Deepfake Technologies and Their Legal Consequences

General Framework

Advances in artificial intelligence and deep learning algorithms have made it possible to imitate the facial, bodily and vocal data of real persons in an extraordinarily realistic manner and to transform such data into synthetic content. This technology, commonly referred to as “deepfake”, enables the creation of fabricated audio and visual material that portrays a person as though uttering words they never spoke or performing acts they never committed. As distinguishing such content from genuine material becomes increasingly difficult, the technology has ceased to be a mere technical novelty and has become a matter that entails multi-dimensional legal risks such as the violation of personality rights, disinformation, fraud and character assassination.

There is currently no specific statute under Turkish law that regulates deepfake content directly and exclusively. Nevertheless, the creation and dissemination of such content gives rise to significant legal consequences within the framework of existing legislation, in particular the provisions on personality rights under the Turkish Civil Code (the “TCC”) and the Turkish Code of Obligations (the “TCO”), various offences under the Turkish Penal Code (the “TPC”), the Law No. 6698 on the Protection of Personal Data (the “KVKK”), the Law No. 5651 on the Regulation of Publications on the Internet, and the Law No. 5846 on Intellectual and Artistic Works (the “FSEK”). This information note outlines, in broad terms, the personality rights, criminal law and compensation law dimensions of deepfake technologies.

Dimension of Personality Rights

A person’s image, voice and the honour and reputation shaped through them are among the personality values protected under Articles 24 and 25 of the TCC and within the scope of the TCO. The artificial creation of a person’s image or voice without their consent, and the creation of a false impression by such means, constitutes an unlawful attack on the personality rights of the individual concerned. A person’s right over their own image and voice also prevents these values from being used for commercial or other purposes without their permission.

Pursuant to Article 25 of the TCC, a person whose personality rights have been attacked may request the prevention of an imminent attack (action for prevention), the cessation of an ongoing attack (action for cessation/injunction), and, even where the attack has ended but its effects persist, a determination of the unlawfulness of the attack (action for declaratory judgment). The person may also request that the consequences of the attack be eliminated, for instance that the content be corrected, or that the judgment be communicated to third parties or published. As regards deepfake content disseminated in the online environment, depending on the nature of the content and on whether the privacy of private life has been violated, it may also be possible to resort to the removal of the content from publication and the blocking of access under Law No. 5651.

Criminal Law Dimension

The creation and sharing of deepfake content may give rise to different types of offences under the TPC, depending on the nature of the specific case and the intent of the perpetrator. Indeed, there is no single, self-standing “deepfake offence”; rather, various provisions become applicable according to the legal interest against which the act is directed. The offences most frequently likely to arise in practice are summarised below:

• Insult (Article 125 TPC): Fabricated audio and visual material produced in a manner that injures a person’s honour, dignity and reputation may constitute the offence of insult. Where the act is committed publicly, or in publicly accessible environments such as the press, broadcasting or the internet, the penalty is increased.
• Violation of privacy and unlawful obtaining of data (Articles 134 and 136 TPC): The unlawful obtaining of a person’s genuine image, voice or personal data for the production of a deepfake, or the disclosure by such means of images relating to a person’s private life, may give rise to these offences.
• Obscenity and content of a sexual nature (Article 226 TPC): The production and dissemination of fabricated content of a sexual nature depicting a person without their consent may be assessed within the scope of the obscenity provisions. Where the victim is a child, more severe sanctions may also arise, taking into account factors such as the method of production of the content and whether the image or data of a real child has been used.
• Slander (Article 267 TPC): The submission to competent authorities of fabricated content portraying a person as having committed an offence they did not commit, for the purpose of causing an investigation or prosecution to be initiated against them, may constitute the offence of slander.
• Fraud (Articles 157-158 TPC): Obtaining money or a benefit by imitating the voice or image of an executive or a relative constitutes the offence of fraud. Where the act is committed through the use of information systems as an instrument, this is deemed an aggravated form and the penalty is increased.
• Publicly disseminating misleading information (Article 217/A TPC): This provision may be applied to a person who, solely for that purpose and in a manner apt to disturb public peace, publicly disseminates information contrary to the truth concerning the internal or external security, public order or general health of the country. Deepfake content frequently becomes an instrument for creating disinformation through fabricated imagery of untrue events.

Copyright Dimension

Depending on the particular features of the specific case, deepfake content may also give rise to legal consequences under the FSEK. Pursuant to Article 86 of the FSEK, images and portraits depicting a person may not, subject to the exceptions set out in the Law, be exhibited or otherwise made available to the public without the consent of the person depicted, even where they do not qualify as a work. For this reason, making a person’s face publicly available by using it in deepfake content may be assessed not only under the provisions concerning personality rights but also within the scope of Article 86 of the FSEK. Furthermore, where photographs, videos, films, music, sound recordings or other protected content belonging to third parties are, in the course of creating the deepfake content, reproduced, adapted, altered or communicated to the public online without authorisation, an infringement of the economic and moral rights of the relevant authors and related right holders may also arise.

Compensation Dimension

A person whose personality rights have been violated by reason of deepfake content may, independently of the criminal law remedies, also bring claims for compensation under private law. Where damage arises from an unlawful act, tortious liability arises pursuant to Article 49 of the TCO, and the perpetrator is obliged to compensate the damage caused through their fault. The tangible pecuniary losses suffered by the person as a result of such content (for example loss of business, clients or earnings) may be the subject of a claim for pecuniary damages, while the distress, grief and loss of reputation suffered may be the subject of a claim for non-pecuniary damages pursuant to Article 58 of the TCO.

In addition, a person’s facial and vocal data qualify as personal data within the meaning of the KVKK, and the processing of such data without explicit consent or another legal basis may constitute a breach of the KVKK; this in turn gives rise both to the data subject’s right to claim compensation and to the risk of an administrative fine for the data controller. Deepfake content may thus, in many cases, simultaneously give rise to more than one type of legal liability at the same time.

On the other hand, where works belonging to third parties or content subject to related rights are used without authorisation in deepfake content, the right holders may, in addition to the general compensation remedies, also resort to the sui generis protection mechanisms of the FSEK. In this context, it is possible to bring actions for the prevention and cessation of the infringement, as well as claims for pecuniary and non-pecuniary damages pursuant to Article 70 of the FSEK.

Conclusion

Deepfake technologies are currently assessed within the framework of the existing provisions of Turkish law on personality rights, criminal law, copyright, the protection of personal data and internet legislation; however, no specific regulation that holistically addresses the distinctive characteristics of this technology is yet in force. The dispersal of the existing provisions across different statutes may at times render it difficult to secure swift and effective protection for victims. In response to this need, it is known that legislative work aimed at directly regulating artificial intelligence applications is ongoing.

Securing effective legal protection against the violations caused by deepfake content is of critical importance in terms of speed and the preservation of evidence. For this reason, it is important that victims assess, without delay and while securing the evidence, the remedies of removal of the content and blocking of access, criminal complaint, and pecuniary and non-pecuniary compensation, in a simultaneous manner.