I INTRODUCTION

On 3 September 2024, the Criminal Code Amendment (Deepfake Sexual Material) Act 2024 (Cth) (the Act) came into force, amending the Criminal Code Act 1995 (Cth) to introduce dedicated federal offences targeting the non-consensual transmission and creation of AI-generated sexual material.[1] The Act was a direct legislative response to a gap that had become impossible to ignore: existing law required proof that an original intimate image existed, yet modern AI tools allowed perpetrators to generate entirely fabricated, photorealistic sexual content depicting real, identifiable people without ever possessing or recording a genuine image.[2]This commentary examines what the Act achieves, where it falls short, and what amendments would strengthen its capacity to deliver justice to victims of one of the most rapidly growing categories of technology-facilitated abuse.

II THE ACT IN BRIEF: WHAT WAS PASSED AND WHY

The Act inserts new sections 474.17A, 474.17AA, and 474.17AB into the Criminal Code Act 1995 (Cth), creating a tiered offence structure based on the perpetrator's role in the production and distribution chain.[3] Under section 474.17A(1), transmitting sexual material depicting a person aged 18 or older without their consent attracts a maximum penalty of six years imprisonment.[4]Critically, subsection 474.17A(2) renders it irrelevant whether the material was transmitted in unaltered form or "created, or altered in any way, using technology," explicitly capturing AI-generated deepfakes.[5]

Where the person who transmitted the material was also responsible for its creation or alteration, section 474.17AA(5) elevates the offence to an aggravated category, attracting a maximum penalty of seven years imprisonment.[6] A further aggravated offence under section 474.17AA(1) applies where the offender has previously been the subject of three or more civil. penalty orders under the Online Safety Act 2021 (Cth) in connection with related non-consensual image offences.[7]

The Bill received broad parliamentary support when introduced in June 2024, driven in large part by the scale of documented harm.[8] Estimates from the eSafety Commissioner indicated that reports of non-consensual image-based abuse had increased significantly in the years preceding the legislation, with a growing proportion involving AI-generated rather than authentic content.[9]Documented cases of victims suffering severe and prolonged psychological harm as a result of deepfake content circulating online — with no adequate legal remedy available — created the political conditions for a swift parliamentary response.[10]

III BENEFITS OF THE ACT

A)    FOR VICTIMS

The most significant benefit of the Act is the closure of the "digital creation loophole." Under the previous law, a perpetrator who generated sexual content using a nudification application or generative AI tool, without ever possessing or transmitting a real intimate image of the victim, occupied a legal grey area.[11] The Act eliminates that grey area. The "appears to depict" standard in section 474.17A(1)(c) means that the offence is engaged where material resembles or purports to be a real, identifiable person, shifting the legal focus from the mechanics of production to the harm caused to the victim.[12] For the first time, a victim whose image has been digitally fabricated has access to a dedicated federal criminal remedy rather than being directed to state-level provisions that were not designed with AI-generated content in mind.

B)    FOR THE COMMUNITY

The Act functions as a clear public deterrent. Prior to its passage, the absence of specific federal criminalisation created a perception in some quarters that the conduct fell within a legal blind spot.[13] The Act communicates an unambiguous legislative position: the non-consensual transmission of sexual material, regardless of whether it depicts a real recording or an AI-generated simulation, is a serious federal offence carrying real custodial consequences.

C)    FOR BROARDER ONLINE SAFETY

The Act complements existing federal and state frameworks without displacing them. It operates alongside the Online Safety Act 2021 (Cth), creating a layered regime in which both the civil and criminal arms of the law are available to address different aspects of the harm.[14] The Act adds to the available toolkit without forcing every case through the criminal courts.

IV DISAVANTAGES AND RISKS OF THE ACT

A)    RISK OF MISIDENFICATION AND WRONGFUL LIABILITY

The Act's broad definitional scope, while necessary to capture AI-generated content, creates a risk of wrongful attribution. Where an account is compromised or where identifying metadata is fabricated, an innocent person may appear to be the source of transmission.[15] The Act does not contain specific evidentiary guidance addressing this scenario. A person whose device or account was used by another without their knowledge could, in principle, face investigation before the true offender is identified.

B)    POTENTIAL FOR MALICIOUS USE

Any broadly drafted criminal provision carries a risk of weaponisation. The Act's reliance on the subjective consent standard means that a complainant can initiate a criminal process by alleging non-consent, even in circumstances where the facts may be disputed or fabricated.[16] This is an argument not against the Act but for robust prosecutorial discretion guidelines and clear investigative thresholds that protect individuals from being subjected to criminal process on the basis of unfounded allegations.

C)    JURISDICTIONAL FRAGMENTATION

While the Act addresses transmission via a carriage service, the regulation of standalone creation — generating a deepfake without transmitting it — remains primarily a matter of state law.[17] Queensland, New South Wales, and South Australia have each enacted or proposed state-level provisions targeting creation even absent transmission, but the approach and penalties differ across jurisdictions.[18] This fragmentation creates inconsistency in the legal treatment of materially similar conduct depending on where the offender and victim are located.

V KEY IMPLICATIONS

A)    THE EVIDENTARY CHALLENGE OF PROVING AI AUTHORSHIP

One of the most significant practical challenges the Act creates for prosecutors is establishing that material was AI-generated rather than authentic. The legislation does not specify any technical evidentiary standard for proving AI authorship.[19] In practice, establishing this will require forensic digital evidence, including metadata analysis, file signature examination, and expert evidence from specialists in AI-generated content detection. Courts and prosecutors will need to develop capacity in this area quickly. The absence of statutory guidance on the admissibility or weight of AI detection evidence creates an early-stage uncertainty that defence counsel will inevitably exploit. Legislative guidance or judicial practice directions on this point would reduce the scope for inconsistent outcomes.

B)    THE CIVIL-CRIMINAL GAP AND ITS CONSEQUENCES FOR VICTIMS

The Act criminalises the conduct but does not address the civil remedies available to victims.[20] A criminal conviction, even if obtained, does not automatically provide a victim with compensation for the psychological, reputational, or economic harm suffered. Tort law remedies for intentional infliction of emotional distress, invasion of privacy, and reputational damage remain underdeveloped in Australia in this context. Many victims who decline to pursue criminal proceedings are left without a meaningful civil remedy. A more complete legislative response would include express civil liability provisions enabling victims to claim damages without having to establish criminal liability first.

C)    THE INTERACTION WITH FREEDOM OF EXPRESSION PRINCIPLES

The Act does not contain an explicit freedom of expression exception, though subsection 474.17A(3)(d) provides a general exception where a reasonable person would consider transmission acceptable having regard to a list of contextual factors.[21] The boundaries of this exception in the context of satire, parody, or political commentary involving digitally altered imagery are not settled. It is foreseeable that a prosecution involving clearly satirical content could raise difficult questions about the scope of the exception that the legislature should address with greater precision.

VI PROPOSED CHANGES

The Act represents a genuinely significant step forward. The proposed changes below are directed at strengthening its operation rather than altering its foundations.

A)    INCREASE THE BASE PENALTY UNDER SECTION 474.17A(1)

Six years imprisonment for a base transmission offence does not adequately reflect the severity of harm that non-consensual deepfake sexual material causes. The psychological damage to victims is comparable to other serious sexual offences that carry higher maximum penalties.[22] A minimum base penalty of eight years, with the aggravated offences scaled accordingly, would better calibrate the criminal law to the actual harm profile of this conduct.

A)    INSERT A DEDICATED EVIDENTARY PROVISION FOR AIGENERATED CONTENT

The Act should be amended to include a section prescribing the admissibility of AI forensic evidence and the qualifications required of expert witnesses in proceedings involving alleged deepfake material. This would reduce early-stage litigation uncertainty and ensure that courts across jurisdictions apply consistent standards when evaluating whether material is AI-generated.

B)    CREATE A CIVIL CAUSE OF ACTION

A new section should provide a standalone civil cause of action enabling victims to seek damages, injunctions, and takedown orders through the civil courts without needing to establish criminal liability. This would address the civil-criminal gap identified above and ensure that victims who cannot or do not wish to engage the criminal process have a meaningful legal remedy.

C)    ADDRESS THE DIGITAL FOOTPRINT AND INVESTIGATIVE OBLIGATION

The Act does not impose any obligation on platforms, internet service providers, or law enforcement to actively pursue digital footprint evidence of offenders. A complementary provision requiring relevant authorities to preserve and analyse digital trail evidence in investigations under this Act would strengthen enforcement and reduce the capacity of offenders to evade accountability through technical anonymisation.

 VII CONCLUSION

The Criminal Code Amendment (Deepfake Sexual Material) Act 2024 (Cth) is an important and overdue piece of legislation. It closes a genuine and harmful gap in the law, provides victims of AI-generated sexual abuse with a dedicated federal remedy, and sends a clear deterrent message to those who might otherwise regard digital fabrication as a consequence-free form of harm.[23] Its weaknesses are real but addressable. The penalty structure underestimates the severity of the harm. The absence of evidentiary guidance creates unnecessary uncertainty for prosecutors. The civil-criminal gap leaves many victims without a remedy proportionate to their loss. And the fragmented state-federal interaction leaves standalone creation inconsistently regulated.

Technology will continue to outpace legislation. The generation of photorealistic synthetic media is already available to any person with a smartphone and an internet connection. The Act is a foundation. What is built on it matters.

VIII FOOTNOTES

[1]Criminal Code Amendment (Deepfake Sexual Material) Act 2024 (Cth) s 2; the Act received Royal Assent on 2 September 2024 and commenced on 3 September 2024.

[2]Australian Parliament, House of Representatives, Bills Digest No 81 of 2023–24, Criminal Code Amendment (Deepfake Sexual Material) Bill 2024(Parliamentary Library, 2024) 3–5 ("Bills Digest").

[3]Criminal Code Amendment (Deepfake Sexual Material) Act 2024 (Cth) sch 1 items 5–6, inserting ss 474.17A, 474.17AA and 474.17AB into the Criminal Code Act 1995 (Cth).

[4]Criminal Code Act 1995 (Cth) s 474.17A(1). The carriage service threshold imports the definition in the Telecommunications Act 1997 (Cth) s 7.

[5]Criminal Code Act 1995 (Cth) s 474.17A(2); see also the note to s 474.17A(2) which expressly identifies "deepfakes" as an example of material covered by para (b).

[6]Criminal Code Act 1995 (Cth) s 474.17AA(5). The aggravated offence under s 474.17AA(1) applies where the offender had previously accumulated three or more civil penalty orders: at s 474.17AA(1)(b).

[7]Criminal Code Act 1995 (Cth) s 474.17AA(1); Online Safety Act 2021 (Cth) ss 75(1), 89, 91.

[8]Commonwealth, Parliamentary Debates, House of Representatives, 5 June 2024, 5 (Mark Dreyfus, Attorney-General); Commonwealth, Parliamentary Debates, Senate, 3 July 2024, 12.

[9]eSafety Commissioner, Image-Based Abuse: 2023 Report (Australian Government, 2023) 12–14.

[10]Clare McGlynn and Erika Rackley, "Image-Based Sexual Abuse" (2017) 37(3) Oxford Journal of Legal Studies 534, 537–540.

[11]Bills Digest (n 2) 5; see also Criminal Code Act 1995 (Cth) s 474.17A(2).

[12]Criminal Code Act 1995 (Cth) s 474.17A(1)(c). For the "appears to depict" standard, see Bills Digest (n 2) 7.

[13]Bills Digest (n 2) 6–7; see also eSafety Commissioner (n 9) 8.

[14]Online Safety Act 2021 (Cth) ss 89–91 (removal notice regime).

[15]Emily Laidlaw, "Platform Liability and Non-Consensual Intimate Images" (2019) 17(2) Canadian Journal of Law and Technology 1, 18.

[16]Criminal Code Act 1995 (Cth) s 474.17A(1)(d)(i)–(ii); s 474.17A(5) (definition of recklessness in relation to consent).

[17]Criminal Code Act 1995 (Cth) s 474.17A(1)(a).

[18]Crimes Act 1900 (NSW) ss 91PA, 91R(1A) (as amended); Criminal Code Act 1899 (Qld) s 223A.

[19]Bills Digest (n 2) 8; see generally Henry Ajder et al, The State of Deepfakes: Landscape, Threats and Impact (Deeptrace Labs, September 2019) 7.

[20]Normann Witzleb and Megan Richardson, "Reviving a Landmark Tort: Privacy in Australia" (2019) 43(1) Melbourne University Law Review 1, 6–9.

[21]Criminal Code Act 1995 (Cth) s 474.17A(3)(d).

[22]Ajder et al (n 19) 7; McGlynn and Rackley (n 10) 540–542.

[23]Criminal Code Amendment (Deepfake Sexual Material) Act 2024 (Cth), Explanatory Memorandum, 1.