High-profile incidents have put AI identity theft on the global agenda. Deepfaked images of Taylor Swift and Scarlett Johansson's dispute with OpenAI over a voice that sounded uncannily like hers brought the issue to mainstream attention. For UAE residents, those cases raise a pressing question: what does UAE deepfake law actually say — and what legal recourse do victims have?
UAE Rights Against Deepfakes and Voice Theft
The UAE does not yet have a single, dedicated deepfake statute. Whether using someone's likeness without consent via AI constitutes a privacy violation under the UAE Civil Code remains a developing question. However, that does not leave victims without protection.
The UAE Cybercrimes Law (Federal Decree-Law No. 34 of 2021) and the UAE Penal Code together cover the most common deepfake and voice-theft scenarios. Charges may include defamation, cyber fraud, and invasion of privacy — each carrying meaningful criminal penalties.
Federal Law No. 45 of 2021 on the Protection of Personal Data (PDPL) adds a civil-law layer: it prohibits processing personal data, including biometric identifiers and voice prints, without explicit consent. This creates a separate avenue for victims seeking compensation rather than criminal prosecution.
In cases involving intellectual property — for example, a voice actor whose recordings are used to train an AI model without authorisation — the UAE Copyright Law may also apply, though the global debate over AI-generated output and IP ownership is still unresolved.
Penalties UAE Courts Can Impose
Legal experts note that UAE courts treat AI-enabled impersonation with the same seriousness as conventional fraud or defamation:
- Defamation via deepfake: Fines between AED 250,000 and AED 500,000, plus potential imprisonment. - Privacy breach (leaking private images or audio via AI): Minimum six months in prison and fines up to AED 500,000. - Cyber fraud using a fabricated likeness: Minimum one year's imprisonment and fines between AED 250,000 and AED 1 million per offence.
If you discover a deepfake or voice clone of yourself, document everything immediately — save links, screenshots, and communication logs with timestamps. Then report the matter to the local police directorate (Dubai Police, Abu Dhabi Police, etc.), which can transfer the case to the relevant public prosecution agency.
UAE Regulatory Efforts and the Road Ahead
The UAE is actively working to build a coherent legal framework for AI. The DIFC amended its Data Protection Regulation to address autonomous systems and AI-specific risks, while the UAE AI Strategy 2031 sets a national roadmap for responsible AI adoption across healthcare, government, transport, and other sectors.
In June 2024, the UAE Charter for the Development and Use of Artificial Intelligence outlined twelve ethical principles — covering algorithmic bias, data privacy, transparency, and human oversight — that are expected to inform future legislation.
Legal experts acknowledge that keeping pace with the speed of AI development is the central challenge. Recommended protective measures for any organisation handling personal data include encryption, anonymisation, strict access controls, and clear user consent mechanisms so people understand how their data is being used.
What This Means for UAE Residents
Despite the absence of a dedicated AI law in the UAE, residents are not defenceless. Existing criminal and civil statutes provide real avenues for justice when deepfakes or voice theft cause harm. The UAE leadership's strategic commitment to AI governance — including the AI Strategy 2031 and the DIFC's updated rules — signals that more targeted legislation is on the way.
The clearest takeaway is this: the UAE is already enforcing its existing legal toolkit against deepfake abusers while simultaneously building the nuanced regulatory architecture that AI demands.
