Deepfakes Force New Identity Rules — And Investigators’ Evidence Is on the Line

Nudification apps — tools that use A.I. to digitally undress people in photos — have been downloaded more than seven hundred million times. That's not a typo. Seven hundred million downloads of software designed to strip someone's image without their consent.

That number sits behind a wave of new laws now

That number sits behind a wave of new laws now rolling across the globe. Sixty-one privacy authorities from dozens of countries just endorsed a joint declaration targeting A.I.-generated deepfakes. Brazil's Digital E.C.A. law took effect on 03-17-2026, requiring every operating system and digital service accessible to minors to verify age — or face fines up to nine and a half million dollars per violation. Singapore passed its Online Safety Act defining "image-based child abuse" to include entirely generated or altered images. And three U.S. states have pushed legislation demanding age verification baked into operating systems themselves. This isn't just governments catching up to a scandal. It's regulators rewriting what counts as proof that a face — or an image of a face — is real. So what happens to investigators whose evidence depends on facial comparison when no one can tell a real photo from a fake one anymore?

Start with Brazil, because it's the most aggressive model on the table right now. Brazil's data protection authority published guidance walking through five distinct generations of age verification technology — from simple self-reported birthdate fields all the way to biometric and document-based identity checks. The law itself bans self-reported age entirely. Article nine says you can't just ask someone how old they are. Article twelve demands auditable verification. But then Article thirty-seven turns around and bans mass surveillance mechanisms. You have to verify identity rigorously, but you can't build a surveillance system to do it. That tension isn't a bug in the legislation — it's the central unsolved problem in every country trying to regulate this space.

Meanwhile, N.I.S.T. — the National Institute of Standards and Technology — revised its digital identity guidelines specifically to address deepfake fraud. Why? Because the Treasury Department's Financial Crimes Enforcement Network reported a jump in deepfakes being used to beat identity and authentication controls at banks. People were submitting synthetic faces to open accounts, pass verification checks, and move money. N.I.S.T.'s National Cybersecurity Center of Excellence then drafted a playbook for financial institutions adopting mobile driver's licenses for customer identity verification. Twenty-nine industry and government partners helped build it. The message to banks is blunt: the old way of checking a photo against a face on a screen doesn't hold up when the photo might never have been a real person.