Deepfake Bills in Denmark and the Netherlands: Right idea, wrong legal framework.

Deepfakes are flooding the internet. Thanks to generative AI, politicians say things on camera they never said, celebrities star in porn clips they never dreamt about, and the Pope dons a puffer jacket he never wore.

Legislators everywhere are now responding. Reflecting the rise of deepfakes, the U.S. legislature is facing a deluge of deep fake bills, one of which (the TAKE IT DOWN Act) was recently adopted, while another (the NO FAKES Act) is advancing through the U.S. House and Senate.

In the E.U. Article 50(4) of the AI Act requires users (‘deployers’) of AI technology to disclose that content was artificially created or manipulated. But the Act does not otherwise restrict the production and posting of deepfakes.

Some Member States are now stepping in. Just a few days before it took over the presidency of the Council of the EU, the Danish government announced – to some fanfare – a bill to protect natural persons, including performing artists, against unwanted deepfakes. Dutch parliamentarians are considering deepfake legislation as well.

The concerns underlying these proposals are understandable. Fake porn and other deepfake content is causing serious, and sometimes irreversible, harm to a person’s integrity and reputation. Fake audio or video content might deceive or mislead audiences and consumers, poison the public sphere, induce hatred, manipulate political discourse and undermine trust in science, journalism, and the public media. Like misinformation more generally, deepfakes pose a threat to our increasingly fragile democracies. Last, and perhaps least (I will come to that), deepfakes might also affect the commercial interests of celebrities, actors, artists and others with marketable personal features.

Assuming legislative intervention is called for, one would expect new rules that reflect these interests and allow deepfakes only under the strictest of conditions. The Danish bill, which is expected to be officially proposed in the Autumn of 2025, does recite several of these concerns in its explanatory memorandum. Technological developments should not compromise “trust, integrity, credibility, and transparency”. The bill additionally points to reputational and privacy concerns.

In light of these concerns it is surprising to see that both the Danish and the Dutch bills are framed in intellectual property legislation. While using different terminology both bills propose to regulate AI generated deepfakes in the context of neighbouring (related) rights. Both bills would grant to natural persons exclusive rights to control the making available of deepfakes of their persona. The Danish bill would additionally extend the neighbouring rights of performing artists to cover digital imitations. In Denmark protection would last for 50 years following the deepfaked person’s death. The Dutch bill, even more generously, would accord a term of 70 years post mortem.

Whereas it makes sense to ensure that performing artists have a right to control digital replicas of their performances – protection not available under current neighboring rights laws – the core provision of both bills, which grants to every natural person a related right in his or her personal features, deserves serious rethinking.

Intellectual property rights regimes commodify the subject matter of protection. The main rationale of copyright and related rights is not to prevent creative content from being used, but quite the opposite: to foster markets where rights to exploit the content are exchanged for money. Thus, copyright and related rights promote the dissemination of content while rewarding creators.

Likewise, both deepfake bills conceive the new right to control deepfakes as a marketable, exploitable right, subject to monetization by way of licensing. Although the draft Dutch bill rules out wholesale assignments, except where deepfakes are commissioned by film or phonogram producers, the bill applies the existing body of copyright contract law mutatis mutandis.

The message both bills convey is not that deepfakes are taboo, but that deepfakes amount to a new licensing opportunity. [The pending NO FAKES Bill is drawing similar criticism in the United States.]

Is granting every person a new IP right the best way to deal with deepfakes? I don’t think so. Although to a hammer everything may look like a nail, IP law is only one of many instruments in the lawmaker’s toolkit. If concerns over privacy and reputation are the main reasons for regulating deepfakes, any new rules should be grounded in the law of privacy. If preserving trust in the media or safeguarding democracy are the dominant concerns, deepfakes ought to be addressed in media regulation or election laws. The Danish and Dutch bills address and alleviate none of these concerns. To the contrary, they embrace and encourage deepfakes as a new and potentially lucrative mode of exploiting a person’s most intimate possession, his or her digital persona.

Leaving aside these fundamental objections, both bills raise a more pragmatic question: is existing law really inadequate? As said, there may be good reasons to strengthen the protection of performing artists against deepfakes. But leaving neighbouring rights aside, existing law in civil jurisdictions already offers victims of unwanted deepfakes a broad choice of legal remedies, including image rights, the GDPR, tort law, unfair competition law, unlawful advertising, and possibly even trademark protection. In addition, deepfakes are punishable as criminal acts such as fraud, identity theft and ‘revenge porn’.

In 2022, a study commissioned by the Dutch Ministry of Justice concluded that existing Dutch law already offers sufficient rights and sanctions to prohibit deepfakes. The real problem, say the authors of the study, is enforcement. A deepfaked person may have all the civil rights and remedies he or she needs, effectively enforcing these rights against anonymous perpetrators operating from unknown territories is another matter altogether – a sobering lesson the internet teaches us again and again.