The UK has introduced a new criminal offence specifically targeting non-consensual AI deepfake nudes. From 6 February 2026 it is illegal in England and Wales to create, or to request the creation of, a sexually explicit AI-generated image of another adult without their consent. The offences apply even if the image is never shared or uploaded online, and the requesting offence applies even if the image is never actually made.

The offence reflects a clear policy choice: harm is done at the point of creation or at the point of asking. Whether an image is real or artificially generated, sexualising someone without their permission causes lasting damage.

This post sets out what the offences actually criminalise, who can be prosecuted, what victims should do, and how the new offences fit alongside the existing sharing offences, the Online Safety Act 2023 and the Crime and Policing Act 2026 — with citations to the primary legislation.gov.uk and gov.uk sources.

What the new offences say

Section 138 of the Data (Use and Access) Act 2025 inserts four new sections into the Sexual Offences Act 2003:

  • Section 66E — creating a purported intimate image of an adult.
  • Section 66F — requesting the creation of a purported intimate image of an adult.
  • Section 66G — interpretation, including the consent test and what counts as appearing to be an adult.
  • Section 66H — extended time limits for prosecuting the new summary offences.

The provisions were commenced in England and Wales by the Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 (SI 2026/31), in force on 6 February 2026.

Section 66E — creating

A person (A) commits the offence where they intentionally create a purported intimate image of another person (B), B does not consent, and A does not reasonably believe that B consents.

The offence is complete on creation. There is no further requirement that the image be shared, uploaded, sold or even kept.

Section 66F — requesting

A person commits the offence where they intentionally request the creation of a purported intimate image of another adult without that person’s consent and without reasonable belief in consent.

Two important points sit on the face of this offence:

  1. It is committed at the moment of the request, regardless of whether the image is ever actually produced.
  2. Section 66F(6)(c) provides that the offence applies regardless of where in the world the person to whom the request is directed (or the audience of a publicly-made request) is located.

That means a single private prompt to an overseas-hosted image generator, or a public post in a community forum asking for a named real person to be “nudified”, can complete a section 66F offence.

What is a “purported intimate image”?

The statutory definition is deliberately technique-neutral. It captures any image which:

  • appears to be, or to include, a photograph or film of the person but is not, or is not only, an authentic photograph or film;
  • gives the overall or predominant impression that the person depicted is 18 or over; and
  • appears to show the person in an intimate state.

This wording catches AI deepfakes, face-swaps, “nudify” tool output and any other digitally manipulated images that purport to be photographic. Wholly synthetic images that do not appear to depict a real, identifiable adult fall outside the offence — the statute is aimed at content that uses, or appears to use, a real person.

Creation and solicitation are two separate offences

Section 66E captures the person who actually makes the image. Section 66F captures the person who asks for it, whether the request is targeted at a particular individual or made publicly available — for example, posted on Reddit, in an open Discord, or in a generative-tool community.

Liability under section 66E arises on creation, so the offence is complete whether or not the image is ever shared. Liability under section 66F arises on the request, so it is complete whether or not the image is ever made.

This is the policy point Sir’s brief flagged: harm is done at the point of creation or solicitation, and the law now reflects that.

How this fits with the existing sharing offence

The Sexual Offences Act 2003 already contained section 66B, an offence of sharing or threatening to share an intimate photograph or film, including deepfakes, inserted by section 188 of the Online Safety Act 2023 and in force since 31 January 2024. That offence covers distribution.

The DUAA 2025 amendments are different. They reach upstream, into the creation and request stages, before any sharing takes place. Together, sections 66B, 66E and 66F now cover:

  • Asking for the image (section 66F)
  • Making the image (section 66E)
  • Sharing the image, or threatening to share it (section 66B)

Penalties and time limits

Both new offences are summary only, tried in the magistrates’ courts.

  • Maximum custodial sentence: 6 months. The statute references a 51-week ceiling, but that depends on commencement of section 281(5) of the Criminal Justice Act 2003, which remains uncommenced as of June 2026. The live ceiling is 6 months.
  • Fine: unlimited (per the explanatory notes, under section 85 LASPO 2012).
  • Time limit (section 66H): an information must be laid both within 3 years of the offence and within 6 months of evidence sufficient to justify proceedings reaching the prosecutor. Both limbs must be satisfied. This deals with the standard six-month time-bar on summary offences and means defendants who created images years ago can still be prosecuted.

”Reasonable excuse” defence

A statutory “reasonable excuse” defence is available under sections 66E(5) and 66F(7), with the burden on the defendant.

The Explanatory Notes signal that the bar is especially high for sexual imagery and that there is no express carve-out for journalism, public interest, research or law enforcement. Anyone relying on reasonable excuse should expect to discharge that burden in court, on the balance of probabilities.

There is no reported case law on the defence as of June 2026.

Investigation and prosecution

Investigations rest with local police forces, coordinated nationally by the NPCC National Centre for Violence Against Women and Girls and Public Protection (NCVPP). Prosecutions are run by the Crown Prosecution Service under its existing Cybercrime, Communications Offences and Rape and Sexual Offences (Chapter 7) frameworks. A standalone CPS charging standard for sections 66E and 66F has not yet been published.

Prosecution does not require a victim’s complaint. The CPS can charge on the basis of investigator-led evidence — particularly relevant where the original target may not realise an image has been created.

Automatic lifelong victim anonymity

Because sections 66E and 66F are inserted into Part 1 of the Sexual Offences Act 2003 and are not within the Sexual Offences (Amendment) Act 1992 excluded list, victims attract automatic lifelong anonymity from the moment an allegation is made. Anonymity is not contingent on charge or conviction.

In practical terms: a complainant cannot be identified in press reporting or in legal proceedings unless and until they consent to lift the anonymity in writing or a court directs otherwise.

Platforms and the Online Safety Act 2023

Section 66B (the sharing offence) was added to Schedule 7 of the Online Safety Act 2023 as a priority offence by the Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2024 (SI 2024/1188). That means in-scope platforms must take proactive steps to prevent and remove non-consensual intimate images, including deepfakes, under Ofcom’s Illegal Harms Codes of Practice (statement published 16 December 2024).

The new sections 66E and 66F (creation and solicitation) have not yet been added to OSA Schedule 7 by any commencement instrument we have identified, so they are not yet priority offences in their own right under the Online Safety Act 2023. User-shared deepfakes still trigger platform duties, however, because the underlying sharing conduct (section 66B) is already a priority offence.

Ofcom’s enforcement teeth: services that fail to comply face fines of up to £18 million or 10 per cent of qualifying worldwide revenue, whichever is greater, and Ofcom can apply for business-disruption measures.

Two live investigations are public:

  • 12 January 2026 — Ofcom opens a formal investigation into X over Grok-generated sexual deepfakes.
  • 6 March 2026 — Ofcom opens a separate investigation into unnamed online forums hosting image-based sexual abuse.

No fines have been imposed at the time of writing.

The Crime and Policing Act 2026 — nudify tools and 48-hour takedown

The Crime and Policing Act 2026 received Royal Assent on 29 April 2026 and sits alongside the DUAA 2025 offences. It introduces several additional measures directly relevant to deepfake harm:

  • A separate offence of making, adapting, supplying or offering to supply a “generator of purported intimate images” — so-called nudify tools — punishable on indictment by up to 3 years’ custody and a fine, with a “reasonable steps” due-diligence defence.
  • A statutory duty on platforms to take down reported non-consensual intimate images within 48 hours.
  • Mandatory image-deletion orders on conviction.
  • A new offence of taking or recording intimate images without consent.
  • A new offence of sharing “semen-defaced” images.

Possession of a nudify tool, and possession of non-consensual intimate images as a standalone offence, have not been criminalised. The Women and Equalities Committee’s recommendation on possession remains outstanding.

Specific commencement dates for individual Crime and Policing Act 2026 provisions should be checked against the relevant commencement regulations on legislation.gov.uk — provisions come into force in stages.

Territorial reach

The DUAA 2025 sections 66E and 66F extend to England and Wales only (section 141 DUAA 2025). The other UK nations may follow with parallel legislation.

Section 66F(6)(c) expressly disregards the location of the person to whom the request is directed or the audience of a publicly-made request — so a request made in England to a tool or community outside the UK is still caught.

The extraterritorial reach of section 66E (the creating offence) on a defendant located outside the UK is not expressly resolved on the face of the statute. Cross-border cases will turn on the standard rules on jurisdiction over conduct.

Key dates timeline

DateEvent
31 January 2024Section 66B SOA 2003 (sharing or threatening to share intimate images) comes into force, inserted by section 188 Online Safety Act 2023
23 October 2024Data (Use and Access) Bill introduced to the House of Lords
10 December 2024SI 2024/1188 adds s.66B to Schedule 7 of the Online Safety Act 2023 as a priority offence
16 December 2024Ofcom publishes Illegal Harms Codes of Practice statement
19 June 2025Data (Use and Access) Act 2025 (c. 18) receives Royal Assent
12 January 2026Ofcom opens formal investigation into X over Grok-generated sexual deepfakes
6 February 2026Section 138 DUAA 2025 commenced via SI 2026/31. Sections 66E, 66F, 66G and 66H Sexual Offences Act 2003 in force in England and Wales
6 March 2026Ofcom opens separate investigation into online forums hosting image-based sexual abuse
29 April 2026Crime and Policing Act 2026 Royal Assent — separate offence of supplying nudify tools + 48-hour platform takedown duty

What this means in practice

For the public

The offences are deliberately broad. Liability does not require sharing, distribution or even successful creation. A single private prompt to an image generator, or a public Reddit request to “nudify” a named real person, can be a complete section 66F offence.

People in the UK who use overseas-hosted nudify services, request deepfakes through international Discord servers, or share AI tools with friends should treat the conduct as criminal. There is no public-interest, journalism or research carve-out on the face of the statute; anyone relying on “reasonable excuse” should expect to discharge that burden in court.

For victims

If you discover that a deepfake intimate image of you exists, has been created, or has been requested:

  1. Preserve evidence first. Capture URLs, screenshots, account handles, dates and times before content is removed or accounts are deleted.
  2. Report to the police. Call 101 or use online reporting. Section 66H gives prosecutors 3 years from the offence; do not delay because the conduct happened months ago.
  3. Register affected images with StopNCII.org — a free hash-matching service used by major platforms including Meta, TikTok, Reddit, Snap, Bumble, OnlyFans and Bluesky to detect and block uploads.
  4. Contact the Revenge Porn Helpline (SWGfL) for confidential help. The Helpline recorded 22,275 cases in 2024, up 20.9 per cent year on year.
  5. For images involving under-18s, report to the Internet Watch Foundation, which handles child sexual abuse material.
  6. Seek legal advice on parallel civil routes — harassment, misuse of private information, UK GDPR breach (complaint to the ICO), copyright or passing off where the underlying photograph is yours, and injunctive relief.

You attract lifelong anonymity in any reporting and in court from the moment an allegation is made. You do not have to be named, and your identity cannot be published without your written consent.

For platforms and tool providers

Three live duties to map:

  • Online Safety Act 2023 priority-offence duties — section 66B is already a Schedule 7 priority offence, so user-shared deepfake intimate images already trigger proactive detection and removal duties under Ofcom’s Illegal Harms Codes.
  • Crime and Policing Act 2026 — the 48-hour takedown duty for reported NCII, the nudify-tool supply offence, and statutory deletion orders. Operating detail will land in commencement regulations.
  • Reputational and regulatory exposure — Ofcom can fine non-compliant services up to £18 million or 10 per cent of qualifying worldwide revenue. The X / Grok and online-forum investigations show Ofcom is now using these powers in earnest.

The DUAA 2025 sections 66E and 66F are tightly drafted, technique-neutral, complete on creation or request, and carry automatic lifelong victim anonymity. The Crime and Policing Act 2026 will fold in tool-supply liability and a 48-hour takedown duty as its provisions commence. Together they are a serious change in UK criminal law.

Practical points for advisers in the next 12 months:

  • No carve-outs. Treat “reasonable excuse” as a high bar — particularly for journalism, satire, research or law enforcement use cases. Document robust due-diligence steps before any creation.
  • Civil remedies remain valuable. Criminal prosecution does not preclude harassment claims, misuse of private information, UK GDPR / Data Protection Act 2018 complaints to the ICO, copyright actions, or urgent injunctions.
  • Cross-border issues. Section 66F expressly reaches across borders for the requesting offence; section 66E’s extraterritoriality is less clear. Cross-border facts need careful jurisdictional analysis.
  • Platform compliance reviews. Sections 66E and 66F are not yet OSA priority offences in their own right, but the sharing route under section 66B already is. Compliance work should track Schedule 7 closely.

Authoritative sources

Primary legislation and commencement:

Government guidance:

Regulator and prosecutor:

Victim support and policy:

Need confidential advice on a deepfake or non-consensual intimate image issue? Book a free 15-minute consultation with RakLAW Solicitors. We advise on criminal defence, civil claims and platform complaints in England and Wales.