Stay updated with the latest ınsıghts ın law and technology
Deepfakes and the Right to One’s Own Identity: Is EU Law Keeping Up?
10/13/20264 min read
Understanding Deepfakes and Digital Identity
Imagine finding a video of yourself on social media in which you say something you have never said. Your face and voice look completely real, but the video is fake. What would happen if thousands of people watched it before you could explain the truth?
This is one of the problems created by deepfake technology. Artificial intelligence now makes it possible to create realistic videos, images, and audio recordings of people without their knowledge. While this technology can be useful for entertainment and creative projects, it can also be used for fraud, harassment, and damaging someone's reputation. But there is another important issue: what happens when someone uses your identity without your permission? As deepfake technology becomes more advanced, it is worth asking whether European Union law provides enough protection for individuals.
The EU AI Act: Is Transparency Enough?
The European Union has taken steps to address deepfakes through the Artificial Intelligence Act (AI Act), officially known as Regulation (EU) 2024/1689.
Article 50 introduces transparency requirements for certain AI-generated and manipulated content. In general, relevant providers must ensure that synthetic outputs can be identified as artificially generated, while people using AI to create or manipulate deepfake images, videos, and audio must disclose their artificial nature, subject to applicable exceptions. These transparency obligations became applicable on 2 August 2026, although a limited transition period applies to certain marking requirements for systems placed on the market before that date.
This is an important development, but is it enough?
Imagine that someone creates a fake video using your face and shares it online. Even if the video is clearly labelled as AI-generated, your identity is still being used without your permission. The label may help viewers understand that the video is not real, but it does not automatically prevent the harm caused by its creation or distribution. In other words, identifying a deepfake and protecting the person shown in it are two different things. This is one of the main limitations of relying on transparency alone.
GDPR and the Protection of Personal Identity
The General Data Protection Regulation (GDPR) is another important part of the European legal framework. Under Article 4(1), personal data includes information relating to an identified or identifiable individual. This can include images and voice recordings when they relate to an identifiable person.
Article 6 requires personal data processing to have a lawful basis. Consent is one possible basis, although it is not the only one. Similarly, not every image or voice recording automatically qualifies as special-category biometric data under Article 9. The GDPR also provides certain rights to individuals, including the right to request the erasure of personal data under Article 17 when the relevant conditions are met.
However, there are practical difficulties. A deepfake can be shared across several platforms in a short period of time. Even if the original video is removed, copies may continue circulating online. For the person affected, obtaining an effective remedy can therefore be difficult. Furthermore, data protection law does not necessarily cover every aspect of reputational damage or the unauthorised commercial use of someone's image. Depending on the circumstances, national laws protecting personality and image rights may also apply.
This shows that legal protection is not only about having rights on paper. People also need practical ways to exercise those rights.
Who Should Be Responsible for Deepfake Harm
Another important question concerns responsibility. If a deepfake damages someone's reputation, who should be held accountable? Is it the person who created the video, the person who shared it, or the platform where it appeared?
The answer depends on the circumstances and the applicable law. The Digital Services Act (DSA), for example, establishes obligations for online platforms, including procedures for notifying them of allegedly illegal content. However, this does not mean that platforms are automatically liable for every deepfake uploaded by their users.
A more effective approach should combine clear transparency requirements with accessible reporting procedures and appropriate legal remedies. The responsibilities of creators, distributors, and platforms should be assessed according to their actions and applicable legal obligations.
At the same time, it is important to remember that not every deepfake is harmful or unlawful. Artificially generated content can be used for satire, political commentary, and artistic expression. Regulations must therefore protect individuals without unnecessarily restricting freedom of expression or technological innovation.
Is EU Law Keeping Up with Deepfake Technology?
The EU has already established important protections through the AI Act, GDPR, and fundamental rights law. Nevertheless, deepfake technology continues to create challenges, particularly when content spreads rapidly and causes harm before legal action can be taken.
In my view, the main issue is that transparency does not always provide sufficient protection. Knowing that a video is artificial does not necessarily solve the problem when someone's identity has been used without lawful justification.
European law should therefore continue developing practical ways for individuals to challenge harmful deepfakes, obtain appropriate remedies, and protect their identity. At the same time, the law must distinguish between unlawful impersonation and legitimate creative expression.
Conclusion
Deepfake technology is changing how people understand authenticity and personal identity online. Although the EU has introduced important legal safeguards, questions remain about consent, responsibility, and the effectiveness of existing remedies.
The AI Act's transparency requirements are a useful step, but they cannot solve every problem associated with deepfakes. Protecting individuals requires a broader approach that combines transparency, data protection, personal rights, and effective enforcement. Ultimately, the question is not simply whether people can recognise a deepfake, but whether they can protect their identity when someone else uses it without lawful justification.
References and Further Reading
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 50.
Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4, 6, 9 and 17.
Charter of Fundamental Rights of the European Union, Articles 7, 8 and 11.
Regulation (EU) 2022/2065 (Digital Services Act).
Łukasz Łabuz, ‘Deep Fakes and the Artificial Intelligence Act—An Important Signal or a Missed Opportunity?’ (2024) 16(4) Policy & Internet 783–800.