UK AI Consent and Misuse Bill

Overview

The Artificial Intelligence (Consent and Misuse) Bill is a proposed United Kingdom Private Member's Bill concerned with the generation, recreation, or imitation of a natural person's likeness using, or with the assistance of, artificial intelligence. Its central objective is to establish consent as a legal prerequisite for this activity. The proposal combines protection of individual identity with civil remedies, criminal offences, and statutory duties on providers of artificial intelligence tools to prevent misuse.

The bill is a Presentation Bill introduced in the House of Commons by Dawn Butler MP on 20 October 2026 under Standing Order No. 57. Presentation Bills are formally introduced without a substantive debate at First Reading. A Second Reading is scheduled for 27 November 2026. The parliamentary bills service identifies it as record 4310; no bill text or printed bill number has been published yet. The proposal addresses concerns surrounding non-consensual synthetic media, deepfakes, unauthorized voice cloning, and digital impersonation.

Definitions and Scope

The proposal concerns a person's likeness and its generation using or with the assistance of AI. This formulation encompasses the distinction between fully synthetic media and material created through a combination of existing recordings, images, human editing, and generative tools. The central policy question is whether an identifiable person's characteristics may be reproduced without that person's permission, rather than whether every element of the output was produced automatically.

In ordinary usage, likeness can involve facial imagery, recognizable physical features, distinctive movements, digital avatars, or vocal characteristics. Such examples explain the forms that digital imitation can take; they are not statutory definitions or a determination of the bill's treatment of living and deceased persons. Relevant technologies include generative models, neural networks, image and video synthesis, and voice synthesis software.

Consent also has an established meaning in UK data protection law. Under the UK GDPR, consent must be freely given, specific, informed, and unambiguous. This provides an important legal context for processing personal images, recordings, or identifying features. Permission to collect an image, permission to train a model, and permission to publish a synthetic replica are distinct practical questions. A consent-based likeness framework concerns the authorization of the relevant use, not merely possession of the underlying material.

Governance and Institutional Framework

The bill's stated architecture combines individual enforcement through civil remedies with responsibilities placed on AI providers. These are different forms of accountability: a civil remedy addresses a person's injury or unlawful interference, while a provider duty concerns the operation of a technology service and the prevention of misuse. Criminal offences introduce a further public enforcement dimension for prohibited creation or dissemination.

The wider UK institutional setting includes the Information Commissioner's Office for personal data protection, Ofcom for regulated online services under the Online Safety Act 2023, and the Competition and Markets Authority for competition and consumer protection. Their existing responsibilities form relevant regulatory context; the bill's general objectives do not themselves allocate new functions to these bodies.

Existing civil justice mechanisms include proceedings in the High Court and County Courts, subject to applicable jurisdiction and procedural rules. Injunctions, removal requests, and damages are familiar mechanisms in disputes involving unlawful disclosure, misuse of personal information, and reputational or economic harm. Provider governance can also involve internal reporting channels, escalation arrangements, technical safeguards, and procedures for responding to complaints. These practices illustrate how prevention and redress can interact without constituting a prescribed institutional structure for this proposal.

Key Focus Areas

The principal focus is prior consent for AI-assisted generation of a person's likeness. The issue arises in commercial advertising, creative production, entertainment, consumer applications, and non-commercial sharing. A person's identity can be used to attract attention, imply endorsement, impersonate a speaker, or create a misleading depiction. The bill's stated objective addresses unauthorized likeness generation as a distinct concern rather than treating every case solely as a copyright or contractual dispute.

A second focus is the creation and dissemination of unauthorized synthetic likenesses. Non-consensual intimate deepfakes, deceptive political material, and fraudulent impersonations illustrate different risks associated with synthetic media. These categories involve differing legal interests, including privacy, autonomy, reputation, electoral integrity, and protection against fraud. Their relevance to the policy problem does not establish separate offence elements or exemptions under the bill.

A third focus is prevention by providers of AI tools. Content filtering, provenance tracking, digital watermarking, user authentication, and abuse-reporting systems are examples of technical and organizational controls relevant to that objective. Traditional remedies such as passing off and breach of confidence remain part of the broader legal landscape, but depend on their own legal requirements. A specific consent-based proposal seeks to address personal likeness directly, including circumstances in which a private individual has no commercial goodwill to protect.

Implementation Framework

A consent-oriented operational framework requires organizations to distinguish authorization to upload material from authorization to synthesize or distribute a recognizable likeness. Practical consent management can include records identifying the person depicted, the permitted use, the party granting permission, and the duration or limits of that permission. Facial photographs, voice samples, and training datasets present different verification challenges, especially where the submitting user is not the person represented.

AI developers, deployment platforms, and corporate users can assess likeness-related risk at several stages: data collection, model training, user input, generation, publication, and subsequent complaints. Input screening can identify requests to impersonate named individuals. Output analysis can help identify prohibited material, while authentication and access controls can support investigation of misuse. These are possible implementation measures, not specified technical obligations under the bill.

Trust and safety arrangements can also include visible labels, machine-readable provenance information, visible or invisible watermarks, and accessible notice-and-takedown procedures. Metadata may assist users and platforms in recognizing synthetic content, but does not itself establish consent. Similarly, verification of a user's identity does not prove authority to reproduce someone else's likeness. Effective implementation therefore separates identity checks, permission checks, disclosure measures, and remediation procedures. Services operating in or targeting the UK market can use these distinctions when assessing the proposal's potential operational relevance.

Monitoring and Evaluation

Monitoring likeness-related misuse can involve structured records of complaints, prompt blocking, generated-content reviews, takedown actions, and system security assessments. Such information helps a provider evaluate whether its safeguards identify recurring abuse and whether complainants can obtain timely responses. Record keeping also supports the reconstruction of events when an affected person challenges the generation or distribution of a synthetic likeness.

Useful evaluation measures include the speed of complaint handling, the frequency of repeated misuse, the reliability of consent records, and the effectiveness of controls against unauthorized impersonation. Blocking rates alone are insufficient: a high rate may reflect extensive abuse, overbroad filtering, or both. Evaluation should distinguish detection performance from the actual reduction of harm and account for the privacy implications of collecting additional verification data.

Parliamentary scrutiny and post-legislative review provide a broader setting for examining legislation's practical effects. Technology-related scrutiny can involve the Science, Innovation and Technology Committee and other committees within their respective remits. Relevant policy questions include the effectiveness of consent standards, access to civil redress, effects on innovation and domestic investment, and the ability of technical measures to reduce abusive deepfake production. These are evaluation considerations rather than a designated monitoring programme established by this bill.

Penalties, Liability, and Appeals

The bill proposes civil remedies for unauthorized AI-generated likenesses and criminal offences relating to their creation and dissemination. Civil and criminal liability serve different functions. Civil proceedings generally concern enforceable rights and remedies for the affected person; criminal proceedings concern conduct prohibited by law and sanctions imposed following the applicable criminal process.

In the wider civil law context, remedies can include interim or final injunctions, orders requiring action or restraint, and compensation where the relevant cause of action permits it. Economic loss, reputational injury, distress, and deliberate commercial exploitation can raise different remedial questions. These examples explain the potential significance of a civil-remedies objective without specifying which remedies the bill creates or who may be sued under it.

Criminal offences require defined elements, including the prohibited conduct and any applicable mental element. Intention, recklessness, fines, imprisonment, public-interest considerations, and artistic or parodic expression are matters that can arise in criminal and expression-related legislation; they are not stated here as provisions of this bill. Appeals in UK proceedings depend on the court, jurisdiction, procedural route, and applicable permission requirements. Existing routes can involve the High Court, Court of Appeal, and Supreme Court, but do not create an automatic entitlement to appeal through every level.

Relationship to Other Instruments

The UK GDPR and the Data Protection Act 2018 provide the principal domestic framework for personal data processing. Identifiable images and voice recordings can constitute personal data. Biometric data processed for the purpose of uniquely identifying a person is subject to special-category rules; not every photograph or recording is automatically special-category biometric data. AI synthesis raises questions about the use of personal features, lawful processing, purpose limitation, and the relationship between data processing and the resulting depiction.

The Online Safety Act 2023 establishes duties for regulated user-to-user services and search services concerning illegal content and other specified risks. Its platform-focused framework is relevant to dissemination and complaint handling. A proposal focused on likeness generation and consent addresses a related but distinct point in the production and distribution chain.

The Copyright, Designs and Patents Act 1988 is relevant to protected works and performers' rights. Reproducing a recording, copying a protected work, and generating an imitation of a person's voice or appearance are not identical legal acts. Commercial exploitation of a persona therefore requires careful separation of copyright, performance rights, privacy, data protection, and any specific likeness rights.

International Alignment

The bill forms part of a broader international policy discussion about synthetic media, digital replicas, and individual control over recognizable identity. United States examples include the federal NO FAKES Act proposal, available through Congress.gov, and California measures concerning digital replicas and election-related synthetic media. These initiatives address different subject matter and should not be treated as interchangeable consent regimes.

California AB 2602 concerns contractual provisions relating to digital replicas of an individual's voice or likeness. California AB 2839 concerns materially deceptive election-related content. Their official texts are available from the California Legislature for AB 2602 and the California Legislature for AB 2839. Together, these examples show the distinction between performer protection and responses to deceptive political communications.

The EU AI Act, Regulation (EU) 2024/1689, includes transparency requirements for certain AI-generated content and deepfakes, including machine-readable marking obligations for relevant providers and disclosure duties for relevant deployers, subject to the regulation's scope and qualifications. Transparency identifies synthetic origin; consent addresses authorization to reproduce a person's likeness. The UK proposal's combination of civil remedies, criminal offences, and provider duties represents a different regulatory emphasis within this international landscape.

Implementation Timeline

Compliance Planning Checklist

These measures are operational preparation options for a consent-based regulatory approach, not an enacted compliance checklist or a statement of technical requirements imposed by the bill.

Sources and References