Deepfakes under Dutch law: which offences and remedies apply

Dutch law has no separate deepfake offence, but most harmful deepfakes are still punishable under existing provisions of the Dutch Criminal Code (Wetboek van Strafrecht, Sr): sexual imagery (Article 254ba Sr), fraud, extortion, defamation, doxing and stalking. Creating a deepfake for private use is rarely an offence in itself; liability usually arises when you distribute it or use it against someone, with an important exception for sexual material, where making it can already be punishable.

Next to criminal law, portrait rights under the Copyright Act (Auteurswet), tort law and the GDPR give victims civil routes that often remove material faster than a prosecution. Dutch criminal law is the starting point, but most cases need both tracks at once.

What is a deepfake under Dutch law?

Dutch legislation does not define the term. A deepfake is synthetic video, audio or imagery in which a real person appears to say or do something they never said or did; the law regulates the conduct and the harm, not the technology.

That is why the same clip can be lawful satire in one context and an offence in another. The European AI Act does use the term: Article 50 of that Regulation requires deployers to disclose that deepfake content is artificially generated or manipulated (see below).

Which offence applies to sexual deepfakes?

Article 254ba Sr, in force since 1 July 2024 under the Sexual Offences Act (Wet seksuele misdrijven), covers sexual images of a person made or published without consent. Unlawfully making a sexual image of someone carries up to one year in prison; publishing a sexual image while knowing this can harm the person depicted carries up to two years.

You do not have to prove that the images are real. What matters is that they depict you in a sexual context and that you did not consent. Consent given once, for one purpose, is not consent to onward publication.

Where a person who is apparently under eighteen is depicted, Article 252 Sr applies. It covers images in which a minor “is involved or apparently involved”, so entirely computer-generated material falls within its scope. Distributing, making or possessing such material carries up to six years in prison. A school that discovers nudify-app images of pupils should treat this as a police matter, not as an internal disciplinary issue.

When is a deepfake fraud or extortion?

Using a deepfake to obtain money or goods is fraud (oplichting) under Article 326 Sr. A cloned voice of a director authorising a payment, or a fabricated video message, is simply the means of deception.

Identity fraud is less straightforward. Article 231b Sr penalises the unlawful use of another person’s identifying personal data, but it expressly excludes biometric data. A cloned face or voice is biometric, so prosecutions are usually built on fraud, forgery or money laundering instead.

Threatening to publish a deepfake unless the victim pays is a separate offence. Article 318 Sr (afdreiging) covers coercion by threatening defamation or revealing a secret; Article 317 Sr covers extortion by threat of violence. That the material is fake does not weaken the case: the harm lies in the coercion.

For companies, the civil consequence matters as much. A payment made by an employee deceived by a cloned voice is rarely recoverable, so payment procedures should include a verification step that a synthetic voice or video call cannot pass. Our guide on fraud in the Netherlands explains how such investigations are built.

When is a deepfake defamation, doxing or stalking?

A deepfake that falsely shows a person doing something disgraceful can be defamation (smaad, Article 261 Sr). Where the maker knows the imputation is false, which is almost always the case with a fabricated clip, it is calumny (laster, Article 262 Sr), punishable by up to two years in prison.

• Insult (eenvoudige belediging, Article 266 Sr) covers material that insults without imputing a specific fact.
• Doxing (Article 285d Sr) covers obtaining or spreading someone’s personal data to frighten them or cause serious nuisance, with up to two years in prison.
• Stalking (belaging, Article 285b Sr) covers a systematic intrusion into someone’s private life to force or frighten them, with up to three years in prison.

Defamation, calumny, insult and stalking are complaint offences: the Public Prosecution Service (Openbaar Ministerie) can only prosecute after your formal complaint (Articles 269 and 285b(2) Sr). You must file that complaint within three months after the day you learned of the offence (Article 66 Sr). Letting that period lapse is one of the most damaging mistakes a victim can make. Our articles on online defamation and on criminal liability for social media statements go further into this.

Which civil claims stop distribution fastest?

Civil law gives you the tools that actually stop distribution. Under Article 21 of the Copyright Act, you can oppose publication of your portrait, made without your commission, if you have a reasonable interest; a recognisable synthetic likeness counts as a portrait.

Alongside portrait rights, the general tort action of Article 6:162 of the Dutch Civil Code (BW) applies. The court balances your right to private life (Article 8 ECHR) against freedom of expression (Article 10 ECHR). False and gratuitously harmful material almost always loses that balance. You can claim damages for material and immaterial harm and ask for rectification.

The most effective instrument is preliminary relief proceedings (kort geding) before the preliminary relief judge (voorzieningenrechter). In urgent cases this produces an enforceable order within days or weeks, usually backed by a penalty payment (dwangsom) per day of non-compliance. The order can be directed at the maker, the people sharing the material and the platform hosting it.

What does the GDPR add?

A deepfake of an identifiable person is processing of personal data, so the GDPR applies. You can ask the party publishing it to erase it (Article 17 GDPR) and claim compensation in the civil court (Article 82 GDPR).

The GDPR does not apply to processing by an individual in a purely personal or household activity (Article 2(2)(c) GDPR), and it must be reconciled with journalistic and artistic expression. It is therefore strong against platforms, employers and websites, and weaker against a private individual. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) can investigate and fine controllers, but it does not remove individual items for you or award compensation.

What do the AI Act and the Digital Services Act require?

European law regulates providers and platforms, not the individual wrongdoer. It does not give you a claim of its own, but it strengthens your position against intermediaries.

Under Article 50 of the AI Act, deployers of a system that generates or manipulates deepfake content must disclose that the content is artificial, and providers must mark output in a machine-readable way. For evidently artistic, satirical or fictional work, the disclosure may be limited so that it does not spoil the work. The AI Act does not ban generating a person’s likeness.

The Digital Services Act (DSA) is more useful in practice. Every hosting service must offer a notice and action mechanism (Article 16 DSA) and give reasons when it removes or refuses to remove content (Article 17 DSA). Online platforms must also offer an internal complaint procedure and access to out-of-court dispute settlement. A hosting provider that has actual knowledge of clearly unlawful content and does not act quickly loses its liability exemption, so a well-documented notice often leads to removal before any court case.

Where does satire end and liability begin?

Freedom of expression under Article 10 ECHR protects opinion, criticism and parody, most strongly in political debate. A recognisable parody of a minister is a different case from a fabricated confession attributed to a private person.

Dutch courts weigh whether the material states facts or expresses an opinion, how it was presented and distributed, its purpose and its impact on the person depicted. Sexual material and material presented as an authentic recording of something that never happened almost always lose that balance. A label saying the clip is generated helps, but it does not cure a portrait-right infringement or make sexual imagery lawful. Businesses using synthetic media in campaigns should obtain written permission from everyone whose likeness or voice is used; see our article on media law.

What should you do if a deepfake of you is circulating?

Secure the evidence first, then run the criminal and civil tracks at the same time. The three-month complaint period of Article 66 Sr starts on the day you learn of the material.

1. Take full-screen captures showing the web address, account, date and number of views, download the file and note when you discovered it. Do not forward sexual material to anyone else.
2. Report to the police and, for defamation, calumny, insult or stalking, file a formal complaint (klacht) within three months.
3. Send a substantiated notice to the platform through its notice and action mechanism.
4. Send a letter to the maker and distributors demanding removal, a list of recipients and destruction of copies.
5. If this does not work within a few days, start preliminary relief proceedings with a penalty payment.

Keep the compensation claim alive. Under Article 3:310 BW a claim for damages generally becomes time-barred five years after you became aware of the damage and the liable person. Our article on false accusations describes how such claims are assessed.

What should you check as a victim?

• Have you captured the URL, account, date and number of views before reporting the material?
• Does the material fall under Article 254ba or 252 Sr (sexual), or under a complaint offence where the three-month period of Article 66 Sr runs?
• Have you sent a notice to each platform under Article 16 DSA and kept the confirmation?
• Can you identify the maker or a payment or advertising account linked to the upload?
• Have you documented your damage: costs of removal, loss of income, therapy costs?

What should you check as an employer or school?

• Have you stopped internal circulation and secured the evidence without forwarding it further?
• If a minor is depicted, have you reported it to the police, given Article 252 Sr?
• Do you refrain from disciplinary action based on a recording whose authenticity has not been verified?
• Do payment procedures require a verification step that a cloned voice or video call cannot pass?
• Do you have written consent from everyone whose likeness or voice you use in synthetic media?

What can we do for you with a deepfake?

Our cybercrime lawyers combine criminal, privacy and media law in one approach.

• We assess which offences and civil claims apply to the material.
• We draft and file the criminal complaint within the three-month period of Article 66 Sr.
• We send notices to platforms under the DSA and demand letters to makers and distributors.
• We start preliminary relief proceedings for removal, backed by a penalty payment.
• We claim damages under Article 6:162 BW and Article 82 GDPR.
• We advise organisations on verification procedures and consent arrangements for synthetic media.

Summary

• There is no separate deepfake offence, but sexual deepfakes (Articles 254ba and 252 Sr), fraud, extortion, defamation, doxing and stalking all cover deepfake conduct.
• Several of these offences require a formal complaint within three months (Article 66 Sr).
• Portrait rights (Article 21 Auteurswet), tort (Article 6:162 BW) and preliminary relief proceedings are usually the fastest way to stop distribution.
• The GDPR and the DSA give leverage against platforms; the AI Act requires labelling but gives no individual claim.

Frequently asked questions