A Real Account of Deep Fakes

Benjamin L.W. Sobel* April, 2026

Laws regulating pornographic deepfakes are written to prohibit “digital forgeries,” “false” images, or media “indistinguishable” from “authentic” recordings. Yet the typical anti-deepfake law covers materials that aren’t forgeries, aren’t false, and that reasonable observers can easily distinguish from authentic recordings. Though drafted as if they regulate statements of fact, anti-deepfake laws actually target certain outrageous depictions per se—and rightly so, because pornographic deepfakes cause harm irrespective of their truth or falsity. However, the inapposite language of facts results in statutes with crucial ambiguities. Moreover, because anti-deepfake laws ban outrageous depictions irrespective of the factual assertions they make, they differ fundamentally from the information-privacy and defamation regimes that they superficially resemble. Instead of regulating true or false disclosures of fact, anti-deepfake laws fall into a distinct and disfavored category: laws that forbid expression because it is outrageous.

This Article begins by excavating the internal tension of anti-deepfake statutes and explaining the laws’ theoretical underpinnings. It shows that the laws mean to redress highly offensive appropriations of likeness, but employ the incommensurable vocabulary of a different dignitary harm: the circulation of facts about persons. The Article then uses semiotic theory to explain how deepfakes differ from the media they mimic and why those differences matter legally. Photographs and video recordings record events. Deepfakes merely depict them. Justifications for regulating records do not necessarily justify regulating depictions. Many laws—covering everything from trademark dilution to flag burning to “morphed” child sexual abuse material (CSAM)—have banned outrageous depictions as such. Several remain in effect today. Yet when such bans are challenged, courts mischaracterize imagery to sidestep constitutional scrutiny: Courts pretend fictional depictions are factual records. Anti-deepfake laws resist this dodge. Courts considering these laws will be forced to confront head-on the extent to which a statute may ban outrageous expression as such.

Introduction

“[R]epresentation is reality . . . .”¹

Breakthrough technology has made it cheap and easy to synthesize photorealistic images and videos of recognizable individuals. People are using it to generate massive amounts of porn.² An AI user needs only a few photographs of his target to generate a pornographic “deepfake” of anyone from an ex-girlfriend to a celebrity.³ In early 2024, sexually explicit deepfakes of Taylor Swift gathered tens of millions of views on the social media site X.⁴ Recent reporting has documented the wide availability and popularity of AI models calibrated to create pornographic images of specific people.⁵ Women in politics and journalism are being threatened with deepfake pornography that uses their likenesses.⁶ Schoolchildren across the nation are using AI to synthesize naked images of their classmates; two boys in their early teens have been charged with felonies for allegedly doing so.⁷ Alarm over pornographic deepfakes has united every state attorney general,⁸ the Biden White House,⁹ and the Trump White House.¹⁰ In May 2025, President Trump signed into law the TAKE IT DOWN Act, a criminal statute that specifically targets pornographic deepfakes of adults.¹¹ Forty-one states have passed similar civil or criminal legislation.¹²

Anti-deepfake laws are sweeping the nation. This Article focuses on two glaring details that these statutes seldom, if ever, duly acknowledge: Deepfakes are not photographs or video recordings; and often, they don’t even pretend that they are. Anti-deepfake statutes differ from information-privacy and defamation laws in a crucial respect: Information-privacy and defamation law regulate facts, or assertions of fact, about persons. Anti-deepfake laws ban outrageous depictions of persons, irrespective of any factual assertions they make. This difference matters for two reasons. First, legislators who approach deepfakes as a defamation, fraud, or forgery problem or as an information-privacy problem—that is, as a problem of false representations of fact or true disclosures of private facts—end up enacting statutes that may not redress the harms they should redress.

Second, because anti-deepfake statutes ban certain outrageous imagery per se, irrespective of any factual assertions the imagery makes, the rationales that justify defamation and information-privacy regimes do not justify these laws. Courts applying the First Amendment regard bans on offensive expressions of opinion with a distinct skepticism not directed at regulations of factual statements.¹³ This isn’t to say that courts never uphold the constitutionality of per se bans on outrageous expression. They do. Along with obscenity law, the most notable example is the federal ban on morphed child sexual abuse material (CSAM), a lower-tech predecessor to deepfakes in which nonsexual images of identifiable children are edited to depict sexual conduct.¹⁴ But in upholding such bans, courts do not always admit that they forbid outrageous expression per se. Rather, courts sometimes pretend that they forbid expression because it signifies particular historical facts. In other words, when evaluating outrageous imagery, courts pretend to be regulating records of historical fact when they are in fact regulating mere depictions of fictional events. In the language of semiotics, courts pretend to be analyzing indexical images when they are in fact analyzing iconic images.¹⁵

Properly drafted and properly understood, anti-deepfake statutes are content-based restrictions on noncommercial speech that is not necessarily obscene; is not necessarily defamatory, nor fraudulent, nor even false; and discloses no private facts. They are the most recent manifestation of a longstanding impulse to ban outrageous visual representations.¹⁶ This impulse motivates not only historical regulations of flag and effigy burning, but also bans on morphed CSAM and trademark dilution by tarnishment that remain in force today. Anti-deepfake laws are also the most recent manifestation of the law’s impulse to mischaracterize per se bans on outrageous expression as something they are not. Courts relied on the conflation of records and depictions to uphold bans on morphed CSAM, and scholars and legislators are reenacting this maneuver today for anti-deepfake laws.

But anti-deepfake laws offer none of the analytical offramps that other bans on outrageous expression offer. Courts considering morphed CSAM could expediently classify it as “child pornography,” which is categorically unprotected by the First Amendment, even though the Supreme Court’s rationale for that categorical exclusion justifies regulating only records of abuse and not mere depictions of abuse.¹⁷ This approach is unlikely to work as well for deepfakes, because there is no categorical First Amendment exclusion for pornographic depictions of adults. Nor can deepfakes be forbidden on the ground that they disclose true, private facts, as revenge pornography does, or on the ground that they necessarily make false statements of fact.

Although they use the language of facts, anti-deepfake laws actually regulate fictional expression. These laws will force courts to consider the degree to which American law can ban outrageous iconography as such—something it has reliably done and continues to do today—even when jurists have to admit that this is what the law is doing. The internal tensions of anti-deepfake laws invite us to reconsider how hostile our constitutional order ought to be to the regulation of outrageous expression per se—and, indeed, how hostile it ever really has been.

Part I examines anti-deepfake laws to distill their essential characteristics. Although commentators frequently analogize anti-deepfake laws to defamation and revenge-porn bans, Part I identifies a critical distinction: Anti-deepfake laws regulate not statements of fact, but outrageous expression per se. In privacy-theory terms, the laws redress “appropriation,” a privacy harm that does not require the disclosure of true facts or the assertion of falsehoods. However, the statutes attempt to do so using infelicitous concepts of truth and falsity, which leads to unclear coverage.

Part II uses semiotic theory to explain how deepfakes differ from photographs and video recordings. Photographs are indexical: They record a visual phenomenon as it appeared through a particular lens at a particular moment in time. Deepfakes are iconic: They represent by resemblance. We interpret indexical media as assertions of fact; as a result, accurate photographs can reveal private matters and deceptive photographs can defame. But deepfakes are merely icons. They do not necessarily assert or record facts in the way that photographs do. As a result, the legal rationales historically invoked to regulate indexical imagery cannot support the full breadth of today’s anti-deepfake laws.

Part III tours trademark dilution and CSAM law, past prohibitions on flag desecration and effigy burning, and the criminalization (vel non) of sexual fantasy to show that anti-deepfake laws address a well-understood harm and have close cousins in past and present American legal doctrines. Part III also, however, shows that courts mischaracterize the semiotic status of this harm in order to sidestep First Amendment scrutiny: To uphold the regulation of icons as constitutional, courts invoke rationales that instead justify the regulation of indices.

Finally, Part IV explains that properly understanding the semiotics of deepfakes is essential to appropriate and effective regulation. Congress and the states have rushed to enact laws that address a deluge of photorealistic, AI-generated pornography. Our impulse to outlaw outrageous depictions per se will collide with our tendency to deny that we are doing so. We may try to equate deepfakes with photographs, but commandeering the law of photographs and video recordings to regulate AI-generated imagery will produce bizarre outcomes—like classifying any sexually explicit image generated by popular AI models as “child pornography” under federal law, even if the generated imagery depicts only adults.¹⁸ Properly regulating deepfakes requires acknowledging that they are icons, not indices, and employing the legal theories that regulate them as such: obscenity law and an extended version of the tort of appropriation.

I. The Internal Tension of Anti-Deepfake Laws

Legal discussion of deepfakes frequently links their harms to two familiar bodies of law. The first is the regulation of false and deceptive statements, like defamation and fraud.¹⁹ The second is the law of information privacy, particularly prohibitions on disseminating so-called “revenge porn”—nonconsensual, intimate photographs and video recordings.²⁰ But studying anti-deepfake statutes reveals that they differ essentially from these supposedly close relatives. Actionable defamation and revenge porn necessarily communicate actual or purported facts about a victim. Legal liability for deepfakes, by contrast, seldom requires that the deepfake assert any facts whatsoever about a victim.

This Part examines the civil and criminal statutes that, as of July 24, 2025, forty-one states and the federal government have enacted specifically to regulate nonconsensual, pornographic deepfakes depicting adults.²¹ It finds that, although anti-deepfake laws commonly limit their coverage to “false” media, “forger[ies],” and/or apparently “authentic” media, the laws, in practice, cover media irrespective of truth or falsity. In other words, the statutes aren’t drafted properly. Instead of conditioning liability on a statement’s truth or falsity, as their language sometimes implies, anti-deepfake laws actually target a statement’s offensiveness.²²

What makes anti-deepfake laws infelicitous is that they mean to regulate media because of how it looks: They target highly offensive aesthetics. However, instead of defining the laws’ scope expressly in terms of offensiveness, legislatures define covered subject matter in terms of the facts it appears to communicate. They seek to remedy a harm rooted in offense using the language of harms rooted in true or false assertions. This is an unbridgeable gap.

This Part begins by identifying the aspects of anti-deepfake laws that demonstrate that their focus is not factual propositions, but outrageous aesthetics. It then highlights a number of statutory-interpretation problems in enacted laws that result from legislatures using the language of factual propositions to regulate the incommensurable harm of offense. It then identifies anti-deepfake laws’ proper theoretical grounding—the privacy harm known as appropriation of likeness—and distinguishes it from the defamation and information-privacy regulations that might seem to be anti-deepfake statutes’ closest cousins.

A. Anti-Deepfake Laws Regulate Fiction Using the Vocabulary of Facts

The core conduct that anti-deepfake statutes proscribe is the dissemination²³ of a “realistic,”²⁴ sexually explicit²⁵ depiction of an “identifiable” ²⁶ person without that person’s consent.²⁷ Anti-deepfake laws come in both civil and criminal variants. Available civil remedies include disgorgement, actual damages, statutory damages of up to $150,000 per deepfake, punitive damages, and attorney’s fees.²⁸ Criminal penalties include multiyear prison terms.²⁹ Civil anti-deepfake laws may not require proof that a violator intended to harm the depicted individual; instead, they may require actual or constructive knowledge that the depicted person did not consent to the creation or disclosure of a deepfake.³⁰ Many criminal laws, meanwhile, require proof of some additional intent or knowledge. Several laws require intent to cause harm to the victim,³¹ while others impose liability when “intent to self-gratify” is present.³² Another group of criminal laws imposes lower requirements, such as proof that the offender knew or should have known that the media was a deepfake.³³

Most important for present purposes, however, are two provisions that delineate the types of communications that anti-deepfake laws regulate: First, the laws usually apply irrespective of whether a deepfake would deceive a reasonable observer into believing it to be a record of historical fact. Second, the laws often limit their coverage to depictions rendered in “realistic” styles, or depictions “indistinguishable from” “authentic” media.

These two provisions exist in some tension. The first establishes that the factual assertions in a deepfake are beside the point: The typical law regulates media irrespective of whether any reasonable observer would understand it as factual. Yet even as the laws treat deceptiveness as irrelevant, they reassert the importance of verisimilitude through provisions that limit coverage to depictions that resemble authentic photo and videographic records of historical fact. In other words, a covered deepfake must resemble an authentic record of historical fact, yet it is irrelevant whether it could actually pass for such a record.

Why would a typical anti-deepfake law simultaneously provide that (1) a deepfake’s tendency to deceive is immaterial and (2) only “realistic” deepfakes are covered? And in practical terms, what media does this language actually cover? On its own, each of these provisions makes sense. Recent outrage over deepfakes shows that certain realistic, sexualized depictions can cause especially grave harm to their subjects, and that this harm can occur whether or not the deepfakes are understood as documentary fact.³⁴ In tandem, however, the two provisions illustrate anti-deepfake laws’ equivocal conception of the harm they seek to redress: Are deepfakes harmful because they are false, or for another reason? This equivocation, in turn, illuminates a deeper fault line in United States’ regulation of privacy and dignitary harms.

1. “Falsity” Without a Deceptiveness Requirement

Some anti-deepfake laws purport to limit their coverage to “false” media.³⁵ But closer reading shows that language of falsity is generally a red herring: Hardly any anti-deepfake laws seem to require that a deepfake could instill a false belief in a reasonable observer. In fact, many laws specify that disclaimers of falsity offer no defense. Laws in California, Florida, Illinois, New York, South Carolina, Tennessee, and Washington expressly provide for liability even where the deepfake contains a disclaimer stating it is unauthorized or that it does not depict the person’s actual behavior.³⁶

Under nearly all anti-deepfake laws, then, a pornographic deepfake’s actual or perceived correspondence with historical fact is irrelevant.³⁷ A deepfake can be unlawful even if no reasonable observer would understand it as a record of something the victim actually did: For example, imagine a deepfake that depicts fantastical events and bears a conspicuous, effective, and unquestionably true disclaimer, “FICTION: NOT AN AUTHENTIC RECORDING.” A deepfake can also be unlawful even if it faithfully depicts true events: Imagine a jilted partner who, by memory, uses AI to generate painstakingly accurate reenactments of sexual encounters with his ex. Neither of these hypothetical deepfakes is “false.”³⁸ There is an argument that both are true, though it may be most accurate simply to say that they’re neither true nor false.³⁹ Yet typical anti-deepfake laws treat them no differently from deceptively false deepfakes. This refusal to differentiate seems entirely appropriate; these nonfalse deepfakes can still cause grave harm. But it belies the language of forgery and falsity that appears in these laws.

2. Subject Matter and “Realism” Requirements

At the same time as they discount whether a reasonable observer would regard a deepfake as documentary record, many anti-deepfake statutes define covered deepfakes in terms of their resemblance to documentary records. For instance, anti-deepfake statutes generally focus on visual media, and many limit their coverage to videos and still images.⁴⁰ The broadest state laws cover both pictorial and aural representations.⁴¹ No anti-deepfake law expressly covers written or spoken words, even though words alone can falsely portray an identifiable person engaging in sexual activity.⁴² The statutes’ core coverage is photorealistic images and videos—although the language they use to articulate this coverage is often clumsy and confusing.

Given that the typical statute treats truthfulness or falsity as irrelevant, the most bewildering aspects of anti-deepfake laws are their requirements concerning how covered media must look. Anti-deepfake laws often expressly limit coverage to material that is “realistic,”⁴³ but they seldom define “realism.”⁴⁴ Moreover, the scope of the typical law frustrates one obvious interpretation: It forecloses equating realism with observers’ tendency to perceive media as factual. “Realistic” must mean something different from “deceptive,” because anti-deepfake laws typically require no proof of deception and often specify that a violation can occur even when the media contains a disclaimer that it is false.⁴⁵

What anti-deepfake laws are targeting is not the assertion of particular truths or falsehoods, but the use of particular aesthetics. “Realism” is a style, and what constitutes realism varies depending on cultural and historical context.⁴⁶ Some statutes, like those in Louisiana, Massachusetts, Pennsylvania, and South Dakota, require a sort of realism that would make the media appear “authentic” to a reasonable observer.⁴⁷ Louisiana’s law refers specifically to resemblance to “authentic” media that “record . . . the actual speech or conduct of the individual” depicted.⁴⁸ Here, “authentic” denotes documentary media, like photographs and video recordings. Unlike other forms of pictorial representation, which merely depict events, documentary media actually record real-life events. ⁴⁹ As I use these words, to depict an event is to represent it pictorially, whereas to record an event is to capture contemporaneous evidence of its occurrence. ⁵⁰ A record may be, but is not necessarily, a depiction, and vice versa.

In the sense that anti-deepfake statutes use the word, an “authentic” photograph is an image that is actually a photograph.⁵¹ Statutes that use the word “authentic” almost certainly require photorealism, “the quality in art . . . of depicting or seeming to depict real people . . . with the exactness of a photograph.”⁵² A photorealistic image is one rendered in a style of realism that resembles an “authentic” photograph or video recording. Statutes that limit their coverage to “recording[s] of an individual”⁵³ or media “substantially derivative” of video recordings and photographs⁵⁴ are probably also meant to capture photorealistic media.

Other anti-deepfake laws, however, use far broader language. Florida’s law, for example, covers “any visual depiction that . . . depicts a realistic version of an identifiable person” nude or engaged in sexual conduct. ⁵⁵ Indiana’s criminal statute covers a “digital image . . . or video . . . that is of a quality, characteristic, or condition such that it appears to depict the alleged victim,” and several other states employ similar language.⁵⁶ These laws are probably intended to regulate photorealistic, AI-generated media rather than pictorial depictions in general.⁵⁷ Yet the text might encompass depictions of all sorts.⁵⁸

3. “Falsity” and “Realism” Puzzles in the TAKE IT DOWN Act

Prodding at the language and the logic of anti-deepfake statutes reveals that they have been drafted in a manner that clashes with their goals. The statutes’ language suggests that their focus is on whether a deepfake can be distinguished from authentic media. Yet their practical scope includes all deepfakes of a particular aesthetic, irrespective of whether a reasonable observer could distinguish them from authentic media. The statutes require apparent “authenticity” while simultaneously discounting whether any reasonable viewer would take a deepfake to be authentic.

As an illustration, consider the federal TAKE IT DOWN Act, introduced by Senator Ted Cruz in June 2024 and enacted in significantly modified form in May 2025.⁵⁹ The first draft’s vague language exemplifies problems that appear in enacted state legislation. And although the enacted TAKE IT DOWN Act improves upon the first draft, the new federal law still contains a crucial ambiguity that illustrates its underdeveloped conception of harm: Are deepfakes regulated because of the facts they assert, or because of the way they look?

a. The First Bill’s Illustrative Shortcomings

The first draft of the TAKE IT DOWN Act provided that to be covered, a deepfake must “falsely depict an individual’s appearance or conduct.”⁶⁰ It further specified, “an individual appears in an intimate visual depiction if . . . the individual is actually the individual identified in the intimate visual depiction; or . . . a deepfake of the individual is used to realistically depict the individual such that a reasonable person would believe the individual is actually depicted in the intimate visual depiction.”⁶¹

Inspecting these provisions reveals that they make no sense. Start with “falsely.” Is a “false[] depict[ion]” simply any ahistorical depiction? Or is it only a depiction that can reasonably be interpreted as asserting historical facts about a person? Many expressive works defy a true/false binary. Are Monet’s haystack paintings true or false? The question is nonsensical: As Rebecca Tushnet observes, “[visual] styles are neither true nor false.”⁶² Star Wars is not a documentary, but it is fiction rather than falsehood. Falsity denotes being “[c]ontrary to what is true, erroneous,” or outright “mendacious.”⁶³ If we don’t interpret media to be reporting historical facts, then it isn’t false—even if it isn’t true, either.⁶⁴ Limiting coverage to false depictions would just establish a takedown regime for certain types of defamation: It could cover images of libelous oil paintings—which are indeed “false[] depict[ions]”—but not photorealistic deepfakes whose content and/or context clearly communicate that they are fictional.

What about the proposed provision that an “individual appears in an intimate visual depiction . . . if the individual is actually the individual identified in” it?⁶⁵ Read literally, this text is almost meaningless. Being “actually the individual identified in [an] intimate visual depiction” was probably meant to cover situations like revenge porn, in which the victim “is actually the individual” recorded in the media, and which the initial bill largely equated with deepfakes. But being recorded is distinct from being identified. As a result, it’s unclear what the “actually” in “actually . . . identified” means.⁶⁶ A person identified in surveillance footage of a bank robbery and a person identified in an oil painting of a bank robbery is, in both cases, “actually” the person identified in the material in question. But only the surveillance footage directly evidences the individual’s participation in the robbery, because it is a record rather than a depiction.

Equally confusing was the bill’s provision that an individual “appears in an intimate visual depiction” if she “is . . . realistically depict[ed] . . . such that a reasonable person would believe [she] is actually depicted.”⁶⁷ On the narrowest plausible reading, the definition requires that a reasonable person actually would believe that the deepfake is an authentic photograph or video recording of the person it depicts. Reading the bill in this way makes the deepfake’s content and context especially significant: If the deepfake contains a disclaimer that it is a deepfake, or if the deepfake depicts fantastical conduct that could never take place in real life, then it may not be reasonable for an observer to believe that the deepfake depicts an individual’s speech or conduct as that speech or conduct truly occurred.

A broader reading of the first draft would be that it required a deepfake to be photorealistic but not necessarily misleading. So construed, the law would have covered even deepfakes that are so obviously fake that no reasonable observer could mistake them for authentic photographs or videos, as long as they are rendered in a photorealistic style. This is the best reading of the numerous statutes that require realism while simultaneously providing that disclaimers of falsity are no defense to liability. Unhelpfully, however, neither the first draft nor the enacted TAKE IT DOWN Act expressly addresses whether a disclaimer of falsity affects liability.

Finally, the broadest plausible reading of this language is that it required only that the depicted individual be identifiable from the deepfake, regardless of its realism. The first draft required only “that a reasonable person would believe the individual is actually depicted,” not that a reasonable observer would believe that the individual is actually recorded. Both the surveillance footage of the bank robbery and the oil painting of the bank robbery depict the robber. But only the footage records the robber.⁶⁸ This means that the broadest reading of the first draft would require only that a reasonable observer would recognize that a specific individual is depicted in the deepfake, thus covering cartoons, flipbooks, or any other nonphotorealistic pictorial medium capable of presentation in a still or video image.

The TAKE IT DOWN Act was significantly revised before its passage, but its original shortcomings remain illustrative, as similar errors appear in enacted state legislation. Numerous state statutes, for example, contain the problematic “appears to depict” language.⁶⁹ Others define covered deepfakes as “false” despite omitting any requirement that they be understandable as assertions of fact.⁷⁰ Finally, many state laws attempt to treat deepfakes and revenge porn identically, despite fundamental ontological differences.⁷¹

b. The Unresolved Problem of “Indistinguishability”

The enacted TAKE IT DOWN Act improves upon the first draft. The modified law removes the incoherent language about “actual[] depict[ion]” and all mentions of the ambiguous word “false.” Instead, the enacted statute defines a covered “digital forgery” as “any intimate visual depiction of an identifiable individual . . . that, when viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction of the individual.”⁷² The statute also addresses offenses involving “digital forgeries” in a separate section from offenses involving documentary revenge porn, while the first draft grouped them together.⁷³

However, the enacted law still contains a crucial ambiguity: Does its definition of “digital forgery” refer to a deepfake’s aesthetic appearance or its propositional content? There are two different ways that a deepfake might be “indistinguishable from an authentic visual depiction”: It might be aesthetically indistinguishable or propositionally indistinguishable. If a deepfake need only be aesthetically indistinguishable, then it need only be photorealistic, even if its content or context make it obvious that it is not authentic.

Alternatively, the statute could require a deepfake to be propositionally indistinguishable from an authentic photograph or video recording, covering only deepfakes capable of convincing a reasonable observer that they are authentic records, or that they otherwise state documentary facts.⁷⁴ The statutory text seems to point to the latter, as it specifies that a “digital forgery” is a depiction that “when viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction.”⁷⁵ When a reasonable person views a communication “as a whole,” that person presumably pays attention not only to its aesthetic appearance, but also to the content it depicts and the context in which it is presented.⁷⁶ In many instances, attention to content and context will put a reasonable person on notice that a photorealistic deepfake is an AI-generated depiction rather than an authentic documentary record.

Yet a propositional-indistinguishability requirement clashes with the TAKE IT DOWN Act’s evident purpose. In addition to its criminal prohibitions on publishing deepfakes, the law requires covered online platforms to establish a notice-and-takedown regime for intimate visual depictions.⁷⁷ The law expressly states that covered platforms include online services that regularly “publish, curate, host, or make available content of nonconsensual intimate visual depictions.”⁷⁸

It is intuitively obvious why the TAKE IT DOWN Act—a statute designed to limit the proliferation of nonconsensual deepfakes—would specifically target websites whose raison d’être is promulgating nonconsensual deepfakes. But this intuition depends to some degree on reading the law to target aesthetic indistinguishability rather than propositional indistinguishability. Of the places a deepfake might appear, a website that primarily or exclusively hosts deepfakes is among the least likely to sow confusion about factual propositions. A reasonable person viewing a deepfake “as a whole” on a site overtly dedicated to deepfakes will very probably distinguish it “from an authentic visual depiction of the individual.”⁷⁹ Thus, the law’s specific enumeration of nonconsensual-intimate-image sites suggests an intent to target aesthetics rather than factual assertions.

Other anti-deepfake laws more clearly communicate an aesthetic indistinguishability requirement.⁸⁰ Take Texas’s 2025 revisions to its criminal statute, which replace a definition of a deepfake as “a video, created with the intent to deceive, that appears to depict a real person performing an action that did not occur in reality,” with the definition, “ ‘Deep fake media’ means a visual depiction . . . that appears to a reasonable person to depict a real person, indistinguishable from an authentic visual depiction of the real person.”⁸¹ The revisions also state that it is not a defense if the deepfake is labeled or otherwise indicated to be inauthentic.⁸² Similarly, South Carolina’s law covers imagery “that appears to a reasonable person to be indistinguishable from an authentic visual depiction . . . regardless of whether the visual depiction indicates . . . that [it] is not authentic.”⁸³ The Texas and South Carolina statutes are arguably internally inconsistent—they cover depictions “indistinguishable from . . . authentic” records even when observers can easily distinguish them—and they are certainly inconsistent with a propositional-indistinguishability standard. What harmonizes their provisions is reading “indistinguishable” as an aesthetic requirement: If a deepfake looks like an authentic photograph or video recording, it can constitute a violation even if it is in practice entirely distinguishable.

Anti-deepfake laws target outrageous aesthetics, not false propositions. They remedy a harm that stems from an outrageous style of fictional depiction, whether or not a reasonable observer would take the depiction to assert historical facts about the person depicted. Yet the laws employ a vocabulary better suited to regulating the communication of facts. Understanding why the laws do so, and what language better captures their theory of harm, requires excavating the theory of privacy that justifies anti-deepfake statutes.

B. Anti-Deepfake Laws’ Theoretical Scaffolding

Anti-deepfake laws are hard to interpret because, perhaps inadvertently, their drafters legislated right on top of a legal fault line. One can divide the harms redressed by American privacy law and dignitary torts into two discrete categories: harms that derive from disclosures of fact and harms that do not. Defamation, for example, falls into the former category, as it concerns false statements of fact. Contemporary privacy-and-technology discourse, too, tends to focus on factual disclosures. Specifically, it focuses on what I’ll call “information privacy”—the collection, transmission, and use of actual or purported facts about persons.⁸⁴ Information-privacy harms result from improper disclosures of personally identifiable facts like someone’s financial information or HIV status.⁸⁵ Like defamation, information privacy regulates statements of purported facts about persons.

In parallel, however, runs a current of privacy doctrine unconcerned with factual representations. Among other things, this body of law redresses injuries caused by appropriation—the dignitary harm wrought by having one’s likeness used for the purposes of another.⁸⁶ Appropriative harm can occur even when no private facts are revealed and no falsehoods are asserted. It is appropriative harm that anti-deepfake laws address. The violation that the statutes remedy is a highly offensive⁸⁷ use of an individual’s likeness, whether or not that use asserts any falsehoods or discloses any true, private facts about the victim.

The problem is that, as Part I.A showed, legislation and scholarship on deepfakes frequently approach an appropriative harm as if it were an information-privacy harm. The mismatch produces an internal tension. In practice, anti-deepfake statutes almost always treat a deepfake’s propositional content as irrelevant. Only a small minority of statutes require a deepfake to be capable of deceiving a reasonable viewer; many provide that disclaimers of inauthenticity are irrelevant. At the same time, however, the statutes describe regulated subject matter in terms of its apparent authenticity. Legislatures, perhaps wary of explicitly regulating offensive aesthetics as such, have tried to couch an aesthetic prohibition in the seemingly safer vocabulary of information privacy. Yet the principle that best explains the statutes’ coverage is not whether the depiction is indistinguishable from an authentic record nor whether the depiction is false—indeed, actionable deepfakes may defy either criterion⁸⁸—but rather whether the depiction is “highly offensive.”

Identifying anti-deepfake laws’ theoretical pedigree is important because it informs both how these statutes should be written and how they should be read. Recognizing that harmful deepfakes are highly offensive appropriations of likeness reveals respects in which some statutes are too narrow. Laws that extinguish liability in the presence of a disclaimer misdiagnose an appropriative harm as a defamatory harm.⁸⁹ By contrast, laws that ban “depiction[s]” without limitation to highly offensive representational styles are unduly broad restrictions on fictional expression.⁹⁰

An imprecise identification of the harm to which they respond leaves some anti-deepfake statutes conceptually incoherent. The following subsections unpack the potential justifications for anti-deepfake laws. Because the harms of deepfakes are so frequently mischaracterized as injuries that stem from deceptive assertions of fact, legislators mistakenly attempt to target the problem by regulating “false” imagery or by equating them with information-privacy violations like revenge porn. But anti-deepfake laws are neither defamation laws nor information-privacy laws because they eschew any requirement that the media in question disclose facts about the person depicted. Statutes that regulate pornographic deepfakes by targeting assertions of fact will never address what’s most objectionable about them, which is neither falsity nor truth, but their highly offensive appropriation of a nonconsenting person’s likeness.

1. Anti-Deepfake Laws Are Not (Just) Defamation Laws

Some legislative history justifies anti-deepfake laws by referring to viewers’ inability to differentiate deepfakes from factual records, which suggests concerns about misleading statements of fact.⁹¹ Similarly, legislation may refer to deepfakes as “digital forger[ies]” or imply that they entail “fraud”—words that presuppose an intent to deceive viewers about a factual proposition.⁹² But a common characteristic of many anti-deepfake laws reveals that these statutes seek to remedy a wrong distinct from harmful falsehood. Several laws and federal bills explicitly state that a violator cannot avoid liability by including a disclaimer that states that a deepfake does not record factual conduct on the part of the person depicted.⁹³ At least one state that initially required a deepfake be “created with the intent to deceive”⁹⁴ later amended the law, removing the intent requirement and specifying that a disclaimer of inauthenticity could not serve as a defense.⁹⁵ Provisions like these are inconsistent with the theory that the harmfulness of deepfakes comes solely from their ability to defame, deceive, and defraud.

The Supreme Court’s defamation jurisprudence teaches that “statements that cannot ‘reasonably be interpreted as stating actual facts’ about an individual” are protected by the First Amendment, at least when they pertain to matters of public concern.⁹⁶ This requirement reflects that a “false representation of fact” is an essential element of defamation.⁹⁷ As the Court has explained, “[u]nder the First Amendment there is no such thing as a false idea.”⁹⁸ On this understanding, an expressive statement that does not assert or imply a factual proposition cannot be actionably⁹⁹ defamatory.¹⁰⁰

If anti-deepfake laws addressed only false statements of fact, it would make no sense for them to provide for liability even when the deepfake is accompanied by a disclaimer that effectively communicates that it is unauthorized and ahistorical. Of course, the presence of a disclaimer does not render a statement nondefamatory per se.¹⁰¹ But some disclaimers surely make it impossible for any reasonable viewer to interpret a deepfake “as stating actual facts about an individual.”¹⁰² To declare disclaimers legally irrelevant is to declare that legally cognizable harm occurs even when no reasonable viewer could understand a deepfake as stating actual facts about the individual depicted. In other words, it is to acknowledge that legally cognizable harm occurs even when a deepfake is non-defamatory as a matter of law.

The Senate made this precise acknowledgement in late July 2024, when it passed a version of the DEFIANCE Act that had been amended with a finding that “individuals depicted in [sexually explicit] digital forgeries are profoundly harmed when the content is produced, disclosed, or obtained without the consent of those individuals. These harms are not mitigated through labels or other information that indicates that the depiction is fake.”¹⁰³ In a decision published two days later, Meta’s Oversight Board made the same observation.¹⁰⁴ Popular attitudes, too, corroborate that the perceived harms of deepfakes are about something more than defamation. One study asked participants to evaluate a hypothetical nonconsensual, pornographic deepfake that was labeled as false and found that “[t]here was no significant effect of labeling on the perceived harmfulness or blameworthiness of the video.”¹⁰⁵ Deepfakes fuel deep outrage that is distinct from their capacity to misinform.¹⁰⁶

2. Anti-Deepfake Laws Are Not Information-Privacy Laws

Just as deepfakes’ harms are often compared to defamatory harms, they are also compared to information-privacy harms. Prohibitions on disseminating “revenge porn”—authentic photographs and video recordings of victims naked or engaged in sexual conduct—are a frequent parallel. In many respects, this comparison is an apt one: Both revenge porn and deepfakes “turn[] individuals into objects of sexual entertainment against their will, causing intense distress, humiliation, and reputational injury.”¹⁰⁷ But revenge porn authentically records private events and thus falls in the heartland of information-privacy regulation, whereas deepfakes do not authentically record private facts—and often do not purport to.

Although some definitions of “revenge porn” refer to “images” without differentiation, jurists consistently employ the term to refer to photographs and video recordings—which record true, private facts about a person’s intimate appearance and activities—rather than to refer to, say, oil paintings and charcoal sketches that depict nudity.¹⁰⁸ Revenge-porn statutes often specify that their coverage is limited to recordings rather than hypothetical depictions of what a victim might have done, or how her body might look.¹⁰⁹

Thus, revenge-porn bans fit in comfortably with information-privacy regulation because their core function is to restrict the circulation of records of private facts. The harm of revenge porn derives not just from how it looks, but from its ability to document private facts. Resemblance to private facts alone is insufficient. A dead ringer for a victim of revenge porn doesn’t gain a legal claim just by virtue of being a doppelganger; applicable statutes specify that it is “the person depicted” who possesses the cause of action.¹¹⁰ Analogously, jurists have justified revenge-porn bans in part through comparisons to criminal voyeurism.¹¹¹ Both revenge porn and voyeurism involve not merely a portrayal of a victim’s private affairs, but actual, nonconsensual access to those private affairs. The victim of a voyeur is the person whom the voyeur actually observes, just as the immediate victim of revenge porn is the person actually recorded in the images.

By contrast, anti-deepfake laws regulate resemblance rather than documentation. The statutes regulate deepfakes without regard to the facts they disclose about the victim. Anti-deepfake laws are thus not information-privacy laws—but this does not mean that anti-deepfake laws aren’t privacy laws. Legislators and scholars frequently, and justifiably, characterize deepfakes’ harms as privacy harms.¹¹² Danielle Citron describes the harm of deepfakes as a hijacking of identity: They “mak[e] [a subject] be a sexual object in ways that [she] didn’t choose. . . . [I]t takes your sexual identity and exposes it in ways you didn’t choose.”¹¹³ Having this autonomy wrenched away, Citron argues, interferes with liberty, autonomy, and self-development.¹¹⁴ Citron is justified in characterizing the harms of deepfakes as privacy harms, but she is justified by a theory of privacy that the fact-based rubric of information privacy elides and that anti-deepfake statutes conceal by using the vocabulary of facts. What makes deepfakes harmful is that they appropriate a person’s likeness in a highly offensive way.

3. Anti-Deepfake Laws Ban Highly Offensive Appropriations of Likeness

Information privacy looms large in privacy scholarship. Several prominent theories of privacy exclusively concern information privacy.¹¹⁵ Daniel Solove’s taxonomy of privacy contains sixteen subcategories of “socially recognized privacy violations,” thirteen of which concern information privacy.¹¹⁶ But information privacy is not the entirety of privacy law. Indeed, the remaining three of Solove’s privacy violations—“intrusion” upon a person’s seclusion, “decisional interference,” and “appropriation”—are not necessarily information-privacy violations. The first two do not capture the harms of deepfakes; deepfakes can be created and consumed without any intrusion upon a person’s seclusion, and if anything, a policy against decisional interference supports an unrestricted entitlement to create and consume deepfakes in private.¹¹⁷ However, appropriation—“the use of [a person’s] identity to serve the aims and interests of another”—does capture deepfakes’ harms.¹¹⁸

a. “Appropriation” Is the Harm

Appropriation is the privacy violation that explains the harms of deepfakes. Appropriation is a confusing body of law because it has bifurcated into two doctrines that redress distinct injuries.¹¹⁹ The first, the “right of publicity,” is generally understood as a property right in commercial uses of name, image, and likeness, which permits individuals to internalize the commercial value of their identity.¹²⁰ Many proposals tout the right of publicity as a tool to combat harmful deepfakes, and the right may, in many cases, be an excellent fit.¹²¹ But because the right of publicity paradigmatically requires commercial uses of likeness and emphasizes the use’s economic value rather than the dignitary harm it causes, even its proponents acknowledge that it may not address pornographic deepfakes circulated in a noncommercial context.¹²²

The second branch of appropriation jurisprudence better approximates the harm of nonconsensual pornographic deepfakes, and it is this body of law that I refer to as the appropriation tort. Like the right of publicity, the appropriation tort focuses on nonconsensual uses of likeness, but unlike the right of publicity, the appropriation tort aims to recompense plaintiffs for dignitary injuries rather than missed licensing revenue. Appropriation is a privacy violation that wreaks a dignitary harm; it “turns a man into a commodity and makes him serve the economic needs and interest of others.”¹²³

Appropriation was first recognized, both at common law and in statutes, in the early twentieth century.¹²⁴ In the 1905 case Pavesich v. New England Life Insurance Company, the Supreme Court of Georgia permitted a common-law privacy claim against an insurance company that used the plaintiff’s portrait in an advertisement without his consent.¹²⁵ Pavesich identified a harm strikingly similar to the harm scholars associate with deepfakes. The court observed that a nonconsensual use of likeness in advertising can instill in the wronged person “a realization that his liberty has been taken away from him; and, as long as the advertiser uses him for these purposes, he cannot be otherwise than conscious of the fact that he is for the time being under the control of another . . . .”¹²⁶ Nonconsensual deepfakes can interfere with liberty in a similar way. As Citron explains, “[b]eing able to reveal one’s naked body, gender identity, or sexual orientation at the pace and in the way of one’s choosing is crucial to identity formation. When the revelation of people’s sexuality or gender is out of their hands at pivotal moments, it can shatter their sense of self.”¹²⁷

Indeed, although Pavesich concerned an advertisement, its reasoning would seem to apply to commercial and noncommercial uses of likeness in equal measure. “If one’s picture may be used by another for advertising purposes,” the court wrote, “it may be reproduced and exhibited anywhere” from “private dwellings” to “the walls of a brothel. By becoming a member of society, neither man nor woman can be presumed to have consented to such uses of the impression of their faces and features . . . .”¹²⁸ Similarly, the Restatement of Torts recognizes that the appropriation tort may apply even when “the use is not a commercial one, and even though the benefit sought to be obtained is not a pecuniary one.”¹²⁹ At its most expansive, then, appropriation would seem to forbid almost any use of a plaintiff’s likeness.

Appropriation’s broad black-letter definition can’t, however, be taken at face value.¹³⁰ Proscribing all uses of likeness that redound to a defendant’s “advantage” or “benefit” would ensnare commonplace activities in the heartland of First Amendment protection, like news reporting, artistic photography and portraiture, and fiction and nonfiction writing.¹³¹ Pavesich’s scandalized discussion of portraiture clashes with present-day understandings of third parties’ rights to express themselves and to document the world around them.¹³² Contrary to Pavesich’s assertion that “[b]y becoming a member of society, neither man nor woman can be presumed to have consented to” public displays of their likenesses,¹³³ contemporary society presumes that by appearing in public, we have assented both to our likenesses being recorded and to those images being displayed publicly in a variety of contexts.¹³⁴

In other words, contemporary appropriation jurisprudence shields a vast array of legitimate interests in nonconsensually referring to, depicting, or describing a specific person. Despite defining a prima facie appropriation claim in broad terms, courts invoke the First Amendment to protect these expressive interests from the tort’s literal scope.¹³⁵ Indeed, even as they recite the Restatement’s broad definition, courts have rejected appropriation claims based on uses of identity in expressive works, including expressive works sold for profit.¹³⁶ Some jurists might go further and argue for limiting appropriation to commercial injuries,¹³⁷ but courts have also permitted appropriation claims to proceed against expressive and/or political uses of a plaintiff’s identity.¹³⁸ Of course, many deepfakes—such as simulated product endorsements—are cut-and-dry appropriation. But harmful deepfakes may lack the indicia of “advantage” that delimit the appropriation tort. Deepfakes may be disseminated without any prospect of direct or indirect pecuniary gain. While a number of cases permit appropriation or right-of-publicity claims against noncommercial speech, these cases at least tend to involve expressive media sold for profit or situations in which the plaintiff’s reputation or standing realizes publicity for a defendant.¹³⁹ Meanwhile, noncommercial deepfakes do not trade on the plaintiff’s identity in quite the manner that the appropriation doctrine contemplates. Disseminating a deepfake in an online chat between schoolmates, for example, would violate anti-deepfake statutes but probably wouldn’t support a claim of appropriation.¹⁴⁰ An advertisement would qualify as appropriation if it used a plaintiff’s name or her picture; whether the invocation is written or pictorial, the same identity is employed for the same benefit. Meanwhile, sharing a written sexual fantasy that refers to another party by name would not violate an anti-deepfake statute, but depicting that fantasy in a deepfake would. The written fantasy and the deepfake both employ the depicted person’s identity for the same end. What distinguishes the deepfake is that it employs a more outrageous mode of expression.¹⁴¹

b. “Highly Offensive” Is the Limiting Principle

Because anti-deepfake laws target outrageous expression as such, they elevate offensiveness in a way that appropriation doctrine may not. In this respect, they resemble the tort of false light invasion of privacy, which gives recourse to a plaintiff who was “place[d] . . . before the public in a false light” that “would be highly offensive to a reasonable person.”¹⁴² Paradigmatic false light claims include a newspaper’s false insinuation that a family was living in “dirty and dilapidated conditions” and a tabloid’s use of the plaintiff’s photograph to illustrate a fictitious story of a centenarian who became pregnant after an extramarital affair.¹⁴³ Unlike appropriation, false light incorporates the same falsity requirement as defamation.¹⁴⁴ Expression that “cannot ‘reasonably [be] interpreted as stating actual facts’ about an individual” cannot support a false light claim.¹⁴⁵

A recent paper by John Goldberg and Benjamin Zipursky argues for extending false light to address deepfakes that disclaim their inauthenticity. Although they do not contest the authority requiring false light claims to rest on a specific false statement, Goldberg and Zipursky argue that “[f]or a whole range of non-newsworthy statements that are publicly disseminated and would be found highly offensive by a reasonable person, there should be no requirement to sort the true from the false because they should be actionable either way.”¹⁴⁶ They specifically observe that pornographic deepfakes “should not become nonactionable just by virtue of a visible disclaimer (of nonauthenticity) on the image itself.”¹⁴⁷ False light, they argue, protects a person’s interest in controlling the presentation of “ordinarily private aspects of their lives” to the public—an interest presumably implicated whether or not an offensive depiction is understood as factual.¹⁴⁸ Goldberg and Zipursky correctly apprehend that the harm of pornographic deepfakes—unlike defamation or information-privacy harm—is independent of factual truth or falsity, because deepfakes are “highly offensive” either way.¹⁴⁹ Whether understood as factual or not, pornographic deepfakes interfere with self-determination, as Citron, Franks and Waldman, and others argue.

The theory underlying anti-deepfake laws, then, is a hybrid of false light and appropriation. Today’s anti-deepfake statutes redress the injury that appropriation redresses, but subject to the offensiveness limitation that appears in the false light tort. By focusing on the most offensive uses of identity—those that are (1) pornographic¹⁵⁰ and (2) involve the manipulation of persons’ realistic visual likenesses rather than merely the invocation of their names—anti-deepfake laws incorporate something akin to false light’s “highly offensive to a reasonable person” requirement, which is a limitation the appropriation tort lacks.¹⁵¹ In turn, anti-deepfake statutes eschew false light’s requirement of a false statement and appropriation’s focus on uses that advantage a defendant.

The “highly offensive” nature of deepfakes relates to a specific victim, not the general public. This is an important distinction; although it is unconstitutional to ban “express[ing] ideas that offend” in general,¹⁵² offense inflicted upon a specific person is an element of numerous legal claims.¹⁵³ Nonconsensual deepfakes are highly offensive in the relevant sense because of (a) what they depict and (b) the circumstances of their production. Both ingredients matter. A depiction of a nude body is not highly offensive in itself.¹⁵⁴ Neither is a nonconsensual use of an identifiable person’s likeness as such. What makes nonconsensual deepfakes offensive is that they are sexual depictions, rendered in a particular representational style, without the consent of the person depicted. The conjunction of these properties distinguishes deepfakes from sexual depictions generally and nonconsensual depictions generally. Unlike the harm to the general public that obscenity law addresses, the offensiveness of deepfakes is specific and relational.¹⁵⁵

Thus, Citron, Goldberg, and Zipursky are all correct, because they say essentially the same thing.¹⁵⁶ Goldberg and Zipursky propose that “false light” drop the requirement of a false statement. Meanwhile, Citron proposes extending appropriation to cover outrageous, noncommercial speech.¹⁵⁷ Their arguments share a premise: Certain offensive uses of likeness interfere with one’s interest in controlling how intimate aspects of one’s identity are presented to the public—even if those uses of likeness realize no tangible benefit for the defendant and assert no facts about the person depicted.

4. Why Getting the Theory Right Matters

There is a more fundamental reason for the confusion that surrounds anti-deepfake laws. Anti-deepfake laws do not just regulate a different harm from defamation or information privacy; they also regulate an entirely different subject matter. Defamation and information-privacy laws regulate materials that assert facts about persons. In other words, they regulate materials that purport to be records about persons. But anti-deepfake laws regulate outrageous depictions of persons, pure and simple. Regulating images because of how they depict someone is dramatically different from regulating images because of what facts they assert. Anti-deepfake laws do the former, while defamation and revenge-porn laws do the latter. This difference places anti-deepfake laws in a distinct category of regulation from fact-based regimes like defamation and information-privacy law, with a distinct constitutional jurisprudence. The discipline of semiotics explains this difference with a precision that has eluded scholars and legislators to date.

II. Semiotics Helps Us Understand Anti-Deepfake Laws

Semiotics is the study of “signs.”¹⁵⁸ A sign, in turn, “is an object which stands for another to some mind”; it is something that communicates meaning.¹⁵⁹ The words in this Article are signs; an air raid siren is a sign; a photograph is a sign; a deepfake is a sign. These examples, like all signs, are representations that communicate some meaning to a beholder. The semiotic theory of the nineteenth-century scholar C.S. Peirce provides an analytical framework for probing the differences between deepfakes and other media, and this framework illuminates the subject matter and the harm that the typical anti-deepfake law regulates.

A. Peircian Icons, Indices, and Symbols

For Peirce, each sign involves a signifying element (e.g., the written word “book”); an object (e.g., the book that the signifying element represents); and an interpretant (“the understanding that we have of the sign/object relation”).¹⁶⁰ Most relevant for present purposes are the trichotomous categories that Peirce propounded to taxonomize signs in terms of their relationship to their objects: icons, indices, and symbols.

An icon is a sign that relates to its object through resemblance.¹⁶¹ This thumbs-up wingding, 👍, is an iconic representation of a fist with a thumb raised.

An index is a sign that relates to its object through physical or temporal contiguity.¹⁶² A footprint in sand is an indexical sign.¹⁶³ Some force—very probably a foot—made contact with the sand and left the foot-shaped depression. We interpret the footprint as a sign that someone walked on the sand.

A symbol is a sign that relates to its object by convention.¹⁶⁴ Both the phrase “thumbs-up!” and the image 👍 are symbols that signify approval. This meaning is arbitrary. In a different linguistic or cultural context, the written words “thumbs-up!”, or the sounds of those words spoken, or the thumbs-up gesture, may not be meaningful. Or their arbitrarily assigned meaning may differ; in some cultures, for example, the thumbs-up gesture is obscene.¹⁶⁵

A sign can function in multiple ways at once. Photographs, for example, signify both iconically and indexically. Photographs mechanically record how their subject “really appeared” at a particular moment (and thus are indexical); they also generally “look like” their subjects (and thus are iconic).¹⁶⁶

Although Peirce contributed much more to semiotics than just his icon-index-symbol trichotomy, the trichotomy is all we need to clarify sufficiently our understanding of deepfakes and the laws that regulate them. Up until this point, my Article has used words like “documentary photograph” or “video recording” in an effort to differentiate media that record perceptual information from media that merely depict things pictorially. But I used these words as approximations for concepts that Peircian semiotics allows us to discuss precisely. When I differentiated between “documentary” “records” like photographs and “non-documentary” “depictions” like drawings and paintings, what I was really doing was differentiating between indices and icons.

Peirce’s theory lets us describe exactly how deepfakes differ from the photographs and videos they resemble, and why these differences may be legally significant. The next two Sections, respectively, explain the semiotic relationship between a photograph or video recording and what it represents, and the distinct semiotic relationship between a deepfake and what it represents.

B. The Semiotics of Photographs and Video Recordings

Photographs bear an indexical relation to their objects. When film is exposed to light, the light’s interaction with the film determines the developed image.¹⁶⁷ A direct, physical relationship exists between what the camera lens “saw” and what viewers of the photograph “see.” A similar relationship holds for digital photographs and videos.¹⁶⁸

Our understanding that photographs are indexical helps explain why we often ascribe “truth claims” to photographs.¹⁶⁹ We understand photographs to depict reality mechanically, and thus to fulfill a documentary function that drawings and paintings do not.¹⁷⁰ We refer to video evidence as a “smoking gun.”¹⁷¹ A smoking gun is an indexical, and thus incriminating, sign that a gun was fired recently.¹⁷² Like a smoking gun, we understand video evidence to be an indexical—indeed, essentially irrefutable—showing that something happened.

However, photographs don’t just signify indexically. What makes photographs especially powerful is that they also signify iconically. Photographs don’t merely record a phenomenon; they also resemble a contemporaneous visual experience of that phenomenon. In contrast to, say, a seismograph—which is an indexical record of an earthquake, but which doesn’t “look” or “feel” like an earthquake in any phenomenologically relevant sense—a photograph actually looks like the pattern of light that it records indexically.

Photographs’ indexical properties don’t make them immutably truthful. Photographs can be doctored or deceptively composed to misrepresent reality.¹⁷³ Mischief results when photographs invite us to misinterpret them (or, in Peircian terms, when photographs produce interpretants that diverge from the photographs’ true relationships with their objects). That a photograph communicates a misrepresentation does not mean that the photograph is not an index. Rather, it means that people are misinterpreting the photograph. For example, Civil War photographers would move corpses from the locations in which they had fallen and pose them for photographs. The resulting photographs are still indexical signs. They just don’t indexically signify the visual appearance of the circumstances of a soldier’s death, which is what naïve viewers might expect. Rather, these photographs indexically signify the visual appearance of a scene that reflects the photographer’s compositional alterations.

Historical methods can help us assign the correct interpretant to a photograph that might otherwise mislead us. A historian studying a series of posed Civil War photographs that purported to depict a dead “sharpshooter” concluded, “[t]he type of weapon seen in these photographs was not used by sharpshooters. This particular firearm is seen in a number of [the photographer’s] scenes at Gettysburg and probably was the photographer’s prop.”¹⁷⁴ The takeaway is that we interpret photographs in light of our knowledge and assumptions about what photographs communicate. Photographs, though indexical, can mislead; the veracity of our interpretations depends on the information we have available to assist us.

What makes photographs special, then, is not so much that they are indices, but that they are indexical icons. After all, every sign is an index of whatever caused it—we just may not find much of interest in what the sign signifies indexically. A hardcover book indexically signifies that paper underwent the bookbinding process, but readers are generally much more interested in the symbolic signification of the book’s text. A doctored photograph isn’t an indexical sign of how photons passed through a lens, but it is an indexical sign of post-hoc manipulation.¹⁷⁵ This tees up a crucial insight: as important as a sign’s actual relationship with its object is the relationship we think it has.

Photographs’ and video recordings’ status as indexical icons—and our corresponding convention of interpreting them as such—explains why the law often affords them singular treatment. Sometimes, indexical status alone makes media special. While police sketches are inadmissible hearsay, authenticated surveillance video is admissible evidence.¹⁷⁶ Indexical evidence of some event, like surveillance footage or a murder weapon, can be admitted in court as substantive “real” evidence, while merely iconic evidence, like a wholly computer-generated recreation of an event, is “demonstrative” evidence.¹⁷⁷ In other contexts, what gives photographs a special legal position is that they are both indexical and iconic. Consider child pornography laws. There are many indexical signs of the sexual abuse of minors that these laws do not encompass, such as the results of a pregnancy test. Instead, child pornography laws focus on audiovisual child sexual abuse material because it both records real-life abuse and resembles that activity in the way we deem most morally salient.¹⁷⁸

C. The Semiotics of Deepfakes

Deepfakes do not indexically record visual phenomena as photographs do.¹⁷⁹ Sure, deepfakes indexically signify something, just like a painting indexically signifies that paint made contact with canvas. What distinguishes deepfakes from photographs is not that deepfakes “aren’t indexical”; it’s that deepfakes don’t indexically signify visual phenomena in the way photographs do. Instead, what deepfakes signify indexically is the outcome of complicated statistical analyses in an AI model.¹⁸⁰ If image-generating AI produces a photorealistic picture of a White man in a lab coat when prompted to depict a “doctor,” that generated image may indexically signify certain patterns in the data that trained the AI. What that image doesn’t signify indexically, however, is that particular photons passed through a particular lens at a particular moment in time to create that particular image. Unlike photographs, which are indexical icons, deepfakes are icons of indexical icons.¹⁸¹ Anti-deepfake laws’ photorealism requirement is simply a requirement that a covered deepfake must be a convincing icon of a photograph.¹⁸²

Because deepfakes are icons, not indexical records of a discrete, observable event—which is what we interpret photographs and video recordings to be—many of the rationales that justify regulating sexually explicit photographs do not apply to deepfakes. Photo- or videographic revenge porn presents a conventional information-privacy issue because it indexically documents a victim’s private actions and the actual appearance of private body parts. Similarly, photo- or videographic CSAM can be regulated on the ground that its creation is “intrinsically related to the sexual abuse of children”: indexical records of abuse require that abuse take place.¹⁸³ Correspondingly, deceptive deepfakes present a conventional defamation issue because we interpret them to be indexical records of perceptual facts, even though they are merely icons.¹⁸⁴ Both revenge porn and deceptive deepfakes assert factual propositions, because we understand both to be indices and we understand photographic indices to make truth claims.

By contrast, many deepfakes are, in context, obviously fake. They can’t reasonably be understood to make a truth claim about how photons struck a lens at a particular moment in time and space. The many grounds that justify regulating indexical images, or deceptive simulacra, are unavailable to regulate obvious deepfakes, which are mere icons. To regulate non-deceptive deepfakes, we must acknowledge that we are not regulating the dissemination of true or false factual propositions, as information-privacy and defamation law respectively do. Nor are we regulating the real-life conduct that the imagery appears to depict, as we are when we regulate indexical CSAM. Instead, we are regulating something closer to flag burning or blasphemous drawings: We are regulating outrageous uses of icons per se.

One counterargument might be that no matter how conspicuously disclaimed, viewers simply cannot regard deepfakes as anything other than assertions of fact.¹⁸⁵ This argument treats deepfake viewers like the apocryphal silent-film audience that fled the theater in fear, believing a train on screen was actually barreling into their seats.¹⁸⁶ Instead of positing that we believe anything that looks like a train barreling at us to be a train barreling at us, this argument posits that we reflexively assume that anything that looks like a photograph is a photograph.

Yet the differing regulation of disclaimers in pornographic deepfakes and electioneering deepfakes shows that even the legislatures that enacted these anti-deepfake statutes do not accept this counterargument. States that treat disclaimers as irrelevant in pornographic deepfakes have also passed laws regulating election-related deepfakes, and these laws expressly exempt electioneering deepfakes that contain disclaimers.¹⁸⁷ That state laws treat disclaimers as effective in electioneering media but ignore them in sexual media is strong evidence that laws prohibiting pornographic deepfakes are regulating something beyond deception.

Moreover, a reasonable observer in 2024 doesn’t interpret all photorealistic media as photographic. Critics of deepfakes acknowledge that “as the public becomes more educated about the threats posed by deep fakes,” the public will quite sensibly doubt that photorealistic media is authentically photographic.¹⁸⁸ If we read anti-deepfake laws as establishing an irrebuttable presumption that it is always reasonable to interpret a photorealistic image as a photograph, then we are reading these laws to codify media illiteracy unmoored from present-day interpretive practice.¹⁸⁹

What the foregoing shows is that the premise of anti-deepfake laws isn’t, and shouldn’t be, that deepfakes inevitably assert facts in the same manner that indexical images do. Rather, the premise is that deepfakes are harmful even when they cannot reasonably be understood as documentary fact. Anti-deepfake laws self-consciously regulate icons qua icons, and they target pornographic uses precisely because of what those uses communicate. This means that anti-deepfake laws are in the business of regulating outrageous expressions of opinion, rather than true or false assertions of fact. This, in turn, might suggest that these laws are unconstitutional. American law, however, has a long and diverse history of content-based regulation of outrageous iconography, which Part III recounts.

III. Iconic Signs in American Law

This Part examines disparate American legal doctrines, each of which illuminates a distinct aspect of the typical anti-deepfake law. Trademark dilution law tells us that it has not been held unconstitutional to regulate nondeceptive uses of images simply because of their putative tendency to distort emotional attitudes towards the referents of those images.¹⁹⁰ CSAM case law tells us both that courts often conflate indices and icons,¹⁹¹ and that, at least for morphed images, criminal prohibitions on nondeceptive icons have been upheld as constitutional.¹⁹² Attitudes towards flag and effigy burning confirm both that desecrating a symbol is a distinct, and possibly more outrageous, act than merely disparaging its object in words, and that this distinction has been legally dispositive.¹⁹³ The legal status of written sexual fantasies shows us that fantastical images can sometimes be treated as more “real” than fantastical words and thus illuminates anti-deepfake laws’ realism requirements.¹⁹⁴

These doctrines demonstrate both that anti-deepfake laws address time-honored concerns, and that bans on nondeceptive, disparaging uses of icons are precedented. But they also reveal the constitutional challenges that anti-deepfake laws present. Courts will have to consider head-on whether certain uses of icons can be proscribed simply because they are outrageous, without being able to deflect by mischaracterizing icons as indices or by relying on categorical First Amendment exclusions. In other words, courts will have to choose between our longstanding and legally enshrined impulses to regulate outrageous iconography, and a line of First Amendment case law that would seem to disfavor precisely such regulation.

A. Contemporary Bans on Outrageous Iconography

1. Trademark Dilution

The doctrine of trademark dilution by “tarnishment” illuminates why anti-deepfake laws single out pornographic media. Semiotically speaking, trademarks function as symbols rather than icons: They are arbitrary signs that designate a provider of goods or services.¹⁹⁵ But just as an iconic depiction of a person represents that person, a trademark symbol represents the brand to which it corresponds. Just as anti-deepfake laws prohibit degrading uses of images irrespective of their deceptiveness, dilution law allows brands to prevent uses of their marks that associate the marks with negative connotations—even if those uses do not convey false information or confuse consumers.¹⁹⁶

Trademark tarnishment occurs when a mark is used in an unsavory context, especially a sexual one.¹⁹⁷ Although run-of-the-mill trademark infringement requires a plaintiff to show a likelihood that consumers will be confused as to the source or origin of goods,¹⁹⁸ dilution is actionable even with no likelihood of confusion.¹⁹⁹ Dilution law lets brands prohibit uses of symbols that ostensibly might imbue those symbols with undesirable emotional connotations.

As Tushnet notes, dilution law goes beyond defamation because it gives brands control over the social and emotional atmospherics of their marks, not just assertions of fact.²⁰⁰ Similarly, anti-deepfake laws may find cognizable harm even when the person who altered the images is the only person who has seen them, or when the imagery is so obviously fake that no reasonable observer could regard it as documenting fact.²⁰¹ However, while federal dilution law covers only commercial uses, anti-deepfake laws cover noncommercial uses, too.²⁰² Scholars question trademark dilution’s constitutionality, and although dilution law has not yet been struck down as unconstitutional, the Supreme Court has in recent years invalidated bans on registering “disparag[ing]” and “immoral[] or scandalous” trademarks as impermissible viewpoint-based discrimination. ²⁰³

2. Child Sexual Abuse Material (CSAM)

The law of CSAM is a tour of all the same semiotic issues and imprecise reasoning that deepfakes have elicited. CSAM jurisprudence reveals that courts have upheld the constitutionality of regimes that regulate nondeceptive icons qua icons. Peirce’s semiotics maps seamlessly onto the law of CSAM. The federal definition of “child pornography” encompasses (1) images whose production “involve[d] the use of a minor engaging in sexually explicit conduct,” (2) “digital . . . or computer-generated image[s] that . . . [are] indistinguishable from[] that of a minor engaging in sexually explicit conduct,” and (3) images that were “created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct.”²⁰⁴ The corresponding case law identifies three distinct categories of CSAM. The first is indexical imagery whose manufacture necessitates abusing children or photographing intimate parts of their bodies. The second is purely iconic “virtual” CSAM, which is constitutionally protected speech precisely because it is not indexical.²⁰⁵ The third category comprises nonsexual photographs of children that have been morphed to depict sexual conduct.

a. Indexical Images of Child Sexual Abuse

The rationale for restricting the first category of images—those whose production necessarily involves children’s participation—is for obvious reasons the least controversial. In New York v. Ferber, the Supreme Court held that the First Amendment did not bar a bookstore owner’s conviction under a New York statute that prohibited “promoting a sexual performance by a child.”²⁰⁶ The defendant, Ferber, sold films “depicting young boys masturbating” to an undercover police officer, and the jury had found that the images in question were not obscene.²⁰⁷ There was apparently no dispute that the materials Ferber sold were indexical, videographic depictions.²⁰⁸ The Court held that material of this sort is unprotected by the First Amendment, even if not obscene.²⁰⁹ It noted the “surpassing importance” of protecting children from sexual abuse, and it reasoned that the distribution of media recording minors engaged in sexual activity “is intrinsically related to the sexual abuse of children in at least two ways”: First, the images “are a permanent record of the children’s participation and the harm to the child is exacerbated by their circulation”; and second, controlling the production of child pornography requires controlling its distribution network.²¹⁰

The harms that Ferber identified depend on CSAM being an indexical sign. Most importantly, Ferber identified a harm “intrinsic[]” to the creation of child pornography—it requires that children engage in real-life sexual conduct.²¹¹ Additionally, because the images record abuse that children suffered before the camera, their circulation “violates ‘the individual interest in avoiding disclosure of personal matters.’ ”²¹² This framing depends on the images’ status as indexical records of real-life events. In a subsequent case, Osborne v. Ohio, the Court relied on these rationales to uphold bans on private possession of child pornography.²¹³ Ferber and Osborne both teach that indexical CSAM’s documentary properties warrant treatment as a distinct category of unprotected speech under the First Amendment.

b. Iconic Images of Child Sexual Abuse

Just as Ferber establishes that indexical images of child abuse fall outside the First Amendment, it is equally clear that images with no indexical relationship to an actual child cannot be criminalized categorically as child pornography. In 1996, Congress expanded the definition of child pornography to include “any visual depiction . . . [that] appears to be[] of a minor engaging in sexually explicit conduct.”²¹⁴ In Ashcroft v. Free Speech Coalition, however, the Supreme Court held that this prohibition of so-called “virtual” child pornography was unconstitutionally overbroad because it covered expression protected by the First Amendment.²¹⁵ The lack of an indexical relationship between virtual child pornography and the content it depicts was central to the Court’s reasoning: Such images “create[] no victims by [their] production.”²¹⁶

Another way of expressing the Court’s conclusion is to say that virtual child pornography is merely an iconic depiction of child abuse, and not an indexical record. It is for this reason that the Court could state that virtual child pornography “creates no victims by its production.”²¹⁷ After Free Speech Coalition, Congress amended the “appears to be” language to instead ban visual depictions “indistinguishable from[] that of a minor engaging in sexually explicit conduct,”²¹⁸ though commentators believe that this language is unconstitutional for the same reasons.²¹⁹

c. Manipulated Indices: Morphed Images

Free Speech Coalition left an important lacuna. The lawsuit did not challenge § 2256(8)(C) of the federal statute, which defined child pornography to include “visual depiction[s] . . . created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct.”²²⁰ About these so-called “morphed” images, the Court noted only that “they implicate the interests of real children and are in that sense closer [than virtual child pornography is] to the images in Ferber. Respondents do not challenge this provision, and we do not consider it.”²²¹ The Court’s brief discussion of § 2256(8)(C) seemed to acknowledge that the ontology of morphed images is more complicated than that of indexical records of abuse or strictly virtual icons. On one hand, unlike the videos in Ferber, morphed images are not records of physical abuse. On the other hand, they are images “of” “real children” in a sense that purely virtual images are not, because the starting point for a morphed image is an indexical image of a real-life child—albeit typically a nonsexual one.²²²

Morphed images are criminalized in a way that reflects this ambivalent status. Even the Department of Justice has stated that “the production of a morphed image of child pornography is not as serious a crime as the production of genuine child pornography.” ²²³ Unlike indexical CSAM, federal law does not prohibit simple possession of morphed images or creation without intent to distribute.²²⁴ Rather, the statute prohibits receipt, distribution, and production with intent to distribute.²²⁵ However, several state anti-deepfake laws prohibit simple possession of pornographic deepfakes depicting a minor.²²⁶

Although the Supreme Court has not considered the constitutionality of the federal criminalization of morphed images, the federal courts of appeals to consider the issue have universally upheld the statute, though they have split as to their rationale.²²⁷ Three courts of appeals have held morphed images to be categorically unprotected speech, but the Eighth Circuit has assumed that morphed images, unlike indexical CSAM, are protected speech.²²⁸ The earliest and narrowest decision came from the Eighth Circuit in 2005 in United States v. Bach. Bach affirmed a conviction based on § 2256(8)(C) where the defendant had received an image of a minor exhibiting his genitals, onto which the face of a different minor had been superimposed.²²⁹ The Eighth Circuit reasoned that, because the nude figure in the photo was a minor, “[u]nlike the virtual pornography protected by the Supreme Court in Free Speech Coalition, the picture . . . implicates the interests of a real child and does record a crime.”²³⁰ The court was careful to note, however, that “[t]his is not the typical morphing case,” because the photo Bach received did not involve merely an “innocent picture of a child” but instead incorporated a photograph of the “lasciviously posed body . . . of” a second child.²³¹ For this reason, Bach held that “[a]lthough there may well be instances in which the application of § 2256(8)(C) violates the First Amendment, this is not such a case.”²³² The court stated that the image “involves the type of harm which can constitutionally be prosecuted under Free Speech Coalition and Ferber,” thereby suggesting that it was holding it categorically excluded from First Amendment protection.²³³

The Eighth Circuit revisited Bach nine years later in United States v. Anderson, in which a defendant had been convicted for superimposing a minor’s face onto a photograph of adults engaged in sexual conduct.²³⁴ Distinguishing Bach, the court in Anderson observed, “[n]o minor was sexually abused in the production of Anderson’s image. . . . [T]his difference is significant enough to distinguish Anderson’s image from the unprotected speech in Bach.”²³⁵ Instead of holding the morphed image to be categorically unprotected by the First Amendment, Anderson treated the image as protected speech and held instead that the prohibition on morphed images satisfied strict scrutiny.

For all the care Anderson took in distinguishing Bach—and all the care Bach took in distinguishing Free Speech Coalition—Anderson’s strict scrutiny analysis was slapdash. The court described the government’s compelling interest as follows: “[M]orphed images are like traditional child pornography in that they are records of the harmful sexual exploitation of children. The children, who are identifiable in the images, are violated by being falsely portrayed as engaging in sexual activity.”²³⁶ As for narrow tailoring, the court wrote, “the harm a child suffers from appearing as the purported subject of pornography in a digital image that is distributed via the Internet can implicate a compelling government interest regardless of the image’s verisimilitude or the initial size of its audience.”²³⁷

Anderson’s compelling-interest analysis is incoherent. In stating that “morphed images are like traditional child pornography in that they are records of the harmful sexual exploitation of children,” Anderson got the ontology of morphed images exactly wrong—morphed images are unlike traditional child pornography precisely because they are not records of the harmful sexual exploitation of children.²³⁸ To call an image a “record” is to suggest that it indexically documents an event. This is how Bach used the term when it observed that the picture at issue in that case, an indexical image of a child’s genitalia, “record[s] a crime.”²³⁹ Moreover, in the next sentence, Anderson acknowledges that morphed images are not records at all; rather than document an event that occurred, they “falsely portray[]” identifiable minors “as engaging in sexual activity.”²⁴⁰ The harm that Anderson is describing is essentially a grievous form of libel.²⁴¹ If spreading such libel about a child is “sexual exploitation,” then morphed images perhaps constitute the “sexual exploitation of children,” but in no event do they record the sexual exploitation of children.

Even if Anderson’s compelling-interest analysis were coherent, it would still be irreconcilable with the narrow-tailoring analysis that follows it. The harm that the court identified to support the government’s compelling interest is the “false[] portray[al] [of victims] as engaging in sexual activity.”²⁴² But just sentences later, in its narrow-tailoring analysis, the court stated that “the harm a child suffers from appearing as the purported subject of pornography in a digital image . . . can implicate a compelling government interest regardless of the image’s verisimilitude.”²⁴³ This assertion belies the court’s earlier characterization of the harm of morphed images. If the harm is truly that the images “falsely portray” minors as having engaged in sexual activity, then verisimilitude matters. If expression doesn’t purport to assert facts, then it might be fictional, but it isn’t false.²⁴⁴ In the defamation context, if speech cannot “reasonably be understood as describing actual facts,” then it cannot be actionably “false.”²⁴⁵ But the charge on which Anderson was convicted did not require a finding that a reasonable person would have perceived the morphed images as documentations of fact, and the statute does not allow a defendant to avoid liability by simply adding a disclaimer stating that an image has been morphed. The harm Anderson identifies is not a false portrayal of an identifiable child engaged in sexual activity, but a portrayal of any sort. The problem is not indices, or even icons that deceptively resemble indices, but icons pure and simple.

Courts hold morphed images categorically unprotected by ignoring the differences between indices and icons. In United States v. Hotaling, the Second Circuit affirmed a defendant’s conviction under §§ 2252A(a)(5)(B) and 2256(8)(C) for superimposing nonpornographic photographs of minors over the heads of adults photographed in sexually explicit circumstances. Citing Ferber and quoting Osborne—cases that both involved indexical records of minors in sexually explicit positions²⁴⁶—the Second Circuit asserted that “emotional and reputational harms” sufficed to justify criminalizing possession of morphed images of a child’s likeness.²⁴⁷ Then, citing Free Speech Coalition’s discussion of indexical child pornography, Hotaling stated that “the Supreme Court has made it clear that the harm begins when the images are created.”²⁴⁸ Hotaling thus held that morphed images “[are] not protected expressive speech under the First Amendment.”²⁴⁹

Hotaling made three significant analytical moves. First, it extended Ferber and Osborne by reasoning that the “emotional and reputational harms” of the circulation of child pornography justify criminal prohibitions, even when the media are not indexical depictions of the real-life sexual abuse of children or of children’s actual bodies. Neither Ferber nor Osborne suggested that the “haunting” rationale applied to media that did not indexically record minors nude or engaged in sexual conduct. Even if the “haunting” rationale does apply to iconic media, neither Ferber nor Osborne held that “haunting” alone was a sufficient basis for holding child pornography laws constitutional.²⁵⁰

Second, Hotaling formulated the constitutional test to match Free Speech Coalition’s dicta about morphed images. Hotaling cited Free Speech Coalition’s holding that the virtual child pornography ban was unconstitutional because “the child-protection rationale for speech restriction does not apply to materials produced without children.”²⁵¹ With this citation as support, Hotaling stated that to evaluate whether imagery is protected speech, “[t]he underlying inquiry is whether an image of child pornography implicates the interests of an actual minor.”²⁵² It then quoted Free Speech Coalition’s dictum that “morphed images . . . implicate the interests of real children and are in that sense closer to the images in Ferber” than purely virtual images are.²⁵³ Hotaling concluded that “the interests of actual minors are implicated when their faces are used in creating morphed images that make it appear that they are performing sexually explicit acts” and thus that such images “are not protected expressive speech under the First Amendment.”²⁵⁴

Hotaling reframed the constitutional inquiry to fit its purposes. In stating that the constitutional test is “whether an image . . . implicates the interests of an actual minor,” Hotaling did not rely on a Supreme Court case that actually so held. Rather, it relied on Free Speech Coalition’s holding that material that did not implicate the interests of an actual child was protected speech.²⁵⁵ Hotaling’s formulation of the test is the inverse of Free Speech Coalition’s: If material does implicate the interests of a child, the First Amendment doesn’t protect it. This holding extends Free Speech Coalition because, as a matter of logic, a proposition does not entail its inverse.

More importantly, Hotaling exploited the ambiguity that it had baked into its own formulation of the First Amendment test. Free Speech Coalition did not hold that “implicating” any interest of a minor necessarily relegates an image to the constitutionally unprotected category of child pornography. Rather, its focus was on distinguishing iconic imagery from indexical imagery—or, in its words, distinguishing virtual pornography from material that “caused [harm] to its child participants.”²⁵⁶ The images in Ferber implicated the interests of actual minor “participants”: They were documentary records of sexual conduct by minors, and their circulation would republish private matters and trigger haunting memories. The images in Hotaling, on the other hand, were simulacra of abuse; their production did not involve minor “participants” in the sense that Ferber used the word. The circulation of the images in Hotaling would expose children to the “risk of reputational harm and . . . the psychological harm of knowing that their images were exploited,” but their creation did not necessitate the abuse of a minor “participant.”²⁵⁷

Hotaling’s third move was to equate the harms of morphed images with the harms of indexical records of child abuse. Recall that Hotaling relied on “haunting,” which is premised upon the harms of images’ circulation, rather than of their creation.²⁵⁸ Hotaling also asserted, “[T]he Supreme Court has made it clear that the harm begins when the images are created,” but it cited a page of Free Speech Coalition that discussed indexical records of child abuse, not morphed images. ²⁵⁹ Free Speech Coalition expressly “d[id] not consider” the ban on morphed images.²⁶⁰ Even federal law does not outlaw morphed images from the moment of creation.²⁶¹ The “haunting” rationale “implies a return of a previous experience” and thus, while it may be grounds to regulate indices of child abuse, it is a flimsy basis for regulating icons.²⁶² Nonetheless, morphed-image case law shows that it has been held constitutional to prohibit some nondeceptive, noncommercial, outrageous uses of icons per se.

3. Morphed CSAM, Deepfakes, and the First Amendment

Judicial reasoning about morphed images is so tortured because Supreme Court precedents put appellate courts in an awkward position. Free Speech Coalition avoided adjudicating whether morphed images were protected speech. Eight years later, in United States v. Stevens, the Court held that depictions of animal cruelty were not categorically unprotected speech. Stevens acknowledged that “the First Amendment has permitted restrictions upon the content of speech in a few limited areas . . . . including obscenity, defamation, fraud, incitement, and speech integral to criminal conduct,” but rejected “a freewheeling authority to declare new categories of speech outside the scope of the First Amendment.”²⁶³ Soon after, the Court relied on Stevens to refuse categorical First Amendment exemptions for violent video games and false statements.²⁶⁴ Although Stevens hedged that there may remain “some categories of speech that have been historically unprotected, but have not yet been specifically identified or discussed as such in our case law,” lower courts read it to suggest an end to novel categorical exclusions from the First Amendment.²⁶⁵ For example, every state supreme court to consider the constitutionality of a revenge-porn statute has, citing Stevens, declined to hold revenge porn categorically unprotected speech.²⁶⁶

Free Speech Coalition and Stevens presented a dilemma for lower courts adjudicating constitutional challenges to morphed-image laws. The expedient option was to classify morphed images as unprotected “child pornography,” ignoring that they lack the indexical link to real-life sexual abuse that Ferber, Free Speech Coalition, and Stevens all presented as the defining justification for child pornography’s categorical exclusion from First Amendment protection.²⁶⁷ The alternative was to subject the bans to strict scrutiny.

Ultimately, three circuits chose the expediency of categorical exclusion, and the Eighth Circuit contorted itself to hold that morphed-image bans satisfied strict scrutiny.²⁶⁸ No matter their approach, these courts relied on justifications for banning indexical images without acknowledging that morphed images are icons. The courts thereby managed to sustain the practice of banning outrageous iconography per se while purporting to adhere to Free Speech Coalition and Stevens.

A morphed-image case from the Fifth Circuit, United States v. Mecham, contains an instructive First Amendment analysis. Mecham justified holding morphed images categorically unprotected by observing that the federal definition of “child pornography” includes not just imagery that records criminal abuse, but also imagery that shows a “lascivious exhibition” of a minor’s genitals, like images taken surreptitiously with a hidden camera.²⁶⁹ True enough. But Mecham overlooked a more persuasive distinction between morphed images and indexical child pornography: Only the latter authentically records private facts about a person. Even if it does not document physical abuse, indexical child pornography is objectionable for the same reason that revenge porn is: Its distribution, as Ferber put it, “violates ‘the individual interest in avoiding disclosure of personal matters.’ ”²⁷⁰ Conspicuously fake morphed images, like deepfakes, do not.

Deepfakes represent a more troublesome extension of the same First Amendment problem that the morphed-image cases presented. Whereas morphed images proved relatively easy for courts to slot into an unprotected category of speech, deepfakes depicting adults do not fall into any recognized category of unprotected speech—at least, not if courts’ refusals to find revenge porn categorically unprotected are any indication. Assuming Stevens is correctly read as hostile towards new categories of unprotected speech that might encompass deepfakes, anti-deepfake laws will have to run the gauntlet of strict scrutiny.

B. Impermissible Bans on Outrageous Expression

Although dilution and morphed CSAM show that per se bans on outrageous iconography have avoided First Amendment invalidation, such bans are not uniformly constitutional. Attempts to outlaw flag burning, effigy desecration, and written sexual fantasies reaffirm that anti-deepfake laws respond to longstanding interests. Judicial curtailments of these attempted bans help us understand the circumstances that have failed to justify per se bans on outrageous expression.

1. Flag Burning

Historical regulation of flag desecration helps explain anti-deepfake laws’ focus on altered images. Like trademarks, flags operate as Peircian symbols when they signify a particular group or nation. For some, the American flag is a symbol not just of the country, but also “of freedom, of equal opportunity, of religious tolerance, and of good will for other peoples who share our aspirations.”²⁷¹ Desecrating the flag can be a grave affront, so much so that at one time forty-eight states criminalized it.²⁷²

In 1989, a 5–4 Supreme Court struck down a Texas ban on flag burning as unconstitutional.²⁷³ The Court held that Texas’s asserted “interest in preserving the flag as a symbol of nationhood and national unity” could not justify criminalizing political expression that took the form of flag burning.²⁷⁴ Dissenting, Justice Stevens argued that the Texas statute did not proscribe the communication of “disagreeable ideas” so much as a particular “mode of expression.”²⁷⁵ “The concept of ‘desecration,’ ” he wrote, “does not turn on the substance of the message the actor intends to convey, but rather on whether those who view the act will take serious offense.” ²⁷⁶ “[E]ven if the actor knows that all possible witnesses will understand that he intends to send a message of respect, he might still be guilty of desecration if he also knows that this understanding does not lessen the offense taken by some of those witnesses.”²⁷⁷

Justice Stevens’s argument about flag burning tracks intuitive attitudes about deepfakes. On his telling, what’s wrong with flag burning is not so much the proposition it expresses as the manner of expression.²⁷⁸ The same is true of deepfakes, which elicit special outrage not because they express any particular proposition, but because they employ a particular manner of expression. For example, one pornographic deepfakes site contained the disclaimer, “We respect each and every celebrity featured. The OBVIOUS fake face swap porn is in no way meant to be demeaning. It’s art that celebrates the human body and sexuality.”²⁷⁹ I can’t imagine this disclaimer placated anyone. Like Justice Stevens’s example of flag burning “intend[ed] to send a message of respect,” the “respect[ful]” creation of pornographic deepfakes to “celebrate[] the human body and sexuality” is still objectionable, because it is still desecration.

Nonconsensual deepfakes and flag burning are both outrageous not strictly because of the propositions they communicate, but because of the outrageousness of their communicative method. But they do not cause identical sorts of outrage. Flag burning concerns only the use of a single, “unique” symbol.²⁸⁰ By contrast, to proscribe nonconsensual deepfakes is to proscribe infinitely many possible photorealistic depictions of every individual’s unique face. Flag burning disrespects a collective, but a deepfake desecrates an individual likeness (although commentators accurately observe that the institution of pornographic deepfakes evinces disrespect for women collectively).²⁸¹ But anti-deepfake laws share the same fundamental stance as Justice Stevens in Texas v. Johnson: What must be regulated is not the expression of any particular proposition or idea, but rather a mode of expression that is simply too outrageous to tolerate.²⁸²

2. Libel, Emotional Distress, and Effigies

The legal and cultural significance of effigies helps us understand why anti-deepfake laws paradigmatically regulate uses of the likeness of another. In 1992, the late singer Sinéad O’Connor concluded her performance on Saturday Night Live by holding a photograph of Pope John Paul II up to the camera and tearing it.²⁸³ Her act is now praised as a protest against sexual abuse within the Roman Catholic Church.²⁸⁴ At the time, however, O’Connor’s demonstration led to death threats, a literal steamrolling of her records in Times Square, and significant damage to her musical career.²⁸⁵ Her protest probably would not have elicited the same outcry if, instead of destroying a photograph, O’Connor had simply stared into the camera and stated, “I protest sexual abuse in the Roman Catholic Church.” There’s something especially outrageous about defacing a realistic likeness of a person.²⁸⁶ Abrahamic religions acknowledge the power of images by forbidding visual depictions of the godhead.²⁸⁷ Islam forbids visual likenesses of prophets, and the past two decades have seen multiple outbreaks of deadly violence following Western political cartoonists’ publication of disparaging caricatures of the Prophet Muhammad.²⁸⁸

Perhaps in recognition of the special power of effigies, historical definitions of libel have acknowledged that the defacement of images can provoke legally actionable outrage. Blackstone explained with respect to criminal libel that “it is immaterial with respect to the essence of a libel, whether the matter of it be true or false; since the provocation, and not the falsity, is the thing to be punished criminally.”²⁸⁹ Some historical sources suggest that civil libel could be shown from the defacement of images, such as burning a plaintiff in effigy.²⁹⁰ And to this day, courts permit claims for intentional infliction of emotional distress when a plaintiff can show that a defendant intentionally or recklessly caused severe emotional distress by defacing an effigy.²⁹¹

In the mid-twentieth century, the Supreme Court interpreted the First Amendment to require defamation plaintiffs to prove the falsity of the defendant’s statement, at least where the subject of the statement was a matter of public concern.²⁹² The First Amendment similarly limits public figures’ claims for intentional infliction of emotional distress.²⁹³ The Court also explained that “[u]nder the First Amendment there is no such thing as a false idea.”²⁹⁴ Accordingly, insofar as a defacement of an effigy merely expresses outrageous disrespect and does not insinuate any factual proposition, it cannot be defamatory today.²⁹⁵ But the venerable history of legal and theological regulation of the creation of effigies suggests an understanding that images can provoke outrage that text may not.

As with pornographic deepfakes and flag burning, the chief harm of disparaging effigies derives from the mode of expression rather than the proposition expressed.²⁹⁶ A provocateur who wears a sandwich board displaying a written message of contempt for Muslims might, in some abstract sense, be said to communicate the same message as a provocateur who burns an effigy of the Prophet Muhammad. But the provocateurs’ communications differ meaningfully.²⁹⁷ Disrespecting an effigy is not a true or false statement, but an outrageous form of disrespect. Anti-deepfake statutes don’t regulate propositional statements; they regulate uses of effigies.

3. Written Sexual Fantasies

Legal analysis of fantasies disseminated in writing illuminates anti-deepfake laws’ “realism” requirements.²⁹⁸ In 2013, a jury convicted former New York City Police Department officer Gilberto Valle of conspiracy to commit kidnapping, based on messages from a sexual fetish website “in which Valle and three alleged co-conspirators discuss in graphic detail kidnapping, torturing, raping, murdering, and cannibalizing women.”²⁹⁹ Valle—who came to be known as the “Cannibal Cop”—had shared “Facebook photographs of women he knew” and exchanged detailed messages with other forum users about kidnapping, torturing, raping, and cannibalizing those women.³⁰⁰ Valle disclosed the women’s true first names, but never their surnames, and he consistently misrepresented details relevant to a potential kidnapping, such as where he lived, whether he had surveilled his putative targets, and where those targets lived.³⁰¹ Valle maintained that these supposedly incriminating communications were in fact consistent with fantasy, and that the government failed to establish that he had the necessary criminal intent or that he entered into an actual agreement to commit kidnapping.³⁰² More than a year after Valle’s conviction, the district court entered a judgment of acquittal, which the Second Circuit affirmed.³⁰³

The government had argued that, while some of Valle’s chats were “fantasy,” others demonstrated “real” criminal intent.³⁰⁴ An FBI agent who reviewed Valle’s chats explained, “[i]n the [chats] that I believe[d] were fantasy, the individuals said they were fantasy,” while “the ones that I thought were real . . . . described dates, names and activities that you would use to conduct a real crime.”³⁰⁵ Both the district court and the Second Circuit held that the “real” and “fantasy” chats were “indistinguishable”—both contained fabricated and fantastical elements, and even Valle’s “real” chats were unaccompanied by any effort to meet putative coconspirators in person—and thus the prosecution could not prove the necessary criminal intent.³⁰⁶

In a similar case, United States v. Alkhabaz, the defendant, Jake Baker, posted to a public Internet newsgroup a story that “graphically described the torture, rape, and murder of a woman who was given the name of” one of his university classmates.³⁰⁷ However, the defendant also transmitted written sexual fantasies in private emails to a single correspondent, and on the basis of these emails the government charged him with violating the interstate-threat statute, 18 U.S.C. § 875(c).³⁰⁸ The emails, among other things, expressed a desire “to do it to a really young girl” and described how one might abduct an unspecified woman in Baker’s dormitory.³⁰⁹ The district court quashed the indictment on the ground that the emails did not express an intent to act and were thus protected by the First Amendment. The court wrote, “Discussion of desires, alone, is not tantamount to threatening to act on those desires. Absent such a threat to act, a statement is protected by the First Amendment.”³¹⁰ The Sixth Circuit affirmed on statutory rather than constitutional grounds. It interpreted the statute to require “that a reasonable person . . . would perceive” the ostensible threat “as being communicated to effect some change or achieve some goal through intimidation.”³¹¹ The court concluded, “[N]o reasonable person would perceive such communications as being conveyed to effect some change or achieve some goal through intimidation. Quite the opposite, Baker and [Baker’s correspondent] apparently sent e-mail messages to each other in an attempt to foster a friendship based on shared sexual fantasies.”³¹²

If Valle or Baker had communicated their sexual fantasies by making pornographic deepfake imagery of identifiable women and sharing it in online chats, such conduct would undoubtedly be a violation of many criminal and civil anti-deepfake statutes. Yet several scholars have sympathized with Valle and criticized his prosecution as motivated by “discomfort, disgust, and confusion toward his online fantasy life.”³¹³ Valle’s fantasies about torturing, raping, murdering, and cannibalizing female acquaintances surely strike many as deeply antisocial. In comparison to such ghoulishness, the fantasy that many pornographic deepfakes make manifest—“I’d like to see this person naked”—seems relatively innocuous.³¹⁴

For whatever reason, however, relatively few scholars have opposed anti-deepfake laws as encroachments on sexual fantasy.³¹⁵ Some scholars even explicitly frame deepfakes as a kind of fantasizing that deserves to be punished.³¹⁶ The widespread intuition seems to be that a fantasy remains a fantasy when it’s represented in writing, but it becomes “real” when represented in a photorealistic image.

But why would it be that disseminating a deepfake is a “real” harm, while disseminating gruesome text accompanied by nonpornographic photographs is constitutionally protected “fantasy?”³¹⁷ Valle even co-opted his targets’ likenesses: Though his portrayals of sadistic sexual conduct were strictly symbolic, he disseminated targets’ photographs along with them.³¹⁸ What Valle and Baker didn’t do, however, was manipulate an icon itself; Baker used text alone, and Valle paired innocuous photographs with appalling text. This is the only material difference between Valle’s and Baker’s chats and a deepfake offense. The dismissal of the cases against Baker and Valle—and the sympathy afforded to these defendants by some of the academic commentariat—imply that this difference is legally and morally dispositive. Unlike a verbal disquisition on cannibalism, a deepfake is an iconic desecration of a person’s image. It is semiotics and the irrational power of images that explain why deepfakes are real criminal wrongs while Valle’s and Baker’s words were unactionable fantasies.

Table 1: Characteristics of Regulations of Outrageous Expression

C. In Summation

The disparate legal doctrines surveyed in this Part illuminate distinct aspects of the typical anti-deepfake law. Trademark dilution tells us that we are still bound today by laws that regulate nondeceptive uses of images because of their putative tendency to negatively affect emotional attitudes towards the referents of those images. CSAM jurisprudence reveals that federal courts of appeals have uniformly upheld the constitutionality of criminal prohibitions on nondeceptive, noncommercial uses of icons that do not disclose private facts. Flag-burning bans show that desecrating an icon or symbol can be distinctly more outrageous than using disparaging words, but their constitutional invalidation also shows that nonindividualized harm may not be sufficient grounds for regulating outrageous speech. The arc of defamation law shows that actionable reputation-harming statements must be false and not merely outrageous. And the legal status of written sexual fantasies suggests that anti-deepfake laws’ focus on photorealistic subject matter may be an essential limitation.

The constellation of features that characterize constitutional and unconstitutional regulations of outrageous iconography also underscores the constitutional precarity of anti-deepfake laws. On one hand, because anti-deepfake laws remedy harmful uses of images that target specific individuals, they are meaningfully distinct from unconstitutional attempts to regulate written sexual fantasies or nonindividualized harms like flag burning or virtual CSAM, or false statements generally. On the other hand, because covered deepfakes neither disclose private facts nor defame, and likely do not fall into an established category of unprotected speech, they differ meaningfully from iconic manipulations that courts have held constitutional to ban. Given this legal context, Part IV explains what defensible regulation of deepfake pornography might look like.

IV. The Law of Deepfakes Is the Law of Icons, Not Indices

AI’s ability to synthesize photorealistic pornography has deeply concerned policymakers—particularly when that pornography depicts children.³¹⁹ This technology also threatens to push the judiciary’s tortured semiotic reasoning to a breaking point. One issue in particular has added urgency to concerns about AI-generated pornography: In late 2023, researchers disclosed that a major dataset used for training image-generating AI contained hundreds of CSAM images.³²⁰ It is not yet clear how Free Speech Coalition’s holding applies to photorealistic, AI-generated CSAM³²¹, or whether the presence or absence of indexical CSAM in training data will be legally significant. But interested parties are already calling for legislation to address the issue, and these calls will only intensify as image- and video-generating technology continues to develop and proliferate.³²² Attempting to regulate all photorealistic imagery as if it were indexical results in doctrinal incoherence. Effective regulation of deepfakes requires employing the legal theories that regulate iconic imagery for its iconic properties.

A. The Law of Indices Cannot Address Deepfakes Coherently

One response to the AI-generated pornography crisis is to simply ignore the semiotic differences between iconic and indexical media and equate the two legally. This approach simplifies the regulatory gameplan: Just add deepfake-related clauses to existing revenge-pornography statutes—as several states have already done³²³—and treat photorealistic AI-generated CSAM as equivalent to indexical CSAM. At least where AI-generated CSAM depicts identifiable children, prosecutions under the morphed-image prong of the child pornography statute could kick into high gear, since courts seem unbothered by the semiotic infirmities of this approach.³²⁴

The law of indexical images is a powerful machine, but the complicated ontology of AI-generated images is already starting to grind its gears. Consider the problem of image-generating models trained on CSAM. Riana Pfefferkorn concludes that the federal child pornography statute prohibits media “generated using training data that included photographic CSAM” because such “[a]buse-trained” CSAM “ ‘involves the use of’ actual abuse” and thus meets the statutory definition of child pornography.³²⁵ This may be the best reading of the statute, but it also entails that the same language prohibits any abuse-trained AI-generated image that depicts sexually explicit conduct at all, irrespective of whether it appears to depict minors or adults.³²⁶ Recall that the definition of “child pornography” includes “any visual depiction . . . of sexually explicit conduct” when its production “involves the use of a minor engaging in sexually explicit conduct.”³²⁷ “[S]exually explicit conduct” is defined broadly to include various forms of intercourse and nudity, without reference to the participants’ ages.³²⁸ Thus, if training on photographic CSAM is all that is required for an image-generating AI’s output to “involve[] the use of a minor engaging in sexually explicit conduct,” then that output will fall within the federal statute’s coverage so long as it depicts anything that meets the broad definition of “sexually explicit conduct.”³²⁹

The puzzles of applying the federal child pornography statute to AI-generated media illustrate the limits of indexicality as a rationale for regulating images.³³⁰ The presence of indexical CSAM in AI training data is dreadful, but liability that hinges on this fact is both over- and underinclusive. If “involv[ing] the use of a minor engaging in sexually explicit conduct”³³¹ is the evil, simpliciter, then every image produced by an abuse-trained AI model—no matter how innocuous its content—is tainted, because its production as a matter of fact involved the real-life sexual abuse of a minor. On the flipside, prohibitions on morphed CSAM and nonconsensual deepfakes show us that photorealistic iconicity alone can suffice for banning an image, even if the image has no indexical relation to real-life abuse and deceives no one. Nonconsensual, photorealistic pornography is regulated because it is an outrageous use of icons, not because it indexically documents abuse.

Judges and lawmakers are already being invited to confront photorealistic, AI-generated pornography with the same haphazard semiotic analyses that morphed-image cases like Anderson and Hotaling employed.³³² In September 2023, the attorneys general of fifty-four states and territories sent a letter urging Congress to “act to deter and address child exploitation, such as by expanding existing restrictions on CSAM to explicitly cover AI-generated CSAM.”³³³ The letter warns that AI-generated CSAM is “still problematic” because it is “often based on source images of abused children”; it “often still resembles actual children”; it “support[s] the growth of the child exploitation market by . . . stoking the appetites of those who seek to sexualize children”; and it is “quick and easy to generate.”³³⁴ In support of the letter, South Carolina’s Attorney General Alan Wilson asserted that generating realistic-looking child pornography “creat[es] demand for the industry that exploits children.”³³⁵

The production of photorealistic, pornographic depictions of children is a deeply troubling phenomenon. But it is troubling because it is an outrageous and antisocial use of icons. The prosecutors’ letter, meanwhile, appeals to indexicality. Its first point is a strict indexicality argument; taking it seriously suggests that the prosecutors’ concern with pornographic images is far too narrow, since all outputs of abuse-trained AI are “based on source images of abused children.” The second point seems to rely on the same conflation of indices and icons that has been used to uphold morphed-image laws. The third point is an argument that Free Speech Coalition expressly rejected.³³⁶ The fourth point holds no independent weight; that these images are “easy to generate” is only bad if the images are themselves bad for other reasons.

Finally, Attorney General Wilson’s remarks contravene Free Speech Coalition’s admonition that “[p]rotected speech does not become unprotected merely because it resembles the latter.”³³⁷ The argument that photorealistic AI-generated CSAM “exploits children” even when it does not depict an identifiable child depends on mistaking icons for indices. A vegan Impossible Burger resembles a hamburger, but this does not entail that Impossible Burgers “creat[e] demand for the industry that exploits” cows. It has been suggested that AI-generated CSAM could stoke demand for indexical CSAM produced specifically for training AI.³³⁸ But as Free Speech Coalition notes, “[t]he mere tendency of speech to encourage unlawful acts is not a sufficient reason for banning it,” and besides, this possible misconduct is unmoored from what makes photorealistic CSAM outrageous.³³⁹ I doubt many people’s alarm about AI-generated CSAM would be assuaged if they were assured that advances in image synthesis would not encourage the production of indexical CSAM for use as training data.³⁴⁰ The problem, once again, is not that AI-generated nonconsensual pornography indexically records harms, but that it iconically signifies something abhorrent.

B. The Law of Icons Coherently Addresses Deepfakes

Regulating AI-generated pornography doesn’t require willful ignorance of semiotic realities. As applied to images, defamation law, information-privacy law, and CSAM doctrine paradigmatically regulate actual or perceived indices. Deepfakes are icons, and they defy the rationales used to regulate indices. But we already have two relevant doctrines that regulate icons qua icons: obscenity and appropriation of likeness. These doctrines, unlike those that focus on images qua indices, regulate the aspects of deepfakes that actually trouble us. Indeed, if a nondeceptive deepfake causes harm of the sort anti-deepfake laws mean to redress, it does so either because it is obscene or because it wrongfully appropriates someone’s likeness.

1. Obscene Deepfakes Are Bad Because They Are Obscene

Obscenity is a constitutionally unprotected category of speech.³⁴¹ Unlike child pornography, however, obscenity is unprotected not because it indexically records harmful conduct, but because “obscene . . . . utterances are no essential part of any exposition of ideas, and are of such slight social value as a step to truth that any benefit that may be derived from them is clearly outweighed by the social interest in order and morality.”³⁴² Whether material is obscene depends on what is known as the Miller test, which considers (1) whether the work “appeals to the prurient interest;” (2) whether it depicts sexual conduct “in a patently offensive way”; and (3) whether it “lacks serious literary, artistic, political, or scientific value.”³⁴³ The Miller test is not a backwards-looking examination of the circumstances of the media’s production, but a forward-looking inquiry into what the media communicates. The state regulates obscenity not because producing obscenity entails inflicting real-life abuse, nor because obscenity defames anyone or invades privacy, but because regulating obscenity fulfills a “governmental responsibility for communal and individual ‘decency’ and ‘morality.’ ”³⁴⁴

An obscenity-based approach to regulating pornographic AI output is already on the books, and federal prosecutors are beginning to employ it against AI-generated CSAM.³⁴⁵ While “child pornography” can be prohibited even if it is not obscene, a distinct “child obscenity” statute, 18 U.S.C. § 1466A, proscribes sexual images of children that are obscene.³⁴⁶ The different ontologies of obscenity and CSAM correspond to meaningful semiotic differences between paradigmatic obscenity and paradigmatic CSAM. Unlike the law of child pornography, which chiefly regulates indices, the law of child obscenity (and obscenity in general) focuses on icons. For example, § 2256 specifically excludes “drawings, cartoons, sculptures, or paintings” from its coverage of “image[s] . . . indistinguishable from” indexical child pornography, while § 1466A explicitly includes “visual depiction[s] of any kind, including a drawing, cartoon, sculpture, or painting.”³⁴⁷ These semiotic differences track the different harms that obscenity and CSAM laws address. The foundational harm targeted by CSAM laws is the harm inherent in indexical records of abuse. Photographing a child being sexually abused requires a child to be harmed; drawing a cartoon of such abuse does not. By contrast, the core harm of obscenity isn’t in how it’s produced, but in what it represents. An obscene photograph is just as bad as an obscene painting because both images are iconic signs for a worthless, antisocial message.

The child obscenity statute, and the catchall obscenity statutes, §§ 1460–62, would seem like the perfect vehicles for addressing the harms of AI-generated pornography. Yet obscenity law is in desuetude; Pfefferkorn reports that in the past twenty years “there have been over fifty-fold more federal court decisions citing 2252A than 1466A.”³⁴⁸ Why might this be? Pfefferkorn suggests that child-obscenity offenses are harder to prosecute than child-pornography offenses: “The knowing possession, receipt, or distribution of (photographic) CSAM is tantamount to a strict liability offense, whereas an obscenity case entails the more probing inquiry of the three-pronged Miller test.”³⁴⁹ But Pfefferkorn also anticipates that § 1466A may become a more appealing vehicle for prosecutors as AI tools for producing photorealistic images proliferate and make it harder for the government to prove that the defendants’ images depict a real-life child.³⁵⁰

Pivoting to obscenity law to address photorealistic pornography has risks. One risk is that obscenity might not cover the breadth of cases that current child pornography or anti-deepfake laws would. For example, a recent Fifth Circuit decision held that graphic iconic and written depictions of violent sexual abuse of children were obscene, but a drawing of “an adolescent girl alone, reclining and apparently masturbating” with “no indication . . . [of] being forced to perform a sexual act” was not.³⁵¹ When it comes to non-child pornography, commentators are divided over obscenity’s present-day viability; some maintain that “[t]oday, pornography is ubiquitous and essentially legal,” while others call such arguments “short-sighted and, in many respects, incorrect.”³⁵² The Miller test is surely harder to satisfy for pornography that only depicts adults, and obscenity prosecutions for pornography depicting adults are indeed rare—but they aren’t nonexistent.³⁵³

But at least when AI-generated pornography depicts no identifiable person, Miller’s demands are a feature, not a bug. Unlike indexical CSAM, which is abhorrent because of what it records, iconic CSAM is abhorrent because of what it depicts. If AI-generated pornography depicts no recognizable person and the prosecution fails to prove that it is obscene, then the material is no more harmful than the nonobscene drawing in Arthur.³⁵⁴ Unlike doctrines that address indexical images, obscenity doctrine actually measures the relevant variable for nondeceptive deepfakes with no identifiable subject: a popular consensus that expression has gone beyond the pale.

A distinct risk is that obscenity might be too inclusive of expression that the public unjustly disfavors. Pfefferkorn warns that “increased reliance on obscenity law risks enshrining regressive social norms about sex, sexuality, and sexual orientation.”³⁵⁵ This is indeed a hazard, but it is a hazard inherent to the project of regulating the outrageous use of icons. Insofar as they proscribe nondeceptive media, anti-deepfake laws are self-consciously responding to the power that such “regressive social norms” hold over our lives.³⁵⁶ Regressive social norms are what make nudity and sexuality a uniquely sensitive and shameful topic; they are what trigger harmful repercussions for sexual presentations that deviate from socially prescribed standards.³⁵⁷ Just as they are premised on the power of regressive social norms, anti-deepfake laws are also premised on the notion that some uses of icons trigger irrational beliefs in reasonable people. A perfectly rational viewer who encounters an obvious deepfake won’t impute a photorealistic avatar’s actions to the person the avatar resembles. If this were the expected reaction to outrageous images, there would be no need for anti-deepfake laws to cover nondeceptive media, just as there would be no need for dilution law to cover tarnishing but nonconfusing uses of trademarks. That anti-deepfake laws do cover nondeceptive media shows that these laws assume that an ordinary person who encounters a deepfake will have an affective response rooted in sexual mores and irrational beliefs about iconography. If anti-deepfake laws’ very theory of harm derives from these widespread social biases and irrational beliefs, how can we expect to administer such laws without reference to those same biases and irrationalities?

Predicting exactly how obscenity law will address nonconsensual, pornographic deepfakes is outside this Article’s scope. My guess is that obscenity law will effectively regulate trafficking in AI-generated pornography depicting children, whether or not those children are identifiable.³⁵⁸ Obscenity law will probably be less effective at regulating deepfake pornography of identifiable adults.³⁵⁹ In all events, an honest semiotic analysis shows that it is the law of icons, not the law of indices, that we must bring to bear on outrageous, nondeceptive deepfakes.

2. Appropriative and Offensive Deepfakes Are Bad Because They Are Appropriative and Offensive

Even before anti-deepfake laws, we had some legal scaffolding to address non-obscene, pornographic deepfakes: the cause of action for appropriation, discussed in Part I.³⁶⁰ To effectively combat deepfakes, appropriation must encompass noncommercial uses of likeness—as it already may in some instances, and as Citron has proposed³⁶¹—and it may need to be buttressed with criminal penalties. This is what anti-deepfake laws, in essence, do: They extend appropriation to all dissemination of certain depictions of identifiable persons, irrespective of whether the dissemination realizes an “advantage” for the defendant. This is a place to which at least some courts, citing the First Amendment, have previously feared to venture.³⁶²

Appropriation regulates images qua icons, not qua indices: For example, Muhammad Ali used New York’s appropriation statute to enjoin Playgirl magazine from publishing “a full frontal nude drawing” purporting to depict him.³⁶³ And appropriation recognizes that the relevant harm is a hijacking of identity without consent, not the creation of expression that would be objectionable even if consensual. Functionally equivalent is Goldberg and Zipursky’s proposal to extend false light to cover highly offensive speech that is not false.³⁶⁴

This reform requires not legislation that equates deepfakes with revenge porn, nor legislation that bans “false” depictions of persons, but legislation that bans highly offensive appropriations of likeness. This is exactly what an Australian criminal anti-deepfake statute does overtly; unlike its American counterparts, the law simply states that its prohibition “does not apply if . . . a reasonable person would consider transmitting the material to be acceptable, having regard to the” totality of the circumstances.³⁶⁵ State laws may be inching towards a similar assessment of overall aesthetic reasonableness—Oregon’s, for example, extends to “reasonably realistic” depictions.³⁶⁶ Moreover, existing American law already redresses similar harms: The appropriation tort and trademark dilution redress nondeceptive, offensive uses of icons in commerce; and the law of morphed images criminalizes nondeceptive sexual depictions of children even in the absence of physical abuse. If morphed-CSAM and dilution-by-tarnishment laws have thus far avoided constitutional invalidation, then this expanded version of appropriation should be able to coexist with them. And if we can’t abide banning outrageous iconography in the manner required to combat deepfakes, then we should reconsider the laws of morphed CSAM and tarnishment, too.

What, then, about the First Amendment? Almost certainly, at least some nonconsensual, pornographic deepfakes depicting adults are protected speech.³⁶⁷ By prohibiting only sexual deepfakes, the typical anti-deepfake law is a content-based restriction of protected speech.³⁶⁸ Anti-deepfake laws will force jurists to assess whether cases like Free Speech Coalition, Stevens, Johnson, Tam, and Brunetti truly forbid banning expression simply because it is outrageous.³⁶⁹ Courts thus far have managed to dodge this question when considering deepfake-adjacent media like revenge porn and morphed CSAM. In revenge-porn cases, courts could emphasize that the regulated media indexically documents true, private facts.³⁷⁰ In morphed-image cases, courts could make expedient use of the categorical First Amendment exception for “child pornography,” even though the Supreme Court’s rationale for that exception applies only to indexical images, and not really to morphed images.³⁷¹ When trademark dilution faces constitutional scrutiny, courts may invoke property rights.³⁷² Deepfakes offer none of these offramps.³⁷³

In other words, anti-deepfake laws will force courts to consider whether American law can regulate outrageous, nondeceptive, nonobscene iconography per se—something it has reliably done and continues to do today—even when jurists must admit that this is what the law is doing. Pornographic deepfakes may or may not be a category of speech that has “historic[ally] and traditional[ly]” been unprotected.³⁷⁴ But in all events, deepfakes bear critical resemblances to forms of nondeceptive, iconic signification that have either been held categorically unprotected—such as morphed CSAM and obscenity—or whose regulation has thus far avoided constitutional invalidation—such as dilution by tarnishment and the tort of appropriation of likeness. This resemblance may or may not save the full sweep of a typical anti-deepfake statute from a constitutional challenge, but it does show the government’s established interest in the regulation of outrageous iconography per se. And if anti-deepfake laws’ continuity with historical prohibitions on the outrageous treatment of icons cannot save them, it is doubtful anything else could. At its least useful, then, my analysis gives proponents of anti-deepfake laws an honest way to lose a constitutional challenge they were doomed to lose; at its most useful, it gives them an honest way to win.

Conclusion

The federal government and dozens of states have enacted a welter of brand-new anti-deepfake laws. Existing theories of defamation and information privacy can explain much of these laws’ scope. But information privacy and defamation can’t account for the full breadth of a typical anti-deepfake law. This doctrinal mismatch shows not that anti-deepfake laws are overinclusive, but rather that they redress an injury distinct from the injuries redressed by defamation and information-privacy law. Anti-deepfake laws prohibit nondeceptive, outrageous uses of iconic signs, which cause harm independent of any factual proposition that they might communicate.

Although images are usually regulated for their indexical qualities—such as their ability to record harmful events or reveal private facts—or for deceptively resembling indexical records, several areas of American law regulate icons qua icons. Trademark dilution doctrine proscribes tarnishing uses of marks not because they cause confusion, but because even nondeceptive uses threaten to change observers’ attitudes. The law of morphed CSAM images posits that “a child suffers [harm] from appearing as the purported subject of pornography in a digital image . . . regardless of the image’s verisimilitude.”³⁷⁵ The harm to a brand that is tarnished, or to a child that is depicted in an obviously fake morphed image, is a harm rooted not in detached rationality but instead in the emotional power of images. That doesn’t make the harm any less real.³⁷⁶

Thus, anti-deepfake laws do not challenge us to examine whether our law can have any solicitude at all for irrational beliefs about images. The doctrines of trademark dilution and morphed images, as well as historical regulation of flag desecration and effigy burning, show that our law already extends solicitude to such beliefs. Rather, anti-deepfake laws challenge us to decide whether the law will extend that solicitude to the particular irrational beliefs about images that harm people—women, overwhelmingly³⁷⁷—who appear in pornographic deepfakes without their consent. If the law can empower Coca-Cola to enjoin a (hypothetical) nonconfusing “Coca-Cola Strip Club,” might the law also empower an individual to enjoin nondeceptive, photorealistic, pornographic deepfakes that depict her? And if the law can’t abide one of these possibilities, should it really abide either of them?

We cannot justify the regulation of photorealistic, AI-generated icons using the same rationales we have used to regulate indexical images. Regulating nondeceptive deepfakes is not about deciding what private facts may be disclosed, or what lies may be told, or what abuse may be recorded—all of which are questions that a law of indices can answer. It is about deciding how our society will tolerate its members to be depicted. This is a question only a law of icons can answer.

* Assistant Professor of Law, University of Wisconsin Law School. The author thanks the editors of the Michigan Law Review, Amy Adler, Kendra Albert, Barton Beebe, Michael Beauvais, Robert Brauneis, Dinis Cheian, Bryan Choi, Brenda Cossman, Daniel Francis, Mary Anne Franks, Kat Geddes, Ruobin Gong, James Grimmelmann, Gautam Hans, Thomas Kadri, Matthew Kugler, Mark Lemley, Ela Leshem, Amanda Levendowski Tepski, Jonathan Masur, Joseph Miller, Helen Nissenbaum, Jacob Noti-Victor, Frank Pasquale, Riana Pfefferkorn, Lisa Ramsey, Blake Reid, Jennifer Rothman, Ted Sichelman, Joel Sobel, Katherine Strandburg, Rebecca Tushnet, Rebecca Wexler, Kathryn Woolard, and Mark Wu. Thanks also to Kris Turner at the University of Wisconsin Law School’s Law Library and to the participants in the Cornell Law School Academic Professionals Workshop, the 2024 Legal Scholars Roundtable on Artificial Intelligence at Emory Law School, the 2024 NYU Academic Careers Program Scholarship Clinic, the 2024 Richmond Junior Faculty Forum, the 2024 Privacy Law Scholars Conference, the 2024 Intellectual Property Scholars Conference, and to interlocutors at Cornell Law School and the Digital Life Initiative, Florida International University Law School, George Washington University Law School, the University of Illinois College of Law, NYU’s Information Law Institute, the University of Wisconsin Law School, and the University of Toronto Faculty of Law. This paper received the Ian Kerr Award for Best Paper at the 2024 Privacy Law Scholars Conference.