Manipulating audio and video is no longer the preserve of editing experts. Artificial-intelligence tools now make it possible to generate fake clips, images, and voices that are hard to tell apart from the real thing — sometimes used to impersonate people, defraud individuals and companies, or damage reputation and extort. In the United Arab Emirates, the victims of such acts are not left defenceless: the UAE legislative framework provides multi-layered protection that criminalises digital forgery, electronic fraud, and attacks on personal data, and guarantees civil compensation for harm.

Deepfakes and AI Fraud: How Does UAE Law Protect You?

What Are Deepfakes and AI Fraud?

A "deepfake" is the creation or alteration of visual or audio content using artificial intelligence to show a person saying or doing something they never did. When coupled with an intent to deceive or harm, it turns into an offence punishable by law. Its most common forms are:

The UAE Legislative Framework for Protection

To date, no standalone federal law dedicated to "deepfakes" under that name has been issued; nonetheless, the protection exists and is effective, as several pieces of legislation combine to cover every form of these offences — from criminal sanction, to data protection, to civil compensation. This protection rests on four pillars:

Protection Under the Law on Combating Rumours and Cybercrimes

The Law on Combating Rumours and Cybercrimes is the cornerstone of confronting deepfakes and AI fraud. Most importantly for our purposes, it expressly criminalises the use of information technology to make any modification or processing of a recording, image, or scene with intent to defame or harm another person — this is the most precise legal description of the "deepfake" offence in its common form. The law also criminalises electronic fraud, fabricating fake websites and accounts, forging electronic documents, attacking payment instruments, extortion, and spreading rumours.

Protecting Your Biometric Data: Your Face and Voice Are Yours

The Personal Data Protection Law classifies the face image and biometric measurements among "sensitive biometric data" afforded heightened protection. The rule is that processing your personal data — including your image and voice — is not permitted except with your clear, explicit consent, save for specific cases set out in the law. When a deepfake system is fed your image or voice without your consent, that is unlawful processing entailing liability and accountability.

The competent authority may impose administrative sanctions on those who violate this law, alongside the criminal and civil liability arising from the act itself.

Civil Liability and Compensation for Harm

Alongside the criminal penalty, the Civil Transactions Law opens the door to compensation for the victim. The established rule is that any harm done to another obliges the wrongdoer to make good the harm, covering both material and moral damage. Because deepfakes affect reputation, standing, and private life, the moral harm suffered by the victim is compensable, in addition to direct financial losses such as sums extracted by fraud.

What to Do If You Are a Victim of Deepfakes or Fraud?

Legal References

Frequently Asked Questions