The EU flag with an image of the X logo. 

What X's Corrected Action Under the DSA Fixes on Data Access, and What's Left Open

OpenAI founder and CEO Sam Altman is seen in an elevator after a meeting with Sen. Ted Cruz (R-Texas) on Capitol Hill on July 29, 2026. (Francis Chung/POLITICO via AP Images)

Advanced AI Is Ultrahazardous. Let’s Treat It That Way

Inside the frame of a mobile phone screen, a woman is depicted walking and looking over her shoulder. Behind her, there is an outdoor scene with the sky, tree, fences, and pavement. A hand is shown grabbing the phone and tapping the record button. On the left side of the phone, a small portion of the same sky, fences, and pavement is displayed in a different scale, representing the world outside the screen. On the right side of the phone, three figures of the same woman are shown against a plain blue background, progressively transforming from minimally glitched to heavily glitched.

Consent, Not Nudity, Should Define Image-Based Abuse Laws

Britain's Prime Minister Andy Burnham is shown the driver's area on a FirstGroup bus at the bus station during a visit to Bath, England, Wednesday July 22, 2026. (Toby Melville/Pool Photo via AP)

Burnham's First Week Redraws the Map of UK Tech Governance

A child using a laptop computer. (Press Association via AP Images)

Brazil's Child Online Safety Law Offers a Different Path Than Social Media Bans

Why the Global AI Safety Agenda Cannot See African Harms

Rwanda's President Paul Kagame listens during the first-ever Global AI Summit for Africa where more than 1,000 policymakers, business leaders, and interest groups gathered in Kigali, Rwanda, Thursday, April 3, 2025. (AP Photo/Yuhi Irakiza)

Another Commission for Global AI Governance. How Can It Deliver for Africa?

A photo shows US Capitol in Washington, D.C., United States of America on July 2, 2026. (The Yomiuri Shimbun via AP Images)

Why Congress Must Codify a Chatbot Duty of Care

12 March 2026, North Rhine-Westphalia, Bergheim: Microsoft is building a data center region for AI applications in NRW. A total of three data centers are planned. The symbolic ground-breaking ceremony for the center in Bergheim was attended by Federal Minister of Digital Affairs Karsten Wildberger, NRW Minister of Economic Affairs Mona Neubaur, Head of Microsoft Germany Agnes Heftberger and Eoin Doherty (Microsoft). Photo by: Benjamin Westhoff/picture-alliance/dpa/AP Images

Microsoft is building a data center region for AI applications in Bergheim, North Rhine-Westphalia, Germany. Photo by: Benjamin Westhoff/picture-alliance/dpa/AP Images

The Case for a Temporary Moratorium on Large Data Centers in Europe

Google CEO Sundar Pichai speaks at the Singapore FinTech Festival in December 2020. (Source)

Google CEO Sundar Pichai during a meeting at the European Commission in Brussels, Belgium. (

Google Android Antitrust Ruling Shows the Next Battle is Over Who Controls Trust

How the AI Deepfake Boom is Outpacing Europe's Safeguards

High-level Meeting to launch the Global Dialogue on AI Governance. UN photo/Laura Jarriel

High-level Meeting to launch the Global Dialogue on AI Governance. UN 

From the AI Accountability Gap to a Global Accountability Infrastructure

US Secretary of State Marco Rubio attends the East Asia Summit Foreign Ministers' Meeting, part of the Association of the Southeast Asian Nations (ASEAN) Foreign Ministers' Meeting in Pasay, Metro Manila, Philippines Thursday, July 23, 2026. (Brendan Smialowski/Pool Photo via AP)

Trump Cannot Use Immigration Law to Silence Technology Researchers

A gowned worker adjusts a test coupon for indium phosphide wafer certification testing in a Coherent manufacturing facility where lasers are developed for transmitting data among chips, which could decrease power use by AI systems, on Tuesday, June 16, 2026, in Sherman, Texas. (AP Photo/Jeffrey McWhorter)

The EU's AI Boom Could Undermine its Own Chip Strategy

Woman defending herself against violence, illustration of a giant fist coming down. 

A Roadmap for Confronting the Chilling Effects of Censorship, Surveillance and New Technology

A magnifying glass hovering over the OpenAI logo in a web browser.

OpenAI logo with magnifying glass, CC BY 2.0, Wikimedia Commons (by Jernej Furman).

Despots, DSA Fines, and an 'Autonomous' AI Attack

Open AI CEO Sam Altman speaks to reporters after meeting with Sen. Bernie Sanders (I-VT) in the Dirksen Senate Office Building on Capitol Hill on June 3, 2026 in Washington, DC. (Photo by Chip Somodevilla/Getty Images)

How the OpenAI-Hugging Face Hack May Affect the Geopolitics of AI Governance

People visit the booth of Kimi, an LLM developed by the Chinese startup Moonshot, during the World AI Conference in Shanghai, China, Monday, July 20, 2026. (FeatureChina via AP Images)

‘Open-Washing’ Is Everywhere in AI. Four Criteria Cut Through It

Michael Kratsios, Director, White House Office of Science and Technology Policy, speaking at a hearing of the House Committee on Science, Space, and Technology at the US Capitol in Washington, DC. (Photo by Michael Brochstein/Sipa via AP Images)

OSTP Vision for Science is a ‘Golden Age’ for Corporations

Close up of the Ray-Ban Meta Wayfarer camera integrated into the smart glasses frame. Shutterstock

Close up of the Ray-Ban Meta Wayfarer camera integrated into the smart glasses frame. 

An Indian Trans Person’s Harrowing Encounter Fuels Backlash Against Meta AI ‘Pervert Glasses’

 to terminate its breaches of the Digital Services Act (DSA), including the failures on researcher data access under Article 40(12) that accounted for €40 million of the €120 million fine issued in December 2025.

In an earlier analysis for Tech Policy Press, Oliver Marsh and LK Seiling 

unpacked what the December fine decision revealed

 about the Commission's interpretation of Article 40. That decision identified four failures: an overly restrictive interpretation of researcher eligibility, deficient application review processes, limited quotas and access duration, and contractual prohibitions on independent data collection.

 respond almost point by point: X will revise its screening process so that eligible researchers are not excluded in error, provide access free of charge, ensure timely access "including to the appropriate volumes of data" with significantly reduced application processing times, and update its terms to state explicitly that eligible researchers are not contractually prohibited from scraping publicly available data. X has six months to implement the plan, will be subject to an external independent audit, and remains under enhanced supervision.

Notably, the European Board for Digital Services considered X's action plan "overall inadequate to address the infringement," and the Commission accepted it only after clarifying key implementation requirements.

The measures however address only half the problem: Researchers may now get through the door, but what they can find once inside is a different question. Our recent audit of the two most mature Article 40(12) implementations, Meta's Content Library and TikTok's Research API, suggests this is the question that will decide whether X's compliance is meaningful.

Access granted does not paint the full picture

 comparing platform APIs with the information actually shown to users suggests that gaining access is only half the challenge. Using controlled sockpuppet accounts during the 2024 US presidential and 2025 German federal elections, we reconstructed the complete 

— which we define as every post and every piece of metadata delivered to a user's device on Instagram's Explore and TikTok's For You feeds — and then queried the Meta Content Library and the TikTok Research API for exactly that content.

Compared to what users see and can retrieve on Instagram and TikTok, we show that platforms' Research APIs apply access restriction mechanisms that function as overlapping filters on the granularity and quality of the data researchers can access. We call these mechanisms (1) 

 can be retrieved through the API at all. Follower thresholds encode platforms' definition of which accounts are "big enough" for their content to count as publicly accessible. On Instagram, that alone excluded 49.35% of the posts users actually saw during the elections. Because the APIs ingest content with default delays of up to four days, ephemeral formats like Stories and live streams, which disappear after 24 hours, are never made available to researchers at all. Further, within weeks, between 17.7 and 23.3% of TikTok posts became inaccessible, often because of terms of service violations. This rate roughly doubled for political content. Some of these posts had however reached millions of views before disappearing and researchers cannot retrieve them anymore; this is problematic because these are precisely the posts needed to study the systemic risks the DSA targets, from the dissemination of illegal content (Article 34(1)(a)) to negative effects on civic discourse and electoral processes (Article 34(1)(c)).

 about the posts that remain. TikTok's Research API exposes 32 of the 186 parameters the Web client transmits (~83% loss); for a single Instagram post, the platform sends 236 parameters in the browser but only 100 are available through the API. The stripped fields are largely the platforms' own governance signals stemming from their design and architecture: moderation labels, downranking and sharing-friction flags as also AI-labels.

 of the remaining data is practically retrievable: at 1,000 queries per rolling week, retrieving the comments of a handful of viral posts would be enough to exhaust Meta's entire weekly quota.

Because each mechanism filters a different slice of the 

, their effects compound. What survives is a dataset characterized by survivorship bias: content that was removed, downranked, or short-lived, precisely what is important to systemic risk research, is least likely to be in it. And because the governance signals are stripped out, researchers are left mainly with data about how platforms are 

. This is the same recurring narrative found in 

 reports, which locate risk in user behavior far more readily than in platform design. None of this concerns application procedures: a platform could approve every eligible researcher, charge nothing, and respond within days — and still deliver exactly such a dataset.

X's commitments constrain none of these mechanisms. The phrase "appropriate volumes of data" is the only language hinting toward quantity, and it remains undefined. Appropriate relative to what? The full public information environment users see, or whatever subset X unilaterally classifies as such? The DSA does not define what counts as "publicly accessible data," and so far, platforms have used that discretion liberally: Meta alone 

 three times since the launch of their Research API. There is no reason to expect X's implementation to be free of equivalent filters unless the Commission's supervision explicitly reaches them.

The scraping commitment is the exception, and it matters more than it may appear. This, however, must be read carefully: X commits only to stating in its terms that eligible researchers are not contractually prohibited from scraping publicly available data. That is not an affirmative right: it means scraping will no longer be contractually forbidden, but neither will it be contractually permitted. What this is worth in practice will depend on whether X refrains from technical countermeasures against vetted researchers' collection efforts.

Independent collection is the only way researchers can construct a ground truth against which to verify what official channels omit. Our audit was only possible because we scraped the 

 demonstrates that such advanced methods of scraping can be conducted on publicly accessible data alone, so that the method can operate within Article 40(12)'s scope as well as GDPR safeguards, while directly serving its systemic risk objectives.

Beyond implementation, the acceptance of the commitments leaves harder questions unresolved. First, "publicly accessible" still lacks a definition — and, as legal scholars like Daphne Keller have 

, it must be defined broadly and safeguarded against platforms shrinking it unilaterally, whether through technical barriers like login walls or through their own classification choices. Our findings show what is at stake in that definition: everything we measured was public in the ordinary sense — users saw it, and their devices received it, as they scrolled — yet up to half of it never reached researchers. If the content a platform itself pushes into millions of feeds does not count as "publicly accessible," the term has lost its meaning.

The privacy objection platforms raise against a broad definition of “publicly accessible” is, on closer inspection, part of the same definitional question. X's confidentiality arguments collapse on the facts because it sold equivalent access commercially: data offered to anyone paying $5,000 per month for the Pro API tier cannot plausibly be too sensitive for vetted researchers. And the pattern generalizes: an entire 

 sells corporations the very social media data researchers are denied. What remains are narrower sub-questions:what safeguards apply when anonymization or pseudonymization would make the research impossible, and what protective measures should govern residual confidentiality concerns under Article 40(12)? These deserve answers, but they are questions about 

Our findings therefore support a broad definition: the full user 

, which includes any content actively recommended by the platform to users, together with the complete metadata transmitted to their devices. Further, privacy tensions should be managed through access safeguards rather than through exclusion from scope.

Second, what will the audit measure? X has committed to an independent audit of its implementation. If the auditor merely verifies that procedures exist — an application portal, a fee waiver, a revised contract — the audit risks becoming procedurally satisfied but substantively hollow. We see this 

currently with the DSA's external systemic risk audits

, where auditors have largely confined themselves to procedural checks (and where X, after receiving the first cycle's only critical audit report, simply switched to a different auditor). If, instead, the audit benchmarks what the API delivers against what users actually see, it becomes a genuine test of completeness. Our methodology shows this comparison is feasible.

The corrective measures dismantle the barriers at the door, and that is a win for the research community. But Article 40(12) also exists to produce evidence for scrutinizing systemic risks beyond formalizing access. 

Whether X's implementation serves that purpose depends on the restriction mechanisms it employs 

the door — in scope, in metadata, in operations. Six months from now, that should be the standard against which compliance is established.

Lorena Giuberti Coutinho is a commissioner at Brazil's National Data Protection Agency (ANPD) and a Professor at IDP in Brasília. She previously worked as an economist at the OECD and contributed to the initial phase of research behind Growing Up in the Social Media Age. The opinions expressed in this article are the author's own and do not represent the official position of the ANPD.

 increasingly agree that children need greater protection online. Some have turned to age limits: 

Australia now requires users to be 16 to open a social media account

, Britain has announced it will do the same, and other countries and a number of US states are weighing similar steps.

The worry is real and widely shared. Many online platforms were not built with children’s interests in mind, and families should not bear sole responsibility for managing the consequences. Brazil starts from the same premise and takes a parallel route. Rather than preventing teenagers from accessing social media, the country's new ECA Digital law (

) focuses on reducing the risks embedded in platform design. New evidence on how young people actually use these platforms helps explain why this approach deserves attention.

Start with a deceptively simple question: is the harm in using social media, or in using it too much? While most research finds that excessive social media use is associated with negative outcomes, establishing a causal relationship is quite complex. The OECD's new analysis of 

 sheds further light on this issue. Among 15-year-olds, mathematics performance is highest for those who use social media moderately; both non-users and heavy users perform worse. Performance remains high up to about three hours a day, after which it begins to fall. The paper carefully describes these as associations rather than proven causes: students who are already struggling may be more inclined towards heavier use. In any case, another finding that stands out from the data is how intensively young people use social media, which suggests intensity is a plausible factor for regulators to address.

 around the principle of "safe by design." Rather than placing the burden entirely on parents or children, the law requires platforms to anticipate foreseeable risks and build protections into their products from the outset. Article 17 of the law requires providers to set the highest level of protection as the default and to limit features designed to prolong use, such as autoplay, rewards for time spent and notifications. It rests on a well-documented behavioral bias: people tend to leave the default settings in place. While engagement-maximizing design exploits this inertia to prolong use, protective defaults direct it towards the best interests of the child. Therefore, the safe configuration is the one that users must opt out of rather than the one they must hunt for. The decree implementing the law goes further by naming specific mechanics and requiring services to prevent designs that encourage excessive, problematic, or compulsive use, such as infinite scrolling and excessive notifications.

Platform design also matters because of network effects. A 

recent NBER study by Leonardo Bursztyn, Cass Sunstein and several colleagues

 finds this makes behavior hard to shift one person at a time, since the pull to stay connected with friends keeps everyone in place. That is part of why acting on design matters: rules that change the product itself do not depend on each child choosing to step back, and so can complement measures that work on access. The two levers reach the problem from different sides.

The same body of work points to instruments acting on intensity: caps on time and designs that ease moderation, which curb heavy use while preserving the value of moderate use. Young people are receptive to this: asked to choose, 

72% of under-16s preferred a tool that helps them limit their own use

. Taken together, this growing body of evidence suggests that platform design should continue to deserve attention. Age restrictions and design obligations are complementary measures that can work together to improve children's safety online.

The online-safety laws now emerging share a common feature: they shift responsibility towards the providers who control the design of the platforms. This means that the burden should no longer be placed only on parents and children to compensate for services that were not designed with their safety in mind. The ECA Digital is built on the premise that it is still possible to strike a balance between preserving opportunities for children online and protecting them.

Whether other governments ultimately choose age restrictions, design regulation, or a combination of both, the emerging evidence points in the same direction. Safer digital environments are more likely to result from changing how platforms are built than from expecting children to navigate products optimized to keep them online.

James Ball is a fellow at Tech Policy Press.

The United Kingdom has a new prime minister, in the shape of former Manchester major Andy Burnham—and that prime minister has had an energetic first week in office.

Burnham has announced a pledge to end street homelessness, introduced several measures to help the cost of living crisis, and opened a second prime ministerial headquarters—named Number 10 North—in Manchester. His priorities, he says, are focusing on cost of living, devolving power to the UK’s regions, and tackling a long-running crisis on the funding of social care.

On the surface, few of these priorities seem to involve tech policy, especially in contrast to former Prime Minister Keir Starmer’s proclaimed focus on growth, which he 

 he believed would rely in part on artificial intelligence. Behind the headlines, though, Burnham has significantly reshaped the UK government’s technology policy even in his first week in office—in ways that have divided initial expert reaction.

The most conspicuous policy shift to date was Burnham’s decision to fully abandon plans to introduce a digital ID system to the UK. Starmer had already walked back plans for such IDs to be mandatory, and to be required during employment checks—a policy 

—but was still rolling out unified digital ID across government services, without the element of compulsion.

 the scheme was now fully scrapped, and funds intended for digital ID would instead be used to help fund a tax cut on electricity bills, which in turn prompted controversy as former minister Darren Jones revealed the digital ID scheme 

While the digital ID story was the one that cut through with the media, the most significant shifts in the longer term were structural: as he appointed his first cabinet, Burnham 

 the UK’s Department of Science, Innovation, and Technology (DSIT), a department created just three years previously by Conservative Prime Minister Rishi Sunak.

DSIT represented an attempt to bring science and technology to the UK’s Cabinet table without being filtered through the lens of another department’s priorities, be that business, education, or culture. While the department was well-regarded in many quarters, and had amassed civil servants with real expertise in its field, it was not without its critics.

“Has DSIT been an unqualified success?” Gavin Freeguard, a former program director at the Institute for Government and founder of the State of the Future thinktank, 

 before listing its problems. “No. Low morale, perpetual restructuring, leadership questions…slow progress in key policy areas, in hoc to US big tech/AI hype.”

 issued after the decision to redistribute DSIT’s functions clarified that the intent was to embed science and technology policy across the government, rather than risk it becoming siloed.

“This move recognises that technology and innovation are not separate sectors of our economy – they are the foundation of all future industry, culture, and public service delivery,” noted the statement from Baroness Angela Smith, leader of the House of Lords.

Burnham has also promoted Kanishka Narayan, formerly the junior minister overseeing AI policy, to attend Cabinet—though not with the status of a fully fledged cabinet minister—to signal the continued importance of AI policy to the new administration.

Alongside that, several policy functions relating to AI are to be incorporated into a new central government department—the Office for the Prime Minister and the Cabinet, right at the heart of government. Ostensibly, this signals that AI policy will be a high priority of the new administration, but some who have looked at the details have 

Any reorganization of government departments typically causes delays and confusion as personnel wait to find out who they now work for, to physically move offices, to get their new email addresses, and so on. One digital policy consultant who works closely with the government, who asked not to be named for that reason, said he had given up on getting any work done before September or October at the earliest, “while everyone shuffles the deckchairs.”

There are substantive concerns, too. The UK set up the Government Digital Service (GDS) in 2011, which had considerable early success in modernising access to public service online—but which relied on having the muscle of the Cabinet Office behind it to do so, allowing it to strong-arm reluctant government departments.

The GDS has been shifted to the Department of Culture, Media, and Sports, now renamed the Department of Digital, Culture, Media, and Sports—traditionally a minnow of a department with little political clout.

Oversight of Ofcom, the agency regulating the UK's television channels, telecoms, and tasked with enforcing the Online Safety Act, will now sit entirely with DCMS, having previously been split between DCMS and DSIT. As a result, DCMS will be responsible for bringing the UK’s proposed social media ban for teens through parliament. Lisa Nandy, who remains as the culture secretary, received 

mixed reviews for her performance on her older, smaller, brief

It is AI policy, though, which seems to be most fragmented after the reorganization. Tom Loosemore, one of the co-founders of GDS, noted that the UK’s AI incubator would now be overseen by DCMS. The business department would oversee AI adoption and preparedness, alongside frontier and emerging technologies. The new Number 10 unit would be in charge of the AI Security Institute and a task force to support the prime minister.

It is not clear how much, if any of that, would actually be overseen day-to-day by the minister nominally in charge of AI policy. By trying to embed AI policy across government, Burnham may have risked spreading it so thinly that no one is able to grasp it.

“My forecast is that this future period will be one in which tech policy in general and big jazz hands plans for digital public service reform recede while DCMS works out how to get the new online safety measures over the line and [business secretary Jonathan] Reynolds looks for inward investment,” said Rachel Coldicutt, a freelance technology consultant.

“Meanwhile everyone who works in tech policy is losing their mind because they will suddenly need to speak with three times as many people as they did before and start building relationships all over again,” said Coldicutt. “If we compare with the absolute breathlessness of the last six years, since Cummings/Johnson, I think this might not be unwelcome, but the crux of the matter is that it needs to be an opportunity for someone, somewhere to get their act together and craft a compelling vision before the next election.”

Reversing his recent predecessors, Andy Burnham has scattered responsibility for technology policy across government. The success or failure of that approach will likely depend upon whether that results in it being owned by every minister, or by none.

A photo of a woman sitting next to a man who is not her husband. A screenshot of a fabricated chat. A photo of a woman who normally covers her hair, without her hijab. None of these images contain nudity, but if shared without permission, 

 shows that they can end a marriage, a career or even a life.

The stakes are highest in conservative communities, and while our research was focused on Pakistan and the Pakistani diaspora, we also found that these communities aren't confined to any one country or region. Yet nearly every law and policy created to combat image-based abuse would fail to recognize the circulation of these images without consent as abuse.

People are waking up to the realization that consent matters. That's why Meta was recently forced to pull 

 that let users generate images of anyone on Instagram without consent and without alerting the people whose photos were used. The backlash Meta faced wasn’t about nudification; it was about consent.

Laws in France and Denmark show that consent-based frameworks, whether that’s a right to your own image as they have in Denmark or or the right to privacy in France, can tackle image-based abuse. We believe that other countries should follow their lead.

, 110 countries had no law against image-based abuse, 67 countries had what are considered “sufficient” laws — meaning they align with Article 16 of the 

 — while 18 have laws that fall short of this standard, including the United States and Japan. While the increasing number of countries passing legislation protecting citizens against image-based abuse is a positive development, it is important to reflect on the limitations of such legislation.

Almost all current laws treat “intimate image-based abuse” as the only form of image-based abuse. What is defined as intimate falls under traditional Western perception of intimacy: nudity and sexual content. Yet, as highlighted in 

 on image-based abuse, for many women harm can also happen from the non-consensual sharing of non-explicit images.

While our research focused on the stories of Pakistani women and the Pakistani diaspora, women from all backgrounds can be affected by non-explicit image-based abuse. 

, in the UK, is one example: a man who was stalking her posted her selfies — none of which were intimate or nude images — onto pornographic websites where men were encouraged to make explicit comments about her images.

 exposed the limits of legislation built around "intimate" images. After a wave of nonconsensual sexualized edits, X said it had added measures to stop Grok from putting real people into "revealing clothing such as bikinis," but only geoblocked that editing in jurisdictions where it is illegal, leaving it available everywhere else. And even where it is restricted, the tool could still be prompted into sexualized edits by asking for "revealing summerwear" or a crop top instead of a bikini. Labour MP Jess Asato 

 after she publicly condemned Grok in January 2026; users generated a fake image of her in a bikini and a video depicting her being chloroformed and prepared for a sexual assault.

Examples of consent-based frameworks already exist. In France, people’s right to their own image is part of the right to privacy. 

 of the French criminal code prohibit the publication of a picture of a person without their consent or the creation of AI-generated deepfakes identifying a person without their consent. Violating those laws can lead to a fine of up to 45,000 euros and up to a year in jail (two years for the sharing of deepfakes). The punishment is harsher (60,000 euros and up to two years in jail) if the perpetrator is a former husband or partner.

The law requires that the person who shares the picture or the video has the written consent

In the case of a photograph taken in a private location (

), the sole criterion for requiring consent is whether the person depicted is identifiable. It is important to note that French law adopts a broad interpretation of what constitutes a private location. The French administration cites, for example, holiday photographs, family gatherings, sporting events, and cultural events as situations that fall within this category. Therefore, a photograph taken at an exhibition opening or during a football match would require the written consent of any identifiable person appearing in the image.

In the case of a picture taken in a public space (e.g., in the streets), there are two criteria for requiring consent: the person must be isolated AND identifiable. The law therefore does not prevent people from taking pictures of crowds in the streets as long as those images do not single out any individual who would also be identifiable.

When seeking consent to share an image, the person seeking to share it must be clear about how the image will be used. Where will it be shared? For what purpose? For how long? If someone obtains consent to share an image on a Facebook group but goes on to use that image for an advertising campaign, the consent would be null and void.

A consent-based framework isn’t just an abstract principle in France, it is something they are operationalizing. The French Minister of Economy publishes 

 for anyone seeking to publish or share a picture. For instance, they advise using pictures without identifying individuals where possible if the individuals do not serve a specific purpose; they warn against the risks of blurring faces, as other elements can identify a person (citing specifically: context, name tags, tattoos…); and they offer recommendations on how to store the consent obtained.

Passed in 2024, Article 226-8 specifically addresses the question of AI-generated deepfakes. The article bans the sharing of fabricated content done using the voice or picture of a person without their consent if it is not obvious that the picture is manipulated or if it’s not clearly labeled as manipulated media.

The fear of AI-generated deepfakes is also what prompted Denmark's changes 

, expected to come into effect this year. It will give citizens copyright over their own image and likeness, as well as their voice, in the context of AI-generated material. Therefore, creating AI deepfakes of an individual that looks like them without their consent could constitute a copyright violation.

While the amendment to the copyright legislation has received overwhelming support in Denmark and in the Danish parliament, at the EU level 

 that it could raise issues at a transnational law level, as it radically departs from the traditional understanding of copyright law that applies internationally. Copyright is indeed traditionally granted to content creators, not those appearing in the content.

A key concern around granting people a right to their own image is the fear that it could infringe on freedom of expression. Both the French and Danish legal frameworks address this concern with provisions specifically designed to prevent these laws being abused to curtail freedom of expression.

In France, the law states that obtaining consent from a person in a picture is 

An image pertains to a news event or a public demonstration, and is subject to the right to information and artistic freedom.

It is the image of a public figure exercising their duty (e.g. an elected official) and the intention of the image is to inform the public

“does not include imitations that are mainly expressions of caricature, satire, parody, pastiche, criticism of power, criticism of society, etc., unless the imitation constitutes misinformation that can specifically cause serious harm to the rights or essential interests of others.”

The cases of France and Denmark show that these laws can exist and can take different forms to adapt to the relevant legal framework of countries seeking to make lack of consent the threshold for what is considered image-based abuse. The copyright law in Denmark is not yet in force and France does not release exact numbers regarding the numbers regarding convictions under its privacy laws. However, it is important to stress that those legal frameworks can serve a purpose beyond the strict boundaries of criminal justice.

Currently, our research suggests that the reporting pathways of tech companies are often the first and only avenue of redress that survivors will use, and survivors primarily seek to see their content taken down. At the moment, tech companies offer little to no remedy when it comes to non-explicit image-based abuse, as those images do not violate tech company policies. However, we believe that the spread of consent-based legislation on the right to one’s own image can create a dynamic that will encourage companies to adopt it in their global policies. Thus, rather than offering geo-locked regulations specific to certain legal frameworks, we would like to see a shift in their takedown policy from "is it explicit?" to "was there consent?"

As the cases of France and Denmark show, there is no “one-size-fits-all” consent-based legislation that guarantees people a right to their own image. We believe that legislative change is most effectively achieved when those changes are integrated into the currently existing legal framework. France has a historically strong right to privacy and the right to one’s own image naturally emerges from it. This approach could work for other countries with similarly strong privacy legislation, such as Germany. Denmark chose the path of copyright law and when the law is implemented, time will tell if it was the right approach. However, other countries could choose other approaches. Some, including the UK and Pakistan, have recently passed online safety legislation that could be amended to offer a consent-based right to one’s own image.

While legislative approaches will differ, what matters is the principle that individuals should have meaningful control over the creation, sharing, and manipulation of images that identify them. Until states and companies recognize that any identifiable image shared without consent can become a tool of coercion and abuse, millions of survivors will remain outside the protection of both legal systems and the platforms that shape modern public life.

Can the Pall Mall Process Curb Spyware Abuse?

A group of shareholders of Samsung Electronics Co. hold a rally criticizing a tentative wage agreement struck between the company and its labor union near the home of Samsung Electronics Chairman Lee Jae-yong in Seoul, South Korea, Thursday, May 21, 2026. The letters read "Unjustified transfer strike." (AP Photo/Ahn Young-joon)

Workers in Asia Are Fighting for Protections as AI Threatens Jobs

A police officer checks the list of a polling station during the parliamentary elections in capital Nicosia, Cyprus, Sunday, May 24, 2026. (AP Photo/Petros Karadjias)

EU Political Ad Rules Leave Elections Open to Foreign Manipulation

Tech Policy Press - Technology and Democracy

Tech Policy Press is tracking laws and regulations, along with government investigations and litigation, that will shape the rules and accountability for tech companies.

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe