Deepfake and Synthetic Media Laws Map: Labelling, Takedown and Likeness Rules by Country

Deepfake law is no longer one rule but five different kinds of rule, and a single AI video feature can fall under all of them in different countries at once. Some laws make providers mark AI output, some make platforms remove intimate deepfakes within hours, some create a right over a person's voice and likeness, some regulate election content, and some simply make creation a crime. This map sets out the main laws in the EU, the US (federal and state), the UK, China, India, South Korea, Australia and Denmark, what each requires and of whom, and their status. It then turns the obligations into controls for AI product teams, trust and safety teams, security and fraud teams and legal counsel. Status as of 11 November 2026; bills are marked as bills.

Source note: this map summarises official texts, regulator guidance and the sources listed at the end, with status as of 11 November 2026. It is not legal advice. Confirm against the official text before relying on it.

Key takeaways

• Labelling is binding in the EU, China and India. China has required visible and metadata labels since 1 September 2025, India since 20 February 2026, and EU AI Act Article 50 transparency duties apply from 2 August 2026.
• Takedown clocks are measured in hours. The US TAKE IT DOWN Act requires removal of non-consensual intimate depictions within 48 hours of a valid request; India requires 2 hours for intimate imagery complaints.
• Creating, not only sharing, is now a crime in places. England and Wales criminalised creating or requesting a purported intimate image of an adult from 6 February 2026, and South Korea penalises possessing or viewing deepfake sexual material.
• Likeness rights are still mostly proposals. The US NO FAKES Act cleared the Senate Judiciary Committee in June 2026 and Denmark's copyright bill was introduced in October 2026; neither is law.
• Fraud deepfakes are covered by existing law. Voice and video impersonation for payment fraud is prosecuted under fraud statutes; for organisations the duty is control design, not a new deepfake statute.

Regulations and frameworks at a glance

For the full India rules, see the India IT Rules 2026 Amendment Guide; for the US platform duties, see the TAKE IT DOWN Act guide; for EU marking practice, see the EU Code of Practice on Marking and Labelling AI-Generated Content Guide.

Scope: who and what is covered

The five types of deepfake law

Definitions differ

The scope test is usually realism, not the tool. The TAKE IT DOWN Act defines a digital forgery as an intimate depiction of an identifiable person created or altered with software, AI or other computer-generated means that, to a reasonable viewer, is indistinguishable from an authentic depiction. India's rules cover audio, visual or audio-visual content that appears real and is likely to be perceived as a real person or event. The EU AI Act defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to be authentic. China's labelling measures go furthest and also cover text and virtual scenes.

Key obligations

For providers of generation tools

• Machine-readable marking: EU Article 50(2) requires output to be marked in a machine-readable format and detectable as artificially generated. China requires implicit labels in file metadata with the provider's name or code and a content number, and encourages watermarks. India requires permanent metadata with a unique identifier where technically feasible.
• Visible labels: China requires explicit labels a user can perceive, kept on downloaded or exported content. India requires a prominent visible label on visual content and an audio disclosure for audio.
• Prohibited outputs: from 2 December 2026, EU providers may not place on the market AI systems that generate CSAM or non-consensual intimate material.

For platforms that host user content

• Notice and removal: US covered platforms must remove reported intimate depictions, including digital forgeries, within 48 hours and make reasonable efforts to remove known identical copies.
• Label checking: China requires dissemination platforms to read implicit labels, add notices around labelled or suspected synthetic content and offer users a declaration tool; app stores must check apps that offer generation.
• Declarations: India's significant social media intermediaries must collect a user declaration, verify it with technical measures and label confirmed synthetic content before publication.

For deployers and ordinary organisations

• Disclosure: EU deployers who publish deepfake content must disclose that it is artificially generated or manipulated, with lighter rules for evidently artistic, satirical or fictional work.
• Marketing and internal use: using a synthetic voice or face of a real person in advertising engages likeness rights where they exist, and consumer protection law everywhere.
• Do not strip labels: China's Article 10 bans removing, altering or forging labels and supplying tools to do so. Editing pipelines that strip metadata can breach this.

Timeline and current status

• September 2024: South Korea passes penalties for possessing and viewing deepfake sexual material; Australia's Deepfake Sexual Material Act becomes Act No. 78 of 2024.
• 19 May 2025: TAKE IT DOWN Act enacted.
• 1 September 2025: China's labelling measures take effect.
• 6 February 2026: creating and requesting offences in England and Wales commence.
• 20 February 2026: India's SGI amendment takes effect.
• 19 May 2026: FTC begins enforcing TAKE IT DOWN platform duties and opens TakeItDown.ftc.gov for complaints.
• 18 June 2026: Senate Judiciary Committee approves the NO FAKES Act by voice vote; the House companion has not been marked up.
• 24 July 2026: the EU Digital Omnibus on AI is published in the Official Journal.
• 2 August 2026: EU Article 50 transparency duties apply.
• October 2026: Denmark introduces its face and voice copyright bill.
• 2 December 2026: EU prohibition on CSAM and non-consensual intimate imagery generators and transitional Article 50(2) date for certain existing systems.

Watch next: NO FAKES floor votes, Danish parliamentary passage, EU harmonised standards for marking, and transposition of the EU directive on combating violence against women, which also addresses deepfake intimate images.

Enforcement and penalties

What it means for AI agents and non-human identities

• Agents that generate media are providers or deployers: an AI agent that produces marketing video, voice responses or images in the EU or China needs marking and labelling built into its output pipeline, not added by hand.
• Agents that publish need disclosure: a voice agent that sounds like a real employee or customer is a deepfake under the EU definition if it would falsely appear authentic. Disclose at the start of the interaction.
• Deepfakes defeat human verification: a cloned voice or face can pass a help desk check, start a credential reset and hand an attacker a service account or admin role. The Arup case, where a fake CFO on a video call led to HK$200 million in transfers, shows the scale; see the Arup Deepfake Fraud 2024 breach page and the Deepfake-Resistant Identity Verification Guide.
• Signing keys are identities: provenance marking with signed metadata depends on signing keys and certificates held by services. Treat them as privileged non-human credentials with rotation and access control.

Compliance steps

1. Map exposure: list every product feature, agent or workflow that generates, edits or hosts realistic audio, images or video, and the countries where users are.
2. Classify roles: for each, decide whether you are a provider, deployer, platform or none under each law above.
3. Build marking in: add signed metadata (for example C2PA content credentials) and watermarking at generation, and test that labels survive download, export and common edits.
4. Stand up takedown: one intake for intimate imagery and likeness complaints, with timers set to the shortest applicable clock (2 hours in India, 48 hours in the US), hash matching for identical copies, and an audit trail.
5. Disclose to users: visible labels and spoken notices for synthetic content and voice agents.
6. Harden processes against deepfake fraud: out-of-band call-back for payments and credential resets, never approval on voice or video alone. See the Deepfake and AI Impersonation Guide.
7. Track bills: review NO FAKES, Denmark and EU standards quarterly and update the register.

Measuring it

• Marking coverage: percentage of generated outputs carrying verifiable metadata and watermark.
• Label survival: percentage of test outputs whose labels survive export and re-encoding.
• Takedown time: median and 95th percentile time from valid request to removal against each legal clock.
• Repeat uploads: identical copies caught by hash matching after first removal.
• Fraud controls: percentage of payment and reset requests verified out of band.

Technical standards mapping

Common failure patterns

• Metadata stripped by the pipeline: image optimisation or transcoding removes provenance data, so the label obligation fails silently.
• Treating bills as law: building compliance programmes on NO FAKES or the Danish bill text before passage, or ignoring them entirely.
• One global clock: using a 48-hour removal target everywhere when India requires 2 hours for intimate imagery.
• Voice approval for money: payment or reset approvals on a call or video alone.

Practitioner checklist

• Inventory every feature or agent that creates or hosts realistic synthetic media.
• Record your role under the EU, China, India and US laws for each.
• Mark output with signed metadata and a watermark, and test survival.
• Run takedown to the shortest applicable clock with copy matching.
• Disclose voice agents and synthetic content to users.
• Protect provenance signing keys as privileged machine credentials.
• Require out-of-band verification for payments and credential resets.
• Review bills and EU standards each quarter.

Standards and references

• GovInfo: Public Law 119-12, TAKE IT DOWN Act
• FTC: FTC begins enforcing the TAKE IT DOWN Act
• EUR-Lex: Regulation (EU) 2024/1689, Artificial Intelligence Act
• Cyberspace Administration of China: Measures for Labelling AI-Generated Synthetic Content
• legislation.gov.uk: Data (Use and Access) Act 2025, section 138
• Federal Register of Legislation: Criminal Code Amendment (Deepfake Sexual Material) Act 2024
• US Senate: Reintroduction of the bipartisan NO FAKES Act
• Public Citizen: Tracker of state legislation on deepfakes in elections

This guide summarises deepfake and synthetic media laws as of 11 November 2026 and is not legal advice. Related NHI Mgmt Group resources: Global AI Regulation Map · Deepfake and AI Impersonation Guide · Deepfake Fraud Statistics · Online Fraud Regulation Map