Deepfake and Intimate Image Laws in Australia: Creation vs Distribution by State

At the Commonwealth level, transmitting a sexual deepfake of an adult without consent is a crime, but creating one and never sharing it generally is not, while creating AI-generated child sexual abuse material is a serious federal offence on its own.

This article covers Australia's deepfake and non-consensual intimate-image laws: when creating one is itself a crime, when only sharing it is, how the states and territories differ, and how to get an image taken down. Doxxing, publishing someone's personal identifying information in a menacing or harassing way under a separate pair of Commonwealth offences, is a related but legally distinct topic; see doxxing laws in Australia if that is what happened to you instead.

Is a Deepfake Illegal in Australia? The Commonwealth Transmission Test

Australia's first purpose-built deepfake law is the Criminal Code Amendment (Deepfake Sexual Material) Act 2024 (Cth), assented on 2 September 2024 and in force from 3 September 2024. It rewrote section 474.17A of the Criminal Code and added the aggravated offences in section 474.17AA.

The base offence, section 474.17A(1), applies where a person uses a carriage service, in practice the internet or a phone network, to transmit material of another person who is, or appears to be, 18 or older, and the material depicts or appears to depict that person in a sexual pose or activity, their genital or anal region, or, if the person is female, their breasts. The person transmitting it must know, or be reckless as to whether, the depicted person does not consent. Transmit is defined broadly: it includes making the material available, publishing it, distributing it, advertising it or promoting it, not just literally sending a file to someone. The maximum penalty is 6 years imprisonment.

Section 474.17A(2) is the provision that puts deepfakes squarely inside this offence. It states that it is irrelevant whether the material transmitted is unaltered, or has been created or altered in any way using technology, and the accompanying legislative note names images, videos or audio that have been edited or entirely created using digital technology, including artificial intelligence, as an example, calling them deepfakes by name. A synthetic image is treated the same as a genuine one once it is shared without consent.

The aggravated offence in section 474.17AA carries up to 7 years imprisonment, but it only applies on top of a proven transmission offence. There are two paths to it: the person already had three or more civil penalty orders made against them under the eSafety Commissioner's image-based abuse scheme, described below, or the person was responsible for creating or altering the material they transmitted. Either way, the underlying section 474.17A(1) transmission offence still has to be established.

That last point answers the question most people ask about this law: creating a sexual deepfake of an adult and never sharing it with anyone is not, on its own, a Commonwealth offence. Section 474.17A(1) requires an act of transmission as one of its elements, and the creation-based aggravation in section 474.17AA(5) does not replace that element, it adds to it. There is no free-standing Commonwealth offence for private creation or possession of adult deepfake material. The picture is different where the depicted person is a child, covered next. Defences exist for law enforcement, court or tribunal proceedings, genuine medical or scientific purposes, and a reasonable-person test weighing factors including the depicted person's age, vulnerability and the effect on their privacy; the defendant carries the burden of raising one.

It is the date material was transmitted, not created, that matters. The reforms apply to material transmitted after commencement regardless of whether it was made before or after that date, so an image created earlier is still caught the first time it is shared after 3 September 2024.

The most visible early prosecution under this framework is R v William Yeates, before the Adelaide Magistrates Court. Yeates, then 19, was charged over material created and posted to X between 8 and 13 February 2025, with 8 counts of creating or altering sexual material without consent, the aggravated offence carrying up to 7 years each, plus 12 counts of using a carriage service to harass or offend, an older, separate provision carrying up to 5 years. The Commonwealth Director of Public Prosecutions withdrew the remaining charges after defence counsel offered an acknowledgment covering the conduct alleged in every count. As of the matter's most recent listing, it had not resulted in a sentence, so it should be read as a charged, contested-conduct-acknowledged case, not a completed conviction with a known outcome.

AI-Generated Child Sexual Abuse Material: Creation Alone Is Already a Crime

The transmission requirement above applies only to adult material. Where the depicted person is, or appears to be, under 18, an entirely different and much older part of the Criminal Code applies: Division 474 Subdivision D, the child abuse material offences.

Section 473.1 defines child abuse material by reference to a person, or a representation of a person, who is or appears to be under 18. That representation of a person wording does the same job for child material that the artificial intelligence note in section 474.17A(2) does for adult material: on its plain wording, it does not require a real child to exist behind the image, so a wholly AI-generated depiction of a fictional child falls inside the definition on the same terms as a photograph. This reading has not been confirmed by a specific Australian Federal Police or eSafety statement addressing AI-generated content directly, so treat it as the best current reading of the statute's own wording rather than a regulator-confirmed position.

Unlike the adult-deepfake regime, transmission is not required. Section 474.23 makes it an offence to possess, control, produce, supply or obtain child abuse material intending it be used, by the person or someone else, to commit a section 474.22 carriage-service offence, up to 15 years imprisonment. Section 474.23(2) removes any doubt about whether an actual transmission has to follow: a person can be guilty under section 474.23 even if committing the underlying section 474.22 offence would be impossible. Producing the material with that intent is itself the complete crime, regardless of whether it is ever sent to anyone.

Two related offences carry the same 15-year maximum: using a carriage service to access, transmit or solicit child abuse material (section 474.22), and possessing or controlling material obtained or accessed using a carriage service (section 474.22A). A fourth offence, section 474.23A, targets creating, developing, altering, maintaining, controlling, moderating or promoting a service intended to be used for child abuse material, and carries the highest penalty found anywhere in this survey, up to 20 years imprisonment.

No confirmed Australian prosecution specifically involving AI-generated, as opposed to photographic, child abuse material was found for this article, so none is cited here.

State and Territory Laws: Creation Offences, Distribution-Only Laws and the Gaps

Outside the two Commonwealth regimes above, every state and territory has its own intimate-image offences, and they do not line up. Some criminalise creating a deepfake even if it is never shared. Others only reach the moment it is distributed or threatened. One has no coverage of an altered or AI-generated image at all. The table below summarises the current position; the standout jurisdictions are explained after it.

Victoria has the most explicit statutory language of any jurisdiction in this survey. Sections 53O to 53X of the Crimes Act 1958, moved out of the old Summary Offences Act by a 2022 reform commencing 30 July 2023, define producing an image as including digitally creating it, and separately as generating the image or altering or manipulating another image, two disjunctive limbs rather than one. Producing an intimate image without consent is itself an offence under section 53R, with no distribution required, up to 3 years. Distributing it (section 53S) and threatening to distribute it (section 53T) carry the same 3-year maximum; before the 2023 reform, a threat carried half the penalty of an actual distribution, so an older source describing a lower threat penalty is now out of date.

South Australia added a dedicated regime for wholly synthetic content. Its longstanding offences under Part 5A of the Summary Offences Act 1953 already reached a real image altered by digital or other means, and creating a humiliating, degrading or indecent image was already its own offence with no distribution required, up to $20,000 or 4 years where the depicted person is under 17, otherwise $10,000 or 2 years. A new Part 5B, in force from 3 November 2025, adds a parallel set of offences specifically for artificially generated content with no real underlying photo: creating such a depiction of an identifiable simulated person is an offence under section 26G, at the same penalty tiers, and distributing it under section 26H carries the same maximum, or up to 1 year for a lower-tier humiliating or degrading depiction.

New South Wales closed its gap on 16 February 2026. Before that date, the original intimate-image offences in sections 91N to 91R covered real and altered images but arguably not a wholly AI-generated depiction with no real underlying photo. A 2025 amending Act inserted a new section 91PA and redefined digitally generated to expressly include content created by generative artificial intelligence. Section 91PA(1)(b) makes it an offence to create intimate image or audio material of a simulated person, defined as content that purports to be, or closely resembles, an identifiable real person, without that person's consent, up to 100 penalty units or 3 years, or both, with no distribution element required.

Western Australia, Queensland and the Australian Capital Territory stop at distribution. Western Australia's Chapter XXVA already defines an intimate image to include one created or altered to appear to show the listed content, but its only substantive offence, section 221BD, is distribution, up to 3 years indictable or 18 months and an $18,000 fine summarily; no later Western Australian amendment closing that gap was found. Queensland's section 223 is likewise a distribution-only offence, up to 3 years, and its definition of an intimate image in section 207A covers an altered image but, on its wording, presupposes an act of alteration performed on a real starting image rather than a wholly generated one. Queensland's Attorney-General announced on 12 April 2026 an intention to legislate for images digitally altered or created entirely using digital technology, naming AI-generation and nudify apps directly, but as of publication that had not yet reached Parliament as a Bill. The ACT's Crimes Act has covered altered images in its definition since 2017, older than any other reform in this survey, but Part 3A only criminalises distributing (section 72C, or 72D for a young person) or threatening to capture or distribute (section 72E) an intimate image; there is no equivalent creation-alone offence.

Tasmania is the clear outlier. Its Police Offences Act 1935 defines a prohibited visual recording as a visual recording, and every offence in sections 13A to 13D, whether observing, publishing or possessing, turns on that word: an actual recording, not an image that was altered or generated afterwards. There is no coverage at all for an altered or AI-generated image. The Tasmanian Government itself acknowledged this on 5 July 2026, in an announcement reported by ABC News that it would become the last Australian jurisdiction to modernise its non-consensual-image laws, with draft legislation promised for consultation only by the end of 2026, meaning no Bill yet exists.

The Northern Territory sits in between. Its definition of an intimate image has covered an image altered to appear to depict since 2018, so distributing (section 208AB) or threatening to distribute (section 208AC) a deepfake is squarely covered. A standalone creation offence, section 208AAB, was added in 2023 and commenced 31 July 2024, but its operative verb is records or captures, camera language that may not extend to an image produced entirely by AI with no underlying recording. Whether it does has not been tested.

Getting an Image Taken Down: eSafety's Image-Based Abuse Scheme

Separate from all of the criminal offences above, the eSafety Commissioner runs a civil scheme under Part 6 of the Online Safety Act 2021 (Cth), aimed at getting an image down quickly rather than punishing the person who posted it.

The Act's own definition of an intimate image, in section 15, does not mention artificial intelligence by name the way the criminal deepfake provision does. It works instead through the phrase depicts, or appears to depict, private body parts or a private act. eSafety's own regulatory guidance removes any doubt about how that phrase applies in practice, stating that intimate images can include photos and videos that have been digitally altered, for example photoshopped images or deepfakes, and that an image falsely tagged with a person's name so people believe it shows them is also covered, even without any alteration to the image itself.

Section 75 makes it a civil contravention, not a crime, for an end-user to post or threaten to post an intimate image of another person without consent, where either person is ordinarily resident in Australia, punishable by up to 500 penalty units. The Commissioner can issue a removal notice under section 77 requiring a platform to take an image down within 24 hours, or a longer period the Commissioner sets, and an equivalent notice directly to the person who posted it under section 78. Failing to comply with a removal notice is itself punishable by up to 500 penalty units under section 80, and the Commissioner can also issue a remedial direction ordering someone to stop further sharing, with non-compliance again punishable by up to 500 penalty units under section 83. None of these tools require a removal notice to have been issued and ignored first; eSafety can go straight to a formal warning, an enforceable undertaking, an infringement notice, an injunction or a civil penalty order in court.

At the Commonwealth penalty unit value that applies from 1 July 2026, $364, the 500-unit maximum works out to about $182,000 for an individual. eSafety's own published guidance still quotes a $313 figure and describes it as applying until 30 June 2026; that reflects the rate current when the guidance was last updated in February 2024, and it has not been refreshed for the two rate increases since, so the guidance is out of date on this specific number. The current $364 figure comes from the Australian Securities and Investments Commission's own penalty unit table and the indexation formula in the Crimes Act 1914.

The scheme's most significant result to date is against Anthony Rotondo, ordered by the Federal Court to pay a $343,500 civil penalty, plus eSafety's legal costs, for 14 contraventions of the Online Safety Act by posting non-consensual deepfake nude images of six women between November 2022 and October 2023. Across 14 contraventions that works out to roughly $24,500 each, well under the per-contravention statutory ceiling, a reminder that a court does not automatically impose the maximum on every count.

Civil Options: Privacy, Defamation and Family Violence Protection

A deepfake victim's options are not limited to a criminal report or an eSafety complaint. Australia's statutory tort for serious invasions of privacy, in force since 10 June 2025, is a separate civil cause of action that can apply to this kind of conduct; see Australia's statutory tort for serious invasions of privacy for its elements, which this article does not repeat. A deepfake that falsely depicts an identifiable person can also be a plausible defamation claim in its own right; see Australia's defamation laws for how that framework works, a topic this article does not independently analyse and one that needs advice on the specific facts.

Where the person sharing or threatening to share the images is a partner or former partner, a state or territory family violence or personal protection order may also be available alongside any criminal report; see AVO and protection order laws across Australia for how those orders work by state.

A deepfake is sometimes made from an image or recording taken covertly in the first place. Whether that original recording itself broke the law is a separate question governed by state surveillance and listening device law, not the deepfake-specific offences above; see is it legal to record a conversation in Australia and CCTV and home security camera laws in Australia.

Real Cases: What Has Actually Happened in Court

Two real prosecutions illustrate the split between the criminal and civil tracks described above. R v William Yeates is a Commonwealth criminal matter, before the Adelaide Magistrates Court, over deepfake images created and posted to X in February 2025; it remains an active matter with acknowledged conduct but no sentence yet. Anthony Rotondo is a Commonwealth civil matter, a $343,500 Federal Court penalty under the Online Safety Act's image-based abuse scheme for deepfake nude images of six women. No state-level creation-offence prosecution, under Victoria's, South Australia's or New South Wales's new laws, had been reported as of publication.

For images of people under 18, including a teenager's own image, the position sits under each state's child abuse or exploitation material offences rather than the intimate-image provisions above; see sexting laws in Australia for the age thresholds and the narrow young-person defences that exist in only three states.

This article provides general legal information about deepfake and intimate-image laws in Australia. It does not constitute legal advice and does not account for your individual circumstances. Statutes referenced were verified against primary sources as at 18 August 2026 and are subject to amendment, particularly given announced but not yet enacted reform in Queensland and Tasmania. Consult a legal practitioner admitted in the relevant Australian state or territory, or contact the eSafety Commissioner or police directly, for advice on a specific incident.

Related reading: the Australia data privacy laws hub covers the wider privacy framework, including the 13 Australian Privacy Principles explained and how to make a privacy complaint in Australia.