In June, Canada’s privacy commissioner concluded that the sexual deepfakes generated by Grok violated the country’s privacy law, and that the image tool had been launched without adequate safeguards. The investigation described millions of sexualized images, built from photos of real people who never agreed to any of it. I read that finding as a turning point, because a regulator finally treated a deepfake as what it is, a privacy violation built on personal data.
Well, we’ve spent years discussing deepfakes as a disinformation problem, something about elections and fake politicians, while most of the damage was always personal. A deepfake starts with collection, when someone takes your photo, your voice from a WhatsApp audio or a few seconds of a video you posted in 2019, and feeds it to a model that learns how your face moves. Your face is biometric data, and since the models need very few samples now, a public profile picture is already enough.
That breaks the old mental model of privacy, which was about keeping secrets. You could protect yourself by sharing less, locking your account and thinking twice before posting, and it worked reasonably well because a leak could only expose things that had really happened. A deepfake exposes things that never happened, with your face attached, and good luck explaining to your employer, your family or a judge that the person in the video isn’t you. I work as a court-appointed forensic expert, and I can tell you that proving a video is fake gets harder and more expensive every year, while generating one takes minutes.
Regulators are moving, slowly. Denmark proposed changing its copyright law to give people explicit rights over their own likeness, which sounds strange until you realize how little protection existed before. The US passed the Take It Down Act, which forces platforms to remove intimate deepfakes within 48 hours of a request. All of that helps, although every one of these measures kicks in after the content exists, and by then the copy is sitting in group chats and on servers no takedown notice will ever reach.
I don’t think the answer is to disappear from the internet, since that train left years ago. The practical answer is boring: fewer public high-resolution photos and voice clips, a family code word for those “mom, I need money” calls, and a company rule that no payment gets approved on the strength of a video call alone. For the companies building these tools the question is even simpler, because a product that generates images of real people without checking consent is processing biometric data without a legal basis, and it should be regulated that way.
You can change a leaked password and you can’t change a leaked face, and the uncomfortable part is that nobody needs a leak anymore, because your face was public all along.