 When they would
find there a high risk to be at stake, they would then have
to inform their national Data Protection Authority, which
would then have to assess whether the deepfake could
be published.102 Although this is a theoretical solution, it
is questionable whether this would work in practice, both
because it is unlikely that citizens will actually adhere to
100
See e.g. Latour, B. (1993). We have never been modern. Harvard
University Press. Borgmann, A. Technology and the Character of
Contemporary Life, University of Chicago Press, 1984.
101
Article 35 GDPR.
102
Article 36 GDPR.
13
such a duty and because the DPA would not have the re-
sources necessary to assess every deepfake on its legiti-
macy. An alternative could be imposing an obligation on
internet intermediaries to monitor their services for deep-
fakes and to block (harmful) deepfakes. This would require
an amendment to the Digital Service Act. For example, in-
ternet intermediaries could be made to deploy deepfake
detection techniques and block any content that is likely
fake. Though this would not filter out all fake content,
it would certain reduce the number of deepfakes signifi-
cantly.
• Thirdly, specific rules could be considered for legal pro-
ceedings. Especially in criminal cases, the fact alone that
someone is prosecuted may have a significant impact on
her personal and professional life. In addition, citizens are
already producing deepfakes in civil law proceedings. Most
legal systems have no systems in place for checking evi-
dence on authenticity before they are introduced in court.
Judges mostly presume evidence, such as a video, to be au-
thentic, unless there are contra-indications. This means
that it is mostly up to the defendant or, in civil law proceed-
ings, the opposing party to claim and possibly prove that
evidence has been manipulated or fabricated. The ques-
tion is whether this is desirable, on the one hand because
it entails the privatisation of a general problem and on
the other because a citizen will not always be able to dis-
pute the veracity and accuracy of evidence. This may be so
not only when suspects are convicted in absentia, but also
when people suffer from mental disorders. In addition, it
can be costly to obtain the technical expertise necessary to
demonstrate that evidence is or may be inauthentic, which
might have the effect that weaker parties will be disadvan-
taged even more. That is why a rule could be introduced
that evidence may only be introduced in court after it has
been assessed for authenticity, for example by the National
Forensic Service or another organ. This would involve eco-
nomic costs, but would prevent significant personal and
societal harm.
6. Conclusion
It is clear that deepfake technology will become more popu-
lar in the coming years. Although there are positive use cases
for this technology, deepfakes can have a major negative im-
pact, not only on personal interests, but also on social insti-
tutions. These involve fraud, identity theft and reputational
harm and undermining the media, the rule of law and democ-
racy. The legal regime already regulates and prohibits most
harmful deepfakes. The main problem regarding deepfakes is
an enforcement problem. Therefore, in the context of deep-
fakes, consideration could be given to ex ante regulation, ei-
ther by prohibiting the production, offering, use or possession
of deepfake technology for the consumer market or by intro-
ducing a mandatory ex ante legitimacy test, which should be
carried out before any material is published and/or distributed
by citizens. An ex ante test could also be required before ma-
terial could be introduced in court.
14 computer law & security review 46 (2022) 105716
Yet the question is whether these regulatory options are
desirable.
• First, there is the question of the enforceability of such
rules. Deepfake technology will always be accessible to
citizens, for example through websites offered from third
countries. How effective a ban would be will have to be as-
sessed before it is introduced.
• Second, there is the question of the desirability of such
a ban. Do we want a society in which technologies are
banned; would such a choice not be an expression of mis-
trust in citizens’ and deprive them of a valuable means of
expression?
• Third, the question is whether the underlying reason for
introducing such a ban would remain valid. While it is cur-
rently the case that the vast majority of deepfakes are un-
lawful in nature, this need not be the case in the future.
Social and ethical codes for the use of a technology are usu-
ally developed gradually after it is introduced. The fact that
such norms are not yet present or dominant with regard
to deepfakes does not mean much, as the technology has
only been in use for a few years. Thus even if left legally
unregulated, social and ethical norms may shift the use of
deepfake technology over time.
• Fourth and finally, ex ante rules would not remove the un-
derlying problem. There is a social problem with misogyny,
especially online; restricting deepfake technology does not
take away that problem, but only one of the means to ad-
vance misogynous expressions. There is a social problem
with fake news and the blurring of fact and fiction; this
trend is likely to continue even without deepfakes. Foreign
powers seek to influence the outcome of democratic elec-
tions, deepfakes are only a small part of their extensive ar-
senal. Etc.
Consequently, there are both very strong reasons to seri-
ously consider ex ante rules and strong reasons not to. The
final decision will have to be made on the basis of an exten-
sive social and political debate. The same applies to the other
regulatory options, such as limiting the household exemption.
Regulating what people do in their private lives may be desir-
able in order to curb the production of intrinsically punishable
or undesirable material, and it may also help to prevent such
material from being produced and then distributed to a wide
audience and/or on various websites by addressing the prob-
lem at the source. Yet the following questions could be asked:
• Do we want to move towards a society in which what citi-
zens do in the privacy of their homes is regulated?
• Do we want DPAs to scrutinize citizens’ private behaviour?
Isn’t the cure worse than the disease?
• Isn’t the enforcement problem actually increased because
the government (DPA, police, etc) have insufficient means
and manpower already, let alone the means and manpower
to also supervise the private lives of citizens?
The same hesitations apply to the potential rules restrict-
ing online expression. It is clear that deepfakes can have a
detrimental effect on the functioning of the media, that fake
news can influence democratic elections and that deepfakes
about public figures can contribute to qualified people giving
up public office or not running for office. Therefore, it could be
examined to what extent additional rules can be set for state-
ments about public persons, who now have to tolerate more
than private persons, in order to offer them more protection
against unwanted and untrue statements by citizens. It can
also be considered to what extent the spread of fake news and
the influencing of democratic elections or political decision-
making by means of fake news can be addressed more force-
fully. An additional argument for the introduction of further
rules on this point is that not all malicious statements can be
tackled at present, since the making of untrue statements is
not prohibited per se. An untrue, incorrect or misleading ex-
pression can be addressed under the current regime, but only
if damage is caused, for example to personal interests (un-
der the tort law) or to certain social interests, such as when
inciting hatred against minorities (under criminal law). New
rules can create more clarity regarding the lawfulness of those
expressions that cannot be directly related to such interests.
Yet, here too, arguments can be furthered against more and
stricter rules:
• Additional rules on statements concerning public persons
or untrue statements during democratic elections may be
considered undesirable because they may cripple the free
and open debate that is so essential to a democratic con-
stitutional state.
• On a related point, satire with respect to politicians and
public officials, also during elections, can be viewed an im-
portant asset and essential part of the free democratic de-
bate.
• It is also highly questionable to what extent it is desirable
for the government to interfere with and ultimately deter-
mine what is true and what is not; this was precisely Or-
well’s fear.
Finally, there are two new(er) issues for which more de-
tailed rules may be considered, but for which the answer to
what should be allowed and what not depends on political
preference or the ethical point of view. This concerns the
deepfakes of deceased persons and deepfakes of fictitious per-
sons. Some examples of were different views may arise in-
clude, but are not limited to:
• Some perceive the idea that Napoleon would give a history
lesson in secondary schools a nice prospect, others find it
problematic because children would be confronted at an
early age with blurred lines between fact and fiction.
• Some find it positive would the police infiltrate child porn
networks by means of deepfakes or if paedophiles could
be treated by means of fake child-porn, others find it un-
desirable if the government deploys such means and con-
tributes to a post-truth world.
• Some think that a partner of a deceased can decide for her-
self whether she wants to continue communicating with
 computer law & security review 46 (2022) 105716 15

the deceased, others think that there should be legal lim-

its and strong protection of post-mortem privacy.
Declaration of Competing Interest
• Some think that a deepfake of a politician who appears to
The authors declare that they have no known competing fi-
be giving a speech in the language of a country’s minority
nancial interests or personal relationships that could have ap-
is desirable with a view to inclusion, others find it voter
peared to influence the work reported in this paper.
deception.

Data Availability
In short, there are enough complex issues for a societal and
political debate on future regulation, which should preferably No data was used for the research described in the article.
take place sooner rather than later, given the speed at which
deepfake technology is developing and its potential impact on
society and democratic institutions.