pleenk
Book a demo
← Blog
pt-brfresende

AI content and deepfakes: the consent the AI Act requires from your adult platform from 2 December

Published 11 November 20267 min readBy Pleenk Approve

Your product team has an idea that creators love. An AI tool would generate photos and short videos "in their likeness", with no new shoot. Creators would save time, and your subscribers would get more content. But one question comes up fast in the meeting: what if someone uses the tool with another person's face?

In Europe, that question now has a legal answer. The short answer: the AI Act is the EU regulation on artificial intelligence. From 2 December 2026, it bans AI that creates realistic intimate images of an identifiable person without their consent. That consent must come from the person depicted. It must be freely given, specific, informed, unambiguous and explicit. A box ticked by the uploader is not enough.

For an adult platform, this covers two situations. You offer an AI tool to your creators. Or you host AI content made somewhere else. In both cases, the key question is the same: who appears, and did that person say yes?

What exactly changes on 2 December 2026?

The EU amended the AI Act through a so-called "omnibus" regulation, Regulation (EU) 2026/1744. The European Parliament adopted it on 16 June 2026, and the Council on 29 June. It was published in the EU's Official Journal in July 2026.

The regulation adds two bans to the list of prohibited AI practices. The first targets systems that create or alter realistic images, videos or audio showing the intimate parts or sexual activity of an identifiable person. The ban applies when that person has not given freely given, specific, informed, unambiguous and explicit consent. The second targets child sexual abuse material, with no consent exception at all.

Both bans apply from 2 December 2026. They cover three acts: placing the tool on the market, putting it into service, or using it.

This deadline is short. Yet the same text pushes back other AI Act deadlines. Lawmakers clearly made AI "nudify" tools a priority.

Is your platform affected?

It depends on your role. The AI Act separates the provider, who develops or puts the tool into service, from the deployer, who uses it.

If you offer an AI tool to your creators, you are on the front line. For providers, the ban does not only cover tools built to create these images. It also covers tools that can do so in a foreseeable and repeatable way, without adequate safeguards. A generator that works "in the creator's likeness" clearly falls into that frame. So the real question is this: do your safeguards stop users from creating images of someone else?

If a creator uses a tool to make this kind of image, the creator is a deployer. The ban applies when they use the tool to create prohibited content, including by getting around its safeguards. Accidental creation is not covered.

If you only host content created elsewhere, the AI Act does not target you directly. But other rules take over. The Digital Services Act (DSA), the EU regulation on online services, requires you to receive reports and act on illegal content (Article 16). The EU directive 2024/1385 on violence against women asks Member States to punish sharing these fakes without consent. It must be transposed by 14 June 2027.

The AI Act has also had a transparency rule since 2 August 2026. Anyone who uses AI to create a deepfake must say that the content was generated or altered by AI (Article 50).

The penalties are heavy. A prohibited practice can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher.

Why must consent come from the person depicted?

Because that person suffers the harm, not the uploader. The AI Act is clear: the consent it requires belongs to the identifiable person who appears. A creator cannot consent on behalf of a former partner, a colleague or a celebrity.

This logic is not new for adult platforms. Since April 2021, Mastercard has required clear, documented consent from the people who appear in content. The network also requires proof of age and identity for every person depicted and every uploader. We cover these rules in our article on consent management for adult platforms.

With AI, the challenge changes. There is no shoot anymore, so there is no natural moment to sign. A single photo is enough to create content. Consent must therefore be collected before generation, not after a complaint.

One more point deserves your attention: consent can be withdrawn. The GDPR, the EU's data protection regulation, says consent can be withdrawn at any time (Article 7). A creator who closes their account or changes their mind must be able to stop the tool from using their image.

What we would do if we launched an AI tool tomorrow

Here are the decisions we would make before 2 December, in this order.

Limit the tool to verified creators. We would verify each creator's identity and age with a liveness check. This check confirms that a real person is in front of the camera, not a photo or a deepfake. Without it, someone can open an account with another person's face.

Only allow the creator's own likeness. By default, the tool only generates the verified person who holds the account. Anyone else who appears must have given their own consent, signed by them.

Collect a separate consent for AI. Agreeing to be filmed is not agreeing to be recreated by a machine. We would add a separate consent that spells out the uses: which content, on which platform, for how long.

Plan for withdrawal from day one. We would write down the process: who receives the request and how fast the tool stops using the image. We would also set out what happens to content already published. And we would measure the real delay.

Write the rule into your terms and enforce it. Your terms of service must ban AI content showing a person without their consent. They must also require an "AI-generated" label. The DSA asks you to apply your terms with care and in a proportionate way (Article 14).

Ban the person, not just the account. A creator who posts an intimate deepfake can come back under a new username. A ban tied to their verified identity stops that.

Keep a record of everything. Your moderation tool checks content before publication. Keep proof of each check and each decision. Sooner or later, your PSP (the payment provider that lets you accept card payments) will ask for it.

What if you do not offer an AI tool?

You probably already receive AI-generated content. Some creators make it with outside tools. The basic rule stays the same: every identifiable person must have consented.

In practice, we would ask creators to declare any content created or altered by AI. We would check that the person depicted is the creator, or someone who signed their own consent. We would handle deepfake reports first. And we would keep proof of each decision, for the PSP and for the regulator.

How Pleenk Approve can help

At the core of Pleenk is a single digital identity. Every creator, co-performer, agency or affiliate is verified with a liveness check. Pleenk encrypts their identity and stores it in a single wallet. The platform receives proof, never the ID document. Everything is linked to that wallet: their accounts, their consents, the bank account that receives their earnings and any bans. A person who appears in content does not need an account on your platform. They are invited, verified and sign their own consent through Pleenk. In their Pleenk space, they can see their consents and withdraw them. The withdrawal is sent to you, and Pleenk measures how long the content takes to come down. Moderation stays with your platform: Pleenk connects to your moderation tool and keeps proof of the checks. From Pleenk, you generate your report automatically and share it with your PSP in one click. To talk it through, write to us at contact@pleenk.com.

This article is for information only. It is not legal advice.

Sources

More articles
9 November 2026 · 8 min read
Human trafficking and cam studios: what a live streaming platform must check
6 November 2026 · 7 min read
Ofcom is investigating two adult services over non-consensual intimate images: what a PSP should ask its merchants
4 November 2026 · 7 min read
When an agency runs a creator's account: what your platform needs to control