United KingdomCreating, or Requesting the Creation of, Purported Intimate Image of Adult
In force since .
An AI prohibited practices rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Do not intentionally create an image that appears to be an intimate photograph or film of another adult without that adult's consent.
- Do not intentionally request the creation of such an image, or request that it include or exclude anything in particular, without that adult's consent.
- The request offence can be committed even if the image is never created, and regardless of where in the world the person making or receiving the request is located.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
On summary conviction, imprisonment for a term not exceeding the maximum term for summary offences (six months, rising to 51 weeks once Criminal Justice Act 2003 s. 281(5) is in force) or a fine, or both (Sexual Offences Act 2003 ss. 66E(6) and 66F(8), as inserted).
What it makes you log
Logging duty
Sections 66E-66H create the two intimate-image offences, the reasonable-excuse defence, the Secretary of State's post-legislative review of that defence, and a limitation period; none of this requires a person to keep or produce a log or record. Section 66F(6)(c) states the request offence is committed regardless of where in the world the persons concerned are located, so where the persons are does not decide whether the offence applies; the general venue rules for prosecuting it in England and Wales sit in other legislation.
- Kind
- None
- As of
What this law does
Section 138 of the Data (Use and Access) Act 2025 inserts new sections 66E to 66H into the Sexual Offences Act 2003.
Section 66E makes it an offence for a person intentionally to create a 'purported intimate image' of another adult without that person's consent, and section 66F makes it a separate offence intentionally to request the creation of such an image, or to request that an image include or exclude a particular thing, without consent; the request offence is committed regardless of whether the image is ever created, of whether it is also requested by someone else, and regardless of where in the world the requester or recipient of the request is located.
A 'purported intimate image' is an image that appears to be, or to include, a photograph or film of the person, but is not, or is not only, an actual photograph or film of them, and that appears to show an adult in an intimate state; a reference to an image expressly includes data stored by any means which is capable of conversion into an image, photograph or film.
Modifying an existing photograph or film of a person does not fall within the offence unless it adds an intimate element, or a person, not shown in the original. Both offences carry a defence of reasonable excuse, and the Secretary of State must review the operation of that defence and lay a report before Parliament within two years of commencement. Section 138 came into force on .
Since both offences are also priority offences under Schedule 7 to the Online Safety Act 2023, so a regulated user-to-user service's illegal content duties reach them, including the duty to mitigate the risk of the service being used to commit or facilitate either offence.
When LexLint raises it
When your app profile says your app generates images with AI or generates video with AI.
Back to the example · Lint your app
Page updated .