A control-based framework for allocating responsibility for non-consensual intimate deepfakes in the United States, the European Union, and Indonesia

Non-consensual intimate deepfakes (NCIDs) are frequently regulated as a problem of false information. This article argues that this framing obscures the wrong at stake and misallocates responsibility among those who build, use, publish, and host the tools and content. Combining doctrinal and functional comparative analysis of law in force on October 2, 2026, in the United States, the European Union, and Indonesia, benchmarked against the United Kingdom, South Korea, and Australia, with an integrative synthesis of empirical research on image-based sexual abuse, the article makes four contributions. First, it identifies five regulatory logics (morality, authenticity, autonomy, containment, and prevention), each answering a different question. Second, it theorizes a labeling paradox: disclosure that content is synthetic answers the viewer’s epistemic question but not the depicted person’s consent question, and authenticity criteria embedded in offense definitions may allow labeled content to escape liability. Third, it develops a control-based framework that separates contribution to harm, capacity to prevent it, and legal duty across creators, distributors, platforms, AI providers, and audiences. Fourth, it compares platform-direct, procedural, and state-mediated takedown architectures, showing that nominal deadlines are incommensurable because they run from different triggers. Indonesia emerges as a hard case: under the Criminal Code in force since 2026, NCIDs are prosecuted chiefly as pornography, private creation remains largely unregulated, and victims’ rights to deletion and restitution depend on whether the conduct qualifies as sexual violence. The article proposes consent-based, label-irrelevant reforms and an evaluation agenda that moves from counting removals to measuring remedy.