Deepfakes Guidelines: Mitigating Risks While Fostering Innovation

Executive summary

This document provides comprehensive guidelines to address deepfake implications and mitigate associated risks by emphasizing ethical principles of privacy, transparency, accountability, and social benefits for developers, creators, regulators, and consumers. Deepfakes are computer-generated synthetic media using deep learning that manipulate audio, video or other digital content, originating from generative adversarial networks in 2014 and using advanced algorithms such as autoencoders, convolutional neural networks, recurrent neural networks and face swap systems, with progressive technological expansion increasing access, reducing costs and creation speed. While deepfakes have legitimate non-malicious applications such as image generation, training simulations, audio dubbing and advertising, they pose serious threats through malicious applications including explicit material, financial scams, political manipulation, voice cloning, corporate espionage, misinformation, fraud and diminished trust in media, requiring development of policy, regulatory tools and technical countermeasures to protect information integrity, individual reputation and public safety.

Malicious and non-malicious deepfakes

Individuals whose likeness is used in deepfakes must provide explicit consent, and deepfakes must be created and used for constructive purposes like education and entertainment following comprehensive ethical guidelines with independent monitoring, not for harmful purposes like imposter scams, non-consensual manipulation, or disinformation campaigns. Malicious deepfakes are AI-generated content designed to deceive or harm without transparency or consent, while non-malicious deepfakes are AI-generated media created for legitimate purposes with clear disclosure and explicit consent. This guideline addresses deepfake technologies' implications and risk mitigation for technology developers, content creators, and consumers, covering definitions, awareness raising, ethical principles, consumer education on identifying harmful deepfakes, and guidance for regulators against emerging threats including synthetic audio scams and AI-generated virtual environments.

Risk mitigation and accountability

Developers must adhere to ethical standards, safeguard personal data, prevent misuse, enable content authenticity verification, and comply with data privacy laws including GDPR, CCPA, Saudi Arabia's PDPL and Anti-Cyber Crime Law, through robust data protection, privacy by design with anonymization and minimal data retention, consent management systems allowing individuals to request removal of their likeness from training datasets, comprehensive machine-readable AI model documentation, explainability features, watermarking and cryptographic security measures, regular impact reports, bias elimination, human oversight, role-based access governance with audit trails, and automated detection of unauthorized or unethical use; organizations must ensure applications benefit society and deploy machine learning to detect suspicious activity patterns and inauthentic accounts. Content creators must use deepfake technology responsibly in compliance with laws while respecting social norms, protecting personal data to prevent fraud, impersonation and defamation, employing end-to-end encryption, multi-factor authentication, strict access controls, and obtaining explicit consent before using individuals' data with maintained encrypted consent records and informed notice of usage purposes and risks; they must apply visible automated watermarks and maintain detailed production documentation covering data sources, algorithms and tools, and apply tamper-resistant watermarks to all deepfake content. Personal data must be used exclusively as specified in consent agreements with any different use requiring new explicit permission, individuals can terminate consent at any time through a simple mechanism after which data must no longer be used and must be completely removed if requested.

Distribution and integrity verification

Content creators must comply with deepfake regulations, develop and regularly update ethical and technical guidelines, distribute through secure channels with digital rights management and secure content delivery networks, use cryptographic hashing and blockchain for immutable content records, and disclose deepfake use through visible disclaimers and metadata labeling. Regulators must require platforms to implement reporting mechanisms prioritizing high-risk cases in finance, politics, and impersonation, conduct risk assessments and establish formal approval processes before commercial deployment, enforce standards including those from the Coalition for Content Provenance and Authenticity, require proportional penalties scaled by intent and impact with reduced penalties for minimal or incidental uses, require annual government reporting on deepfake use, conduct regular independent audits, maintain annual inventories of government use, and provide mandatory updated training. Regulators and governments should collaborate with organizations like EndTAB, launch public education campaigns on deepfakes and their safeguards, implement annual reporting on employee training programs, and require all relevant government staff to take annual refresher training.

Incident response and victim support

Consumers can use AI-based detection tools including pixel analysis, motion inconsistency identification, audio-visual synchronization checking, and open-source tools like Deepware Scanner and Sensity AI, and verify content authenticity through metadata analysis, digital watermarking, content authenticity platforms like Adobe Content Authenticity Initiative, and blockchain technology to trace content origin and modifications. Victims of deepfakes should document evidence, identify the malicious use type, report to the platform where shared and to local law enforcement through the Kollona Amn app or Cybercrime Unit, and in cases of financial fraud or identity theft also report to the Saudi Central Bank and their bank; they should seek guidance from lawyers experienced in digital rights and data protection, engage digital forensics experts, implement enhanced security measures such as stronger privacy settings and two-factor authentication, and reference the Personal Data Protection Law, Anti-Cyber Crime Law, and Criminal Code, with the CST and Bureau of Investigation providing technical support during investigations. Individuals should familiarize themselves with distinguishing features of deepfakes including unnatural facial movements, lighting and shadow inconsistencies and audio mismatches, and organizations particularly in media sectors should establish verification processes using artificial intelligence detection systems and qualified professionals supported by tools checking file metadata, expert digital forensics analysis, comparison with official sources and digital watermarks, with ongoing education in artificial intelligence and cybersecurity fields strengthening capacity to recognize and respond to deepfake risks.

Education and healthcare sector applications

Deepfake technology has positive applications in Marketing, Entertainment, Retail, Education, Healthcare and Culture sectors when applied ethically, including personalized advertisements and dynamic content with explicit documented consent, virtual try-ons and investor pitches, interactive learning content and virtual tutors, medical training simulations and health campaigns, and preservation of endangered languages and cultural events. Users must obtain documented consent from individuals whose appearance or voice is used, provide clear disclosure that content is synthetic media, not misrepresent product appearance or functionality, avoid invasive personalized advertising, ensure education content is accurate and culturally respectful and does not spread false information or substitute for real teachers, and ensure healthcare content does not generate misleading medical advice or simulated outcomes that could give patients false hope or unwarranted fear. Deepfakes must not inaccurately portray cultural practices, figures or events, and must not exploit cultural heritage commercially without proper permission and community benefit.

Public awareness and education

Ethical deepfake deployment requires developers to include content authentication mechanisms, creators and developers to obtain consent and maintain transparency, and consumers to verify authenticity through awareness campaigns and education. End-users require semi-annual workshops covering deepfake creation, detection techniques, ethical and legal considerations, and hands-on detection tool training with annual refresher courses and special sessions after major technological or regulatory changes. Government officials should participate in quarterly workshops and bi-annual hands-on detection training to understand deepfakes and respond effectively to threats, while developers should engage in monthly technical webinars and bi-annual intensive workshops covering AI algorithms, machine learning, responsible creation and detection, ethical AI practices, and integration of detection tools into software solutions.

Deepfake harmful scenarios

These guidelines address deepfake risks through illustrative cases of harmful uses (voice cloning scams, non-consensual synthetic images, manipulated audio) and beneficial applications (personalized advertising, film production, voice reconstruction for ALS patients), requiring a consent form that specifies purpose, lists data types (photographs, video, audio), defines scope and duration, discloses risks, uses only minimum necessary data, ensures secure storage accessible only to authorized personnel, and grants individuals the right to withdraw consent at any time. The guidelines will be regularly reviewed based on periodic input from participating organizations to assess difficulties and identify necessary revisions, continuously monitoring emerging threats and changing industry standards.