The one test that matters: consent, not technology

Every law on this topic, across different legal systems, asks the same question: did the person in the image agree to it. How the image was made doesn't matter much—diffusion model, Photoshop edit, or real photo taken without permission. What matters is consent: did the person agree to be shown this way, and did they agree to it being shared.

The confusion here usually comes from treating this as an AI problem. It's not. The legal issue is non-consensual intimate imagery—content shared without the person's permission—which is older than AI. Most countries already had some rules about it. What's new is that lawmakers are closing a gap: old laws about photographs didn't always clearly cover AI-generated or AI-altered images of the same person.

US federal law: the TAKE IT DOWN Act

In May 2025, the US passed the TAKE IT DOWN Act, its first federal law on this. It makes it a federal crime to knowingly publish intimate imagery of someone—including AI-generated—if they had a reasonable expectation of privacy, didn't put it out themselves in a public or commercial setting, and the publication is meant to harm or actually does. Penalties are up to two years for adults, three years if a minor is involved.

It also created a takedown requirement: platforms must give users a way to report nonconsensual imagery and remove it within 48 hours of a valid report. They also have to try to remove copies. The FTC enforces this, and it started in May 2026. The federal law doesn't replace state laws; both apply.

On top of that, at least 45 states have their own laws covering nonconsensual deepfakes as of mid-2026, usually added to existing laws about nonconsensual imagery. Penalties and scope differ by state. That's why there's no single answer to "is this legal" even inside the US.

UK law: a new criminal offence, and a coming ban on the tools themselves

The UK moved faster than most. In February 2026, section 138 of the Data (Use and Access) Act 2025 took effect, amending the Sexual Offences Act 2003 to criminalize creating a nonconsensual sexual or intimate image of an adult—any kind, AI or not, deepfake or facemapped, any method that makes someone appear in a sexual or intimate context without their agreement.

The UK is going further: proposed legislation would criminalize selling tools designed for this purpose, not just using them. That moves legal liability from the user to the platform that makes or distributes the tool. It changes how these services have to operate.

EU law: the AI Act bans "nudifier" systems outright

The EU took the most direct approach. In 2026, the European Parliament and Council agreed to add a new prohibited practice to the AI Act: a ban on AI systems designed to generate nonconsensual intimate imagery—commonly called "nudifier" apps—placed in the same banned category as systems that create child sexual abuse material. Companies have until December 2, 2026 to bring their systems into line.

Separately, the AI Act's transparency rules (Article 50, applying from August 2, 2026) require labeling AI-generated or manipulated content that resembles a real person as synthetic, regardless of intent. Together, these two rules address both the tool (if it processes photos without consent checks) and the output (if it isn't marked as synthetic).

What this means for services built around a consent gate

Together, the US, UK, and EU all point the same direction: away from just punishing individual misuse and toward requiring platforms to be built to prevent it. A service that checks nobody and processes any photo is heading toward a different legal category (especially under UK and EU rules) than one that verifies consent before processing.

This distinction matters on its own, regardless of any product. Hoty, the service behind this blog, is built on it: only your own photo or one from someone who explicitly consented, with moderation on every upload before anything is generated or charged. I'm saying this plainly because it's directly relevant to what you're reading.

This isn't a claim that any service is fully compliant everywhere; compliance depends on details this guide can't see and on law that's still changing. It describes where regulators are heading and why the gap between "any photo" and "checked consent" now matters more than before. For details on how consent checking works technically, see our guide to AI photo generation.

A practical checklist before using any service in this category

Before uploading to any service like this, ask yourself: Is this your photo, or did the person in it explicitly agree to this use? Does the service verify consent and age, or take any upload? Is there an actual privacy policy about what happens to the photo after? Are prices and rules clearly stated, or hidden and vague?

Failing several of those checks is a legal and personal risk, regardless of output quality—for both the person using the tool and whoever is in the photo. Consent isn't a formality: using this on a photo without the person's agreement now carries criminal liability in much of the world, regardless of which app or site you use. Our privacy and moderation guide covers how to evaluate a service on these points.

This isn't legal advice

What's above is a general overview of publicly available laws as of mid-2026. This isn't a substitute for legal advice. Law here moves fast, rules differ by state and country, and application to your specific situation depends on facts this guide can't know. If you have a real legal question about a photo, a jurisdiction, or a use case, talk to a lawyer where you live.

The dated legal claims and links above were last verified: July 21, 2026.

Frequently asked questions

Read next