Consent, Not Nudity, Should Define Image-Based Abuse Laws

A photo of a woman sitting next to a man who is not her husband. A screenshot of a fabricated chat. A photo of a woman who normally covers her hair, without her hijab. None of these images contain nudity, but if shared without permission, our recent research shows that they can end a marriage, a career or even a life.

The stakes are highest in conservative communities, and while our research was focused on Pakistan and the Pakistani diaspora, we also found that these communities aren't confined to any one country or region. Yet nearly every law and policy created to combat image-based abuse would fail to recognize the circulation of these images without consent as abuse.

People are waking up to the realization that consent matters. That's why Meta was recently forced to pull an Instagram AI feature that let users generate images of anyone on Instagram without consent and without alerting the people whose photos were used. The backlash Meta faced wasn’t about nudification; it was about consent.

Laws in France and Denmark show that consent-based frameworks, whether that’s a right to your own image as they have in Denmark or or the right to privacy in France, can tackle image-based abuse. We believe that other countries should follow their lead.

As of January 2025, 110 countries had no law against image-based abuse, 67 countries had what are considered “sufficient” laws — meaning they align with Article 16 of the UN Cybercrime Convention — while 18 have laws that fall short of this standard, including the United States and Japan. While the increasing number of countries passing legislation protecting citizens against image-based abuse is a positive development, it is important to reflect on the limitations of such legislation.

Almost all current laws treat “intimate image-based abuse” as the only form of image-based abuse. What is defined as intimate falls under traditional Western perception of intimacy: nudity and sexual content. Yet, as highlighted in Chayn’s latest research on image-based abuse, for many women harm can also happen from the non-consensual sharing of non-explicit images.

While our research focused on the stories of Pakistani women and the Pakistani diaspora, women from all backgrounds can be affected by non-explicit image-based abuse. The story of Charlotte Hooper, in the UK, is one example: a man who was stalking her posted her selfies — none of which were intimate or nude images — onto pornographic websites where men were encouraged to make explicit comments about her images.

The Grok case on X exposed the limits of legislation built around "intimate" images. After a wave of nonconsensual sexualized edits, X said it had added measures to stop Grok from putting real people into "revealing clothing such as bikinis," but only geoblocked that editing in jurisdictions where it is illegal, leaving it available everywhere else. And even where it is restricted, the tool could still be prompted into sexualized edits by asking for "revealing summerwear" or a crop top instead of a bikini. Labour MP Jess Asato became one of the targets after she publicly condemned Grok in January 2026; users generated a fake image of her in a bikini and a video depicting her being chloroformed and prepared for a sexual assault.

Examples of consent-based frameworks already exist. In France, people’s right to their own image is part of the right to privacy. Articles 226-1 and 226-8 of the French criminal code prohibit the publication of a picture of a person without their consent or the creation of AI-generated deepfakes identifying a person without their consent. Violating those laws can lead to a fine of up to 45,000 euros and up to a year in jail (two years for the sharing of deepfakes). The punishment is harsher (60,000 euros and up to two years in jail) if the perpetrator is a former husband or partner.

The law requires that the person who shares the picture or the video has the written consent of the person on the picture or video.

In the case of a photograph taken in a private location (lieu privé), the sole criterion for requiring consent is whether the person depicted is identifiable. It is important to note that French law adopts a broad interpretation of what constitutes a private location. The French administration cites, for example, holiday photographs, family gatherings, sporting events, and cultural events as situations that fall within this category. Therefore, a photograph taken at an exhibition opening or during a football match would require the written consent of any identifiable person appearing in the image.

In the case of a picture taken in a public space (e.g., in the streets), there are two criteria for requiring consent: the person must be isolated AND identifiable. The law therefore does not prevent people from taking pictures of crowds in the streets as long as those images do not single out any individual who would also be identifiable.

When seeking consent to share an image, the person seeking to share it must be clear about how the image will be used. Where will it be shared? For what purpose? For how long? If someone obtains consent to share an image on a Facebook group but goes on to use that image for an advertising campaign, the consent would be null and void.

A consent-based framework isn’t just an abstract principle in France, it is something they are operationalizing. The French Minister of Economy publishes a set of recommendations for anyone seeking to publish or share a picture. For instance, they advise using pictures without identifying individuals where possible if the individuals do not serve a specific purpose; they warn against the risks of blurring faces, as other elements can identify a person (citing specifically: context, name tags, tattoos…); and they offer recommendations on how to store the consent obtained.

Passed in 2024, Article 226-8 specifically addresses the question of AI-generated deepfakes. The article bans the sharing of fabricated content done using the voice or picture of a person without their consent if it is not obvious that the picture is manipulated or if it’s not clearly labeled as manipulated media.

The fear of AI-generated deepfakes is also what prompted Denmark's changes to its copyright legislation, expected to come into effect this year. It will give citizens copyright over their own image and likeness, as well as their voice, in the context of AI-generated material. Therefore, creating AI deepfakes of an individual that looks like them without their consent could constitute a copyright violation.

While the amendment to the copyright legislation has received overwhelming support in Denmark and in the Danish parliament, at the EU level some argue that it could raise issues at a transnational law level, as it radically departs from the traditional understanding of copyright law that applies internationally. Copyright is indeed traditionally granted to content creators, not those appearing in the content.

A key concern around granting people a right to their own image is the fear that it could infringe on freedom of expression. Both the French and Danish legal frameworks address this concern with provisions specifically designed to prevent these laws being abused to curtail freedom of expression.

In France, the law states that obtaining consent from a person in a picture is not necessary when:

• An image pertains to a news event or a public demonstration, and is subject to the right to information and artistic freedom.
• It is the image of a public figure exercising their duty (e.g. an elected official) and the intention of the image is to inform the public
• The image has historical value.

In Denmark, one of the subsections states that the amendment “does not include imitations that are mainly expressions of caricature, satire, parody, pastiche, criticism of power, criticism of society, etc., unless the imitation constitutes misinformation that can specifically cause serious harm to the rights or essential interests of others.”

The cases of France and Denmark show that these laws can exist and can take different forms to adapt to the relevant legal framework of countries seeking to make lack of consent the threshold for what is considered image-based abuse. The copyright law in Denmark is not yet in force and France does not release exact numbers regarding the numbers regarding convictions under its privacy laws. However, it is important to stress that those legal frameworks can serve a purpose beyond the strict boundaries of criminal justice.

Currently, our research suggests that the reporting pathways of tech companies are often the first and only avenue of redress that survivors will use, and survivors primarily seek to see their content taken down. At the moment, tech companies offer little to no remedy when it comes to non-explicit image-based abuse, as those images do not violate tech company policies. However, we believe that the spread of consent-based legislation on the right to one’s own image can create a dynamic that will encourage companies to adopt it in their global policies. Thus, rather than offering geo-locked regulations specific to certain legal frameworks, we would like to see a shift in their takedown policy from "is it explicit?" to "was there consent?"

As the cases of France and Denmark show, there is no “one-size-fits-all” consent-based legislation that guarantees people a right to their own image. We believe that legislative change is most effectively achieved when those changes are integrated into the currently existing legal framework. France has a historically strong right to privacy and the right to one’s own image naturally emerges from it. This approach could work for other countries with similarly strong privacy legislation, such as Germany. Denmark chose the path of copyright law and when the law is implemented, time will tell if it was the right approach. However, other countries could choose other approaches. Some, including the UK and Pakistan, have recently passed online safety legislation that could be amended to offer a consent-based right to one’s own image.

While legislative approaches will differ, what matters is the principle that individuals should have meaningful control over the creation, sharing, and manipulation of images that identify them. Until states and companies recognize that any identifiable image shared without consent can become a tool of coercion and abuse, millions of survivors will remain outside the protection of both legal systems and the platforms that shape modern public life.