Who Gets Deepfaked? AI Sexual Abuse, Women in Public Life, and the Limits of Platform Transparency
The views expressed in this publication are those of the author and do not necessarily reflect the official stance of the European Digital Media Observatory. This text has been published as part of the third edition of the new monthly EDMO Signals & Noise newsletter. Sign up here to receive future editions directly to your inbox.
Author: Benjamin Shultz, Lead Researcher at The American Sunlight Project, a nonpartisan organization based in Washington that exposes online harms. He is also an External Doctoral Researcher at Hochschule Neu-Ulm, where his dissertation examines the impacts of deepfake sexual abuse on democracy. Additionally, Ben teaches courses on open-source investigative techniques and media literacy and holds a Data Fellowship with Agora Digitale Transformation in Berlin.
Feed an ordinary photo — a headshot, a holiday snap, a campaign portrait — into one of a growing class of “nudify” apps, and within seconds it returns a fabricated sexual image of the person depicted. The picture is fake. The harm is not. Once posted, it can be copied, re-shared and indexed by search engines faster than anyone can chase it down. The people on the receiving end range from schoolchildren to journalists to members of parliament, many of whom have been driven out of public life, their careers, or have taken their own lives.
The scale is easy to underestimate. By one widely cited estimate, 98% of deepfake videos online are pornographic, and 99% of them depict women. Many nudify apps simply do not work on images of men: the abuse is gendered by design, baked into the data the tools are trained on. Over the past two years, links advertising these apps have soared by more than 2400% across mainstream social platforms. What was once a fringe, technically demanding practice is now a cheap, point-and-click consumer product. And when the targets are women in public life, the purpose is to discredit, humiliate and silence. Women politicians across the world have been targeted with fake sexual images timed to elections, controversies or moments of visibility. Seen this way, deepfake sexual abuse belongs on the same shelf as other grave threats to democracy: it is a way of distorting who gets to take part in public debate, and on what terms.
Until recently, much of the evidence was anecdotal. Not in a pejorative way, but rather, brought to light through individual testimony, viral incidents on Grok or 4Chan, or through sporadic local and national news headlines. New evidence is beginning to show the shape of the problem. Building on our work at The American Sunlight Project (ASP) that first measured how often members of the US Congress appear on deepfake-hosting sites, I’ve run the preliminary results of a new cross-national study, examining roughly 2,200 members of parliament across eight democracies. To attempt to benchmark how deepfake sexual abuse impacts women in public life, I used a custom search engine check whether their names surfaced on two-dozen deepfake-hosting domains. Their names sure did appear — dozens of them.
Two patterns stand out. First, gender is by far the strongest predictor of exposure on deepfake-producing domains: women legislators are dramatically more likely to be found. Second, in countries with explicit laws against this kind of abuse, legislators were meaningfully less likely to appear — a sign that clear legal prohibition can deter. Age, seniority and migration background, by contrast in this particular case, predicted little — although existing research has shown that these attributes indeed make women more susceptible to online abuse. The full findings of this study will be presented in an academic format at the end of 2026, however, there is an important takeaway: who gets deepfaked is not random; it is structured by gender and shaped by policy.
That second finding — that policy matters — leads to an uncomfortable problem at the heart of platform regulation. The Digital Services Act is built on transparency, the idea that if platforms must disclose how they operate and what content they distribute, researchers, regulators and the public can hold them to account. But transparency only works if the disclosures are honest.
As an antecedent to this study, ASP collaborated with Indicator last year to find thousands of ads for nudifier apps on Facebook which had filled legally required “beneficiary” and “payer” fields (i.e., who paid for this ad?) with fictitious or unverifiable information, in violation of the spirit of the DSA. The disclosure fields existed; they were just filled with bogus text, on a massive scale. Interestingly, we could see legitimate disclosures in ads targeting countries outside the EU, including Singapore and Taiwan (both of which maintain robust online governance regimes) finding most nudifier app ad beneficiaries and payers to be based in Southeast Asia. In essence, the very transparency tool mandated by the DSA had become a hiding place, demonstrating that either Meta willfully enabled ‘malicious noncompliance,’ or that the advertising rules in Singapore and Taiwan are simply more enforceable. Either way, the lesson here is, we cannot judge platform behavior using only the data platforms choose to hand us. And based on this lesson, we therefore cannot reasonably estimate the scale of the problem — despite our best efforts to use custom search engines and other OSINT-based methods — until platforms and web hosts play ball.
None of this means law is useless — my cross-national data suggests the opposite — and governments are moving. Germany’s draft law against digital violence would create new criminal offences for sexual deepfakes and notes explicitly that women are especially affected; the United Kingdom has moved to criminalize their creation and sharing; and the United States’ Take It Down Act requires platforms to remove such content quickly. These are real steps. But most of this architecture is reactive; it punishes individual creators and removes individual images after the harm is done. Both of these steps are positive compared to before, but, all the while, new nudifier apps pop up in the stores, new ads keep running, and deleted images reappear elsewhere within hours. And both Meta and the EU haven’t fixed the nudifier ad disclosure loophole. As Nina Jankowicz so aptly describes the problem, that’s one giant game of “Whack-A-Troll.”
If the goal is to protect democracy and the standing of all in public life, four concrete moves at the EU-level would do more than the current transparency and enforcement regime mandated by the DSA. First, enforce transparency in substance, not just in form: rather than allowing free-form text in disclosure fields, mandate platforms only host ads from real, verified business entities based in the countries which they target. Second, move upstream — app stores, web hosts, and advertising networks should stop distributing and monetizing tools whose primary actual purpose is abuse — e.g., not simply taking face-swap apps at their word. Third, name the problem accurately: this is an information-integrity and gender-equality issue, not a taboo or embarrassing one, and it deserves sustained research funding, in academia and civil society, as well as continued policy attention. Fourth, the EU must stick together; the 27 member states have 27 different sets of rules governing the legality of deepfake pornography. The data shows, explicit prohibitions on deepfake pornography appear to have a mild deterrence effect. Ideally, future amendments to the DSA, the Digital Markets Act (DMA) and AI Act will implement a bloc-wide, unified policy prohibiting nonconsensual deepfake pornography.
Europe’s transparency rules will continue be tested precisely on cases like these — where a platform’s own disclosure tools are turned into cover for the harm they were meant to expose. Getting this right protects more than the individuals targeted. It protects the basic openness of public life: the ability to stand for office, report a story or speak in public without being driven out by a fake.