Deepfake Pornography and German Criminal Law: Protection Gaps, Legal Frameworks and the Fight Against Non-Consensual Sexualized Deepfakes

Non-consensual sexualized deepfakes are far from isolated incidents. When victims of intimate image abuse come forward, they are too often met with blame, with the suggestion that they should simply not have shared such images in the first place. Researchers such as Nivedita Prasad describe a troubling revival of victim blaming in digital gender-based violence. Such reasoning ignores a fundamental shift: digitalization has created new forms of punishable harm. Audiovisual content online no longer necessarily depicts real events, because artificial intelligence can now manipulate images, audio and video with unprecedented realism. This makes it all the more important to understand how criminal law protects people against these practices, and where its gaps lie.

Deepfake pornography must be understood within the broader context of image-based sexual violence. Scholars Clare McGlynn and Erika Rackley shaped this framework, and in the German-speaking context the term refers to creating, distributing and using intimate or sexually connotated images of a person without their consent. Such material typically shows nudity or underwear-clad genitals, breasts, or intimate poses and activities, and is usually framed in a sexualized, defamatory manner. AI tools now allow manipulation of existing material with a quality that is often impossible to detect with the naked eye, producing convincingly realistic pornographic content.

Deepfakes affect everyone, but not equally. The growing supply of easy-to-use deepfake apps allows people without technical expertise to create them. Anyone whose images or videos are publicly available online, for example on social networks, can be targeted. Perpetrators also draw on privately shared content obtained with consent, as well as material accessed without authorization. Analyses show that pornographic deepfakes vastly outnumber non-pornographic ones; a 2020 report by Sensity attributed up to 93% of deepfake content to pornography. An intersectional perspective reveals that women and marginalized groups are particularly affected. A 2019 analysis by Deeptrace found that all pornographic deepfake videos depicted women, while non-pornographic videos were more evenly split. Public figures, including politicians, scientists, activists and entertainment industry women, are especially at risk. The consequences are severe at both societal and individual levels: on a societal level, the silencing effect pushes diverse voices out of online spaces and threatens democratic discourse; on an individual level, it can cause lasting psychological and physical harm through degrading sexualized objectification.

Deepfake pornography spreads through many channels. Beyond private communication via WhatsApp, email and SMS, it circulates on non-pornographic platforms such as social networks and dating sites, on mainstream pornography websites, and on dedicated revenge-pornography platforms. Its spread is fuelled by misogynistic groups, such as the Incel movement, which seek to spread hostility toward women online. Researchers Jenny-Kerstin Bauer and Ans Hartmann describe this as a deliberately chosen, woman-hostile and violent milieu. Because of the intimate and largely uncontrollable nature of this content, victims face a heightened risk of repeated, prolonged or even permanent victimization.

Legal assessment requires distinguishing harmless deepfakes from deliberately harmful ones. The boundary is often blurred. Popular face-swapping tools, for instance, can be used for humor or artistic purposes, yet they are also widely misused to place the faces of actresses onto pornographic performers. The rights at stake are not only those of the person whose original material is used, but also those of the person whose face is inserted into a new, sexualized context. Harmless uses typically rely on the consent of the depicted persons. Consent-based science-fiction pornography, for example, is a recognized category on some platforms. Without consent, however, creating and using deepfake pornography can infringe copyright under § 106 UrhG in conjunction with § 108 UrhG, or the right to one's own image under Art. 2(1) and Art. 1(1) GG and §§ 22 f. KUG in conjunction with § 33 KUG. Satirical or humorous deepfakes, such as memes, require case-by-case balancing between the expressing party's freedom of expression and the affected person's personality rights. Because deepfake pornography intrudes on intimacy, it usually violates the right to sexual self-determination under Art. 2(1) GG, which can outweigh freedom of expression.

The core of harmful deepfake pornography is that its content is created, distributed or otherwise used without the consent of the depicted persons. Such conduct can violate the right to sexual self-determination and general personality rights. German criminal protection stems primarily from the Strafgesetzbuch (StGB), a code written for the analog world. As a result, protection is spread across numerous provisions, many of them shaped by individual cases, and which applicable offence applies depends on the specific circumstances. Where deepfakes contain depictions of violence, § 131(1) Nos. 1 and 2 StGB may apply, as may § 184a StGB concerning violent pornographic content. It remains unsettled whether these provisions cover AI-manipulated, fictional depictions or only real ones. The distribution of sexualized deepfakes, though not necessarily their creation, may fall under § 201a(1) Nos. 1 and 4 and (2) StGB, which protects the highly personal sphere and image rights. Distribution may also constitute the dissemination of pornographic content under § 184 StGB. Creation and distribution may further trigger the insult offences in §§ 185 ff. StGB. It is still unclear whether § 184k StGB, on violations of intimate privacy through image recordings, applies to deepfake pornography.

Deepfake pornography is frequently accompanied by other criminal acts. Insulting comments may be punishable, as may hacking to obtain material, which falls under § 202a(1) StGB on data espionage. Sextortion can constitute sexual coercion under § 177 StGB or extortion under § 253 StGB, while doxing, the endangering dissemination of personal data, may be punishable under § 126a StGB. A gender-specific perspective adds another dimension. Under § 46(2) StGB, a gender-specific motive can serve as an aggravating factor in sentencing. Offences directed against women because of their gender can therefore be penalized more severely within the statutory range.

In July 2024, the Bundesrat responded to serious gaps in protection and the growing dangers posed by deepfakes by passing a draft law on the criminal protection of personality rights. The proposal would create a new offence, 'Violation of personality rights through digital forgery' under § 201b StGB. A further planned law against digital violence aims to help victims enforce their rights in court. Together, these measures signal an effort to close the fragmentation of current law and make protection against digital forgeries more coherent.

Beyond national law, international and EU rules play an important role. EU law takes precedence over national law in Member States. A key challenge is holding platform operators and developers of AI systems accountable, since the anonymity of many users who spread such content makes removal and prosecution difficult. The Digital Services Act (DSA), in force since November 2022 and implemented in Germany through the Digitale-Dienste-Gesetz (DDG), imposes obligations on large online platforms and search engines, including a notice procedure to facilitate the removal of illegal content and protect users. The AI Act, in force since August 2024, follows a risk-based approach. However, deepfake software is classified only as an AI system with limited risk, meaning comparatively modest transparency obligations apply. In addition, Article 7 of the Directive on combating violence against women and domestic violence, in force since June 2024, covers the non-consensual production and sharing of intimate or manipulated material, reflecting the particular exposure of women and marginalized groups to digital violence.

The incomplete protection against the creation of non-consensual sexualized deepfakes and other forms of image-based sexual violence against adults leaves significant gaps that burden victims. Given the particular exposure of women and marginalized groups, combating these practices is essential to preserving diversity on the internet. At the same time, recently enacted and forthcoming national and international laws, together with growing social awareness, offer grounds for hope. Those who wonder whether they appear in deepfake pornography can use AI detection tools to check. Victims are not left alone: beyond legal counselling, support organizations such as HateAid are available to help them.