Sexual deepfake technology has been in circulation in its modern form since 2017. Over nine years, the ability to generate realistic sexually explicit images and videos of people who have not consented to appear in them went from an obscure technical curiosity to a massive phenomenon affecting millions of people around the world, with a disproportionate impact on women and minors.
Until May 7, 2026, when the European Union reached a political agreement to ban AI systems that allow the creation of this type of content, no large-scale legislation had managed to effectively regulate the practice. On May 19, the United States began to apply its own federal law on the matter. Two great powers simultaneously regulating the same problem. The problem is that they arrive almost a decade after this problem began to cause real damage.
What the European agreement prohibits
The European agreement has two central prohibitions. The first is the generation or manipulation of realistic images, videos or audio – deepfakes – of intimate parts or that identify people in sexual activities without the express consent of the affected person. The second is the prohibition of systems capable of generating or manipulating child pornography. Both bans will be implemented through amendments to the European Union AI Law.
The process that led to this agreement began in Spain. The Spanish government proposed an amendment to the AI Law in response to public controversy generated by Grok – Elon Musk's xAI AI tool – and its ability to generate explicit images. The European Commission incorporated the amendment and negotiated it in a tripartite process between Parliament, the Council and the Commission that culminated in the early hours of May 7.
Application schedules — EU and US
- EU: ban on non-consensual sexual deepfakes · obligations from December 2026
- EU: obligations for high-risk AI systems (biometrics, employment, education) · December 2027
- EU: mandatory watermarking of AI-generated content · postponed until 2028
- USA: federal law in force since May 19, 2026 · 48-hour period to remove reported content
- USA: FTC forces platforms to enable direct reporting channel for victims
American law: 48 hours to remove content
The United States federal regulation, which began to be applied on May 19, 2026, works differently from the European one. Instead of banning generating systems, American law focuses on the obligation of platforms to act quickly when the existence of such content is reported. The Federal Trade Commission (FTC) ruled that web portals must enable a direct reporting channel for victims, and that technology companies have a maximum period of 48 hours to remove the reported material.
The law also criminalizes the digital distribution of explicit sexual montages created using algorithms for commercial use. It is a more pragmatic approach than the European one in the sense that it does not attempt to ban the technology – which would be technically almost impossible to enforce – but rather to create legal consequences for the distribution and concrete obligations for the platforms that host it.
The structural problem of regulating what already exists massively
The most well-founded criticism of both regulations is not that they are unnecessary—they clearly are—but that they arrive when the damage has already been normalized. According to estimates by digital defense organizations, there are currently tens of thousands of websites specialized in non-consensual sexual deepfakes, with millions of images and videos of real people. Most of that content will exist tomorrow, the next day and a year from now, regardless of new regulations.
This is not an argument against regulation: it is an argument about when to regulate. Deepfake technology was identified as a serious risk to people's rights almost from the moment it appeared. In 2019, researchers and activists were already presenting evidence to European and American legislators of the concrete damage it was causing. The regulatory processes took seven years to produce legally binding results.
Technology scales in weeks. Regulation takes years. When the norm arrives, the problem has already become widespread. This gap is not a failure of political will. It is a structural characteristic of the system.
The Grok case and pressure from civil society
The immediate catalyst for the European agreement was the controversy surrounding Grok, Elon Musk's xAI AI model. The tool generated massive media attention in Europe when it became clear that it could generate sexually explicit images with few restrictions. Public outrage—amplified by media coverage and pressure from digital rights organizations—created the political environment necessary for an amendment to the AI Act, which had been stuck in negotiations for months, to move forward quickly.
It is a well-known pattern in technological regulation: public outrage generates the political will that the technical process had failed to generate. The problem is that this pattern means that regulation is driven by cases that have already caused harm, rather than by the anticipation of harm.
Watermarking – digital marking that would automatically identify whether content was generated by AI – is part of the AI Act but has been postponed until 2028 for its mandatory application. It is one of the most promising technical tools for the deepfake problem in the long term, but also one of the most difficult to implement in a way that cannot be easily circumvented. That its application has been delayed is a tacit recognition that verification technology is not ready to be mandatory yet.
Share this article
