In Australia it is a federal crime to share a sexual deepfake of an adult without their consent. Under the Criminal Code Amendment (Deepfake Sexual Material) Act 2024, section 474.17A of the Criminal Code covers sexual material sent without consent whether it is real or made with AI, with a maximum of 6 years' imprisonment, or 7 years for the person who created or altered it. Making a fake without sharing it is a matter for state law, and NSW, South Australia and Victoria now have offences that cover it. Separately, eSafety can order a deepfake taken down whoever made it.
This page maps the law as general information, not legal advice. If you have just found a fake of yourself, start with the deepfake first-response plan, which covers evidence and reporting. Leaks of real paid content raise different questions, covered in is leaking creator content illegal.
The federal offences, element by element
Section 474.17A, as substituted by the 2024 Act, has four parts. Someone uses a carriage service, which covers the internet, phones and messaging, to transmit material of another person; that person is, or appears to be, 18 or older; the material depicts or appears to depict them in a sexual pose or sexual activity, or shows a sexual organ, the anal region or, for a female, breasts; and the sender knows the person does not consent to the transmission or is reckless about it. The Act says recklessness includes not giving any thought to consent, and that it makes no difference whether the material is unaltered or created or altered using technology. Its note names deepfakes as an example.
Transmit is defined broadly to include making available, publishing, distributing, advertising and promoting, so offering a fake for sale or pointing people to it is covered as well as posting it. There are exceptions for law enforcement, court proceedings, genuine medical or scientific purposes, and transmissions a reasonable person would consider acceptable, judged on factors such as the content, the circumstances, the effect on the depicted person's privacy and the relationship between the two people.
Section 474.17AA, inserted by the same Act, adds two aggravated versions. One applies when the sender was responsible for creating or altering the material; the other applies when three or more civil penalty orders had already been made against them under the Online Safety Act's image-based abuse provisions. The amending Act commenced on 3 September 2024 and applies to material transmitted after that date, regardless of when it was made. What it does not do is criminalise creating a fake that is never sent anywhere; creation only raises the penalty for someone who also transmits it.
Law map: conduct, enforcer and maximum penalty
Penalties are the maximums stated in the source in each row, not what a court would impose in a given case. Penalty units convert to a dollar amount set by the Commonwealth, so check the current value before quoting one.
| Law | Conduct covered | Who enforces | Maximum as the source states |
|---|---|---|---|
| Criminal Code section 474.17A | Transmitting, publishing or promoting sexual material of an adult without consent, whether real or made with AI | Federal or state police, with Commonwealth prosecutors | Imprisonment for 6 years, per the 2024 Act |
| Criminal Code section 474.17AA(5) | The same transmission by the person who created or altered the fake | Police and Commonwealth prosecutors, as an aggravated charge | Imprisonment for 7 years, per the amending Act |
| Criminal Code section 474.17AA(1) | The same transmission by someone already subject to three or more image-based abuse civil penalty orders | Police and Commonwealth prosecutors, relying on the earlier court orders | Imprisonment for 7 years under subsection 474.17AA(1) of the 2024 amendments |
| Online Safety Act 2021 section 75 | Posting or threatening to post an intimate image, deepfakes included, on a social media service, messaging service or website without consent | eSafety, through formal warnings, infringement notices, injunctions and civil penalty proceedings | 500 penalty units, per eSafety's scheme guidance |
| eSafety removal notices and remedial directions | Ignoring a notice to take the image down, or a direction such as not to post it | eSafety, against the poster, platform or hosting service named in the notice | 500 penalty units for each kind of breach, per the November 2025 guidance |
| NSW Crimes Act 1900, Part 3, Division 15C | Creating, sharing or threatening to share sexually explicit images or audio without consent, AI-generated material included, for conduct on or after 16 February 2026 | NSW Police; courts can also order the material removed or deleted | 3 years, a fine of up to $11,000, or both, per NSW Communities and Justice |
| SA Summary Offences Act 1953, sections 26G and 26H | Creating or distributing a humiliating, degrading or invasive depiction of a simulated person, from 3 November 2025 | South Australia Police | Fines up to $20,000 and up to 4 years, depending on the depiction and the person's age, per the SA Law Handbook |
| Victoria Crimes Act 1958, section 53R | Producing an intimate image of someone, including by digitally creating it, contrary to community standards of acceptable conduct | Victoria Police, which says its image offences cover deepfakes | 3 years' imprisonment, per the section text on AustLII |
| ACT, Northern Territory, Queensland, WA and Tasmania | Distribution and threat offences that differ by jurisdiction, with Tasmania relying on privacy-recording offences | Police in the state or territory concerned | Check the sections on eSafety's state-by-state list before relying on a figure |
eSafety's scheme: removal comes first
The criminal law punishes the person responsible; eSafety's civil scheme is about getting the image down. Its image-based abuse regulatory guidance says intimate images can include digitally altered photos and deepfakes, and images shared so that people will think they show a particular person, such as a nude tagged with your name. Drawings and cartoons would not usually count. Either you or the person who posted it must ordinarily live in Australia, which includes Australians who happen to be overseas when it happens.
A removal notice can go to the poster, the platform, or the hosting service behind a website, and the same guidance says the Act sets no time limit on when eSafety may give one, so an old fake is not out of reach. eSafety can also give a remedial direction, for example telling someone not to post an image they have threatened to share. For deepfakes, the main friction is volume: eSafety's reporting page says it prioritises complaints that need the quickest compliance and enforcement action. Its approach to images first made for commercial purposes is a separate issue, covered in the leaked content legal guide.
State and territory laws fill the creation gap
NSW changed its law in 2025. According to NSW Communities and Justice, it is now a crime to create or share, or threaten to share, sexually explicit images, video or audio of someone without consent, including content generated by AI, for conduct on or after 16 February 2026. The same DCJ page says courts can order offenders to remove or delete the material, with penalties for ignoring the order; proceedings against anyone under 16 need the approval of the Director of Public Prosecutions; and the law will be reviewed after a year.
South Australia took a different drafting route. The Legal Services Commission's Law Handbook explains that from 3 November 2025 it has been an offence to create or distribute a humiliating, degrading or invasive depiction of a simulated person, meaning a person shown in content created wholly by AI, or solely with digital technology, that purports to be or resembles a real person. Altered real images stay under the older invasive image offence, written consent is a defence, and a separate offence covers threats to distribute a depiction.
In Victoria, Victoria Police describes offences of producing, distributing or threatening to produce or distribute intimate images without consent, says producing includes digitally creating an image, and lists deepfakes as covered. For the other states and territories, eSafety's police and legal help page lists the sections for each jurisdiction and notes that Tasmania has no offence aimed specifically at image-based abuse, relying instead on privacy-recording offences.
Two official sources disagree here. eSafety's state list, updated on 29 September 2026, still describes the NSW offences as recording, distributing and threatening, and places Victoria's in the Summary Offences Act 1966. NSW Communities and Justice and Victoria Police both describe creation and production offences that the list does not mention. The state agencies administer their own laws, so treat their current pages as the better guide and ask police which section they would use.
Civil options alongside the criminal law
Criminal charges depend on police and prosecutors; civil routes are ones you, or a lawyer for you, can start. The main ones for a deepfake are:
- The statutory tort for serious invasions of privacy, which since 2025 lets you sue over misuse of information about you; the privacy tort guide for creators explains the elements, remedies and tight time limits.
- Defamation, where the fake carries a false and damaging message about you, such as implying you sell content you have never made.
- A protection order, which eSafety's legal help page says can stop a known person from sharing or threatening to share your intimate images, with a breach becoming a crime.
- Copyright, which suits reposted originals far better than fabrications; a lawyer can say whether a fake copies enough of your own photo or video to support a notice.
Which route fits: a checklist
- The fake is online and you want it gone: report it to the platform and to eSafety, which does not require a police report first.
- You can name the person who made or posted it and they are in Australia: add a police report, because the federal offence and any state creation offence can both apply.
- Someone made a fake but you have no evidence it was shared: ask police in NSW, South Australia or Victoria about the creation and production offences there.
- The poster is overseas but you live here: eSafety can still act, because the residency test is met by either of you.
- The same person has been through eSafety before: tell police, because prior civil penalty orders can support the aggravated charge.
- The fake comes with threats or demands: police first, then the sextortion safety steps.
- The fake is not sexual but is spreading lies or exposing private details: speak to a lawyer about defamation or the privacy tort.
The rules work differently overseas; the UK deepfake offence table is the comparison point if the person responsible is in Britain.
Limitations of this law map
This is general information about Commonwealth and state law as published on official and legal-aid pages read on 1 October 2026, and it is not legal advice. Several of these laws are recent and courts have had little chance to interpret them, state agencies and eSafety do not yet describe them consistently, and maximum penalties say nothing about likely outcomes. Police and eSafety also decide which matters to pursue. Check the current text of the relevant law, contact police if you are in danger or a crime may have been committed, and get advice from a lawyer, community legal centre or legal aid service before relying on any route above.