AI deepfake laws are being written faster than most operators are reading them, and the people they target are not the ones running a fictional AI persona. They target anyone who makes sexual, deceptive or non-consensual synthetic media of a real person. That distinction is the whole game for an AI creator business. This guide covers what the main US, UK and EU rules actually say in 2026, where an original persona sits relative to them, and the three habits that keep an operator clear of the line. It is general information, not legal advice.
What counts as a deepfake in law?
Statutes rarely use the word “deepfake”. The US federal TAKE IT DOWN Act talks about a “digital forgery”: an intimate visual depiction of an identifiable person that was created or altered with software, AI included, so that it appears authentic. UK law talks about images that “show or appear to show” a person. The EU AI Act defines a deep fake as AI-generated or manipulated content that resembles real people, objects or events and would falsely appear authentic.
Every one of those definitions needs a real, identifiable person or real-world thing to be imitated. A face that belongs to nobody is not a forgery of anybody.
That is why an original persona, built from scratch and not modelled on a real individual, is outside the core of these laws. It is also why the risk concentrates in a few specific workflows: face-swapping a real person’s photo onto generated content, training a model on a real person’s pictures without their permission, and building a persona so close to a real creator that fans could mistake one for the other.
What does US law say about deepfakes?
There is still no single federal deepfake statute covering everything. What exists is a patchwork, anchored by one significant law.
The TAKE IT DOWN Act was signed in May 2025. It makes it a federal crime to knowingly publish non-consensual intimate imagery, including AI-generated digital forgeries, and it requires covered platforms to run a notice-and-removal process and take reported material down within 48 hours of a valid request. The platform duties began applying a year after signing, so by mid-2026 they are live. The FTC enforces the platform side.
For an operator, the practical effect arrives through the platforms rather than a courtroom. Fan platforms now have a legal reason to act quickly on any report that a profile depicts a real person, and an account that triggers one can be frozen long before anyone argues the merits. If your payouts sit on a single platform, a takedown is a business risk before it is a legal one. The platform-rules angle is worth reading alongside this.
Below the federal level, dozens of states have passed laws on sexual deepfakes, election deepfakes or both, and the penalties and definitions differ state to state. Tennessee’s ELVIS Act, passed in 2024, goes a different direction and protects a person’s voice and likeness from unauthorised AI replication. A federal likeness bill, the NO FAKES Act, has been proposed but, at the time of writing, is not law.
Two things follow. A persona with an invented face and a synthetic voice that does not clone anyone is not what these statutes describe. And a voice cloned from a real person without permission is a live legal problem in at least some states, so voice deserves the same care as the face.
How do UK deepfake laws work?
The UK took the criminal route first. The Online Safety Act 2023 created offences covering the sharing of intimate images without consent, and those offences were drafted to include images that appear to show a real person even when they were synthesised. A further offence aimed at creating or requesting sexually explicit deepfakes was legislated in 2025. Commencement of individual provisions has been staged, so check the current status on legislation.gov.uk before relying on a particular date.
The UK also has a second layer that matters more to commercial operators: advertising and consumer rules. The ASA and CMA expect clear disclosure when content is a paid promotion, and a synthetic person promoting something is subject to the same standard as a human one. If you run a UK-facing persona, the point where deepfake law and disclosure law overlap is honest labelling. The disclosure and tax questions are covered separately.
What does the EU AI Act require?
The EU AI Act is the one regulation here that regulates deepfakes as a category rather than punishing a particular harm. Article 50 requires anyone deploying an AI system that generates or manipulates image, audio or video content constituting a deep fake to disclose that the content has been artificially generated or manipulated. The transparency obligations are scheduled to apply from August 2026, although parts of the wider Act have been the subject of postponement proposals, so confirm the current timetable.
There is a nuance worth knowing. The disclosure duty attaches to content that resembles existing people, objects or events. A wholly fictional AI character is not obviously a deep fake in the Act’s sense, but regulators and platforms are moving toward expecting machine-readable marking of AI output anyway. An operator selling into the EU should assume labelling will be required in practice, whatever the strict reading.
Where does an original AI persona sit?
On the statutes as written, an original persona with no real counterpart is lower risk than most people assume. The exposure shows up in the gaps between the law and how people actually build personas. Four situations cause nearly all the trouble:
- Face-swapping a real photo. Putting a real person’s face on generated body content is the textbook non-consensual forgery. Consent from the person pictured, in writing, is the only safe version, and consent to a photo is not consent to sexual content.
- Training on a real person’s images. A custom model trained on a real individual’s pictures can reproduce them. If the output is recognisable, the persona is that person for legal purposes.
- Accidental lookalikes. Generators drift toward certain faces. A persona that happens to resemble a known creator or a celebrity invites a complaint even if no one copied anyone. Building a stable, distinct character from a unique seed face reduces that risk.
- Using a real person’s name or backstory. A persona called after a real creator, or borrowing her biography, is a likeness problem even if every pixel is original.
Copyright is a separate question. Whether anyone owns the images a model produces is covered in the AI-generated content copyright guide.
What should an operator actually do?
Compliance here is mostly process, and the process is cheap compared with a frozen account.
- Start from an invented identity. Decide the face, name and backstory on purpose and record how they were created. If a complaint ever lands, a dated record of an original character is the best evidence you have.
- Run a lookalike check. Reverse-image search a handful of the persona’s best images before launch, and repeat when the style changes. Ten minutes catches the obvious collisions.
- Never use a real person’s face or voice without written, specific consent. If you offer a digital-twin service for a client’s own likeness, get the consent in a signed document that names the use, including adult content if that is the intent.
- Label where the rules ask for it. Use the platform’s AI-content toggle where one exists, and add a plain line in the bio. Labelling costs a sliver of mystique and removes the largest category of dispute.
- Keep a takedown routine. Know where each platform’s report channel is, and answer within a day. The 48-hour rule means platforms will not wait for you.
Anonymity and legal accountability pull in opposite directions here, and operators often miss it. A business that hides its owner still needs a legal entity that can receive a notice and respond to it. An anonymous LLC is the usual way to keep the owner private while keeping the business answerable.
How will this change?
Deepfake laws in 2026 are still moving, and the direction is tighter, not looser. Courts and legislators are treating sexual deepfakes as a harm in their own right, and labelling is becoming the default expectation for synthetic media. Operators who built on an original character, documented where it came from, and kept consent paperwork for anything involving a real face will find new rules mostly confirm what they already do. Those who built on borrowed faces will find them expensive.
Check the primary sources above when you plan a launch in a new country, because the details here have moved several times in the last two years and will move again.
A persona built from an original character, with a documented origin, is the cleanest setup under all of these rules. Get your AI creator built for you.
