RN
"Still a thing" is the wrong frame, and it is worth replacing before answering, because it treats this as a trend that might have run its course.
Deepfakes were never a trend. They were a capability, and capabilities do not go out of fashion — they get cheaper. What has happened since is exactly that, plus something the earlier coverage did not anticipate: the law arrived.
The technique became a product
The first wave required a person who understood the tools, a substantial set of source images, a decent GPU and patience. That combination is a filter, and it kept the volume low and the targets famous, because only well-photographed people supplied enough training material.
That filter is gone. The work now happens on hosted services that take an uploaded photograph and return a result, and the skill required has collapsed to filling in a web form. Those services operate openly, take payment, and draw traffic measured in tens of millions of visits a month across the category.
The consequence is a change in who this happens to. When the barrier was technical, the targets were people with thousands of public photographs. When the barrier is a single image, the targets are colleagues, classmates, ex-partners and strangers — and a substantial share of reported incidents now involve schoolchildren, generated by other schoolchildren.
What the category actually consists of
This is the number worth carrying: across the studies that have sampled it, the great majority of deepfake material circulating online is sexual, and it is almost entirely of women who did not agree to it. Estimates cluster in the mid-to-high nineties as a percentage and vary with sampling method, so treat the exact figure with care — but every serious measurement lands in the same place.
That matters for how the subject is discussed. Deepfakes are frequently framed as a general problem about misinformation, with political fakes as the headline case. Empirically, the field is overwhelmingly one thing: sexual images of real women, made without asking.
What changed legally
Two developments in the last eighteen months are the substantive answer to the headline question.
In the United States, the TAKE IT DOWN Act was signed on 19 May 2025. It makes it a federal crime to publish, or to threaten to publish, non-consensual intimate imagery, and it says explicitly that AI-generated imagery counts. Its more practical half is the platform duty: covered services had to build a notice-and-removal route, remove reported material and known identical copies within 48 hours, and had until 19 May 2026 to have it working. Failure is treated as a Federal Trade Commission Act violation, and the FTC has since put warning letters in front of fifteen major platforms.
In the United Kingdom, section 138 of the Data (Use and Access) Act 2025 came into force on 6 February 2026. It criminalises making — or asking someone else to make — a purported intimate image of an adult without their consent. Two details give it teeth. The offence is the creation, so no distribution is needed for it to be complete. And it is not written around AI specifically: a manually edited image is covered on the same terms as a generated one.
Between them, those close the two gaps that made the earlier position almost unenforceable: that making the image was not itself illegal, and that a victim's only recourse was to ask a platform nicely.
What they do not fix
Plenty. Services hosted outside either jurisdiction carry on. A takedown removes a copy, not the copies already downloaded. Identifying an anonymous creator is real investigative work that under-resourced police forces will not always do. And enforcement against a fourteen-year-old who used an app on a classmate raises questions neither statute answers well.
The honest summary is that the legal position went from absent to serious in about a year, and that the practical position is improving more slowly than the statute book.
If this happens to you
Do not go looking for the source alone and do not negotiate with anyone demanding money — the demand escalates when it is paid.
Capture evidence first: URLs, usernames, timestamps and screenshots, before anything is deleted. Then use the platform's non-consensual intimate imagery report — the dedicated route, not a generic "report post" button — which now runs on a legal deadline in the US. Hash-matching services exist that let you register an image from your own device so participating platforms can block re-uploads without you ever sending the picture to anyone. And report it to the police: in the UK the creation is now a criminal offence in its own right, and in the US the publication and the threat both are.
On "responsible enjoyment"
Earlier writing on this subject, including the version of this article that stood here before, tended to end on a note about navigating the ethics thoughtfully.
There is not much to navigate. The defining property of this material is that a real person is in it who did not agree to be, which is not a complication attached to the genre — it is the genre. Synthetic performers who depict nobody are a different subject entirely and raise none of these questions. What is being discussed here is a picture of someone specific, and there is no version of consuming that responsibly, only a version where the person in it never finds out.