China's Deepfake Rules Just Rewrote the Evidence Playbook — And Investigators Have 18 Months to Catch Up

On 4-3-2026, China's internet regulator published draft rules that would require signed consent before anyone's face can be used to create an A.I. avatar or a deepfake. Every synthetic likeness would need a visible label. And minors would get extra protections on top of that.

That might sound like a story about China

That might sound like a story about China. It's not. It's a story about what happens to evidence — in courtrooms, in insurance claims, in any investigation that relies on a photograph of a human face — when governments around the world start demanding proof that an image was authorized and unaltered before anyone can use it. If you've ever taken a selfie, posted a photo online, or been captured on a security camera, your likeness is already floating through systems you never opted into. That reality just got a legal framework — and not just in one country. The E.U.'s A.I. Act takes effect in 8-2026, with its own requirement that all A.I.-generated content, including deepfakes, carry a clear label identifying them as artificially manipulated. In the U.S., the federal TAKE IT DOWN Act, signed in 5-2025, already makes non-consensual intimate deepfakes a crime and forces platforms to pull reported content within forty-eight hours. Three major jurisdictions, all moving in the same direction, all within about eighteen months of each other. So what does this convergence actually demand from the people who handle digital evidence every day?

China's Cyberspace Administration — the C.A.C. — laid out specific obligations in its draft. Anyone generating a synthetic likeness of a real person must first obtain that person's explicit consent. The resulting image or video must carry a prominent label marking it as A.I.-generated. And for children, the rules add a separate layer of safeguards. The draft was open for public comment through early May, so implementation details could still shift. But the direction is unmistakable. Consent isn't an afterthought anymore. It's a documented prerequisite.

Now, zoom out from Beijing and look at what this means inside a case file. For years, facial comparison workflows focused on one question — is the match accurate? Courts and prosecutors are adding a second question that carries just as much weight — can you prove this match was authorized and untampered? That's not a detection problem. It's a documentation problem. Federal evidence rules in the U.S. are already being amended to address deepfakes directly, shifting the burden of proof for any evidence suspected of A.I. fabrication or alteration. The assumption used to be that a photo was real unless someone challenged it. That assumption is dissolving.

For anyone running a facial comparison — whether

For anyone running a facial comparison — whether you're matching a suspect to surveillance footage or verifying someone's identity for an insurance claim — the new expectation looks like this. You document where each comparison image came from. Was it seized? Obtained with consent? Pulled from a public record? You record who authorized the use of each image. You verify whether any face in the comparison has been modified or filtered before analysis. And you track every single handoff of the digital file from the moment it enters your workflow to the moment it lands in a report. That's chain of custody applied not just to physical evidence, but to pixels. For someone who's never thought about this — if you've ever sent a photo to your insurance company after a car accident, or submitted a headshot for a background check, this is about whether the person on the other end can prove your image wasn't swapped, altered, or generated by a machine.

One story from the C.A.C.'s own reporting underscores why this matters beyond the courtroom. An elderly woman in China interacted with a digital avatar of her deceased son — a synthetic recreation of his face and voice, built with A.I. Without consent rules, anyone could build that avatar. Anyone could deploy it. And anyone could use it to manipulate someone who's grieving. That's not a hypothetical. It already happened.

There's a reasonable counterargument floating through the industry. Consent requirements could slow down legitimate investigations without actually stopping bad actors who create malicious deepfakes in the first place. If the documentation burden falls hardest on solo investigators or small agencies, adoption may lag even where the rules are crystal clear. That tension between accountability and speed isn't going away.