“The surprise was something I didn’t anticipate.”
That’s how L., a 21-year-old law student at the University of Hong Kong, describes her feelings upon realizing that another student had generated explicit images of her without her permission using artificial intelligence.
At first, she felt self-blame, questioning if she had somehow contributed to the misunderstanding.
“I was extremely shocked and quite scared at that moment, and I took a break from social media for a while, as I was uncertain who might have access to my images,” L. shared with CBC.
In February, over 700 images, which included AI-generated explicit content, were uncovered by the male student’s ex-girlfriend when she used his laptop, according to three of the alleged victims, L., B., and H. All three agreed to speak with CBC anonymously to avoid being identified by their peers.
The laptop reportedly held around 20 folders filled with women’s images, featuring screenshots from their social media profiles taken without consent, along with explicit AI-generated images depicting them in nude or sexual contexts, as stated by L., B., and H.
“Criminalization serves as a message to society that this behavior is fundamentally wrong.”B.
The three law students from HKU made the decision to go public with their story in July by establishing an Instagram account to share a letter outlining their experiences.
They revealed that following inquiries from his ex, the male student confessed to using images of the other students, which he had captured from social media, to generate explicit AI content featuring their faces.
H. mentioned that the University of Hong Kong initially requested him to write an apology letter, which he complied with, and subsequently issued him a warning letter to be retained in his personal file for internal purposes. H. felt these actions did not sufficiently hold him accountable.
B. indicated to CBC that she still had to encounter him in class at least four times after they reached out to the university.
Global Issue
The university later announced it was reviewing the situation and promised to take further measures. In a statement to CBC, a spokesperson for the University of Hong Kong confirmed that the case was still under examination.
John Lee, the head of the Hong Kong government, also commented on the case, promising in July to explore international “best practices” for regulating AI.
MrDeepFakes was the world’s most notorious website for non-consensual deepfake porn until CBC’s visual investigations team — along with partners Bellingcat, Tjekdet and Politiken — exposed the Canadian pharmacist who played a key role in the site.
However, months later, the three HKU students still feel a sense of unresolved issues. B. shared that their complaint to Hong Kong’s Equal Opportunities Commission has been dismissed, as the incident did not qualify as sexual harassment under the law, and there was not enough information to proceed with the investigation.
In a statement to CBC, the Equal Opportunities Commission affirmed its dedication to addressing inquiries and complaints under the anti-discrimination laws in an impartial, fair, and objective manner.
The three women informed CBC that they have not reported the matter to the police, given that Hong Kong lacks legislation criminalizing the creation of AI-generated pornography.
This incident highlights a global challenge regarding the regulation and policing of AI-generated explicit content produced without consent.
“Once [someone has] these images, you cannot predict how they might be utilized. They could be kept private or disseminated secretly or openly,” H. expressed. “You have no control over it.”
B. remarked that there’s also a possibility that the perpetrator’s device could be hacked, meaning that regardless of his intentions to keep the images private, there remains a risk they could be distributed widely.
“Criminalization sends a message to society that this behavior is fundamentally wrong,” B. added.
Addressing ‘Deepfakes’
In 2021, Hong Kong enacted legislation addressing the publication or threat of publishing intimate images or videos without consent, which includes “deepfakes,” defined as images or videos digitally altered using AI to swap one person’s face with another. The penalties for these offenses can reach up to five years in prison.
Nevertheless, this legislation does not encompass the creation or possession of such content. Legal experts argue this loophole needs to be addressed.
In Canada, sharing non-consensual deepfake pornography remains legal. Prime Minister Mark Carney promised to introduce a law to criminalize the “production and distribution of non-consensual sexual deepfakes” during his 2025 federal election campaign.
Last year, South Korea passed legislation criminalizing both the possession and consumption of such content. The United Kingdom has also classified the creation or distribution of sexually explicit deepfakes as a criminal offense following a rise in incidents in recent years.
“Nudify” applications typically employ AI to generate fake images of individuals without their consent. Victims of non-consensual explicit deepfakes include pop star Taylor Swift and U.S. Democratic politician Alexandria Ocasio-Cortez.
Clare McGlynn, a law professor at Durham University who contributed to drafting the U.K. legislation regarding pornographic deepfakes, informed CBC that social media platforms must enhance their efforts to combat the spread of deepfake pornography.
Clare McGlynn, a law professor at Durham University in the U.K., asserts that social media platforms must take stronger action to curb the spread of deepfake pornography. (Submitted by Clare McGlynn)
She indicated that the problem is becoming increasingly pervasive and highlighted the actions of San Francisco city attorney David Chiu, who initiated legal proceedings in August 2024 against 16 of the most-visited websites generating AI-based non-consensual explicit images.
According to his office, the websites involved in the lawsuit received over 200 million visits in the first half of 2024. By June of this year, his office reported that 10 of the sites were either offline or inaccessible in California. The attorney’s office identified some of the companies running the websites, including U.S.-based Sol Ecom and Briver, as well as U.K.-based Itai Tech Ltd.
McGlynn believes that if governments focus on larger platforms, they would not need to be as concerned about smaller ones.
“These are the gateways, the pipeline. It’s on TikTok. Boys see advertisements for nudify apps…. If we eliminate that, we could effectively tackle this issue,” McGlynn stated.
Material Becoming More Realistic
Vince Chan from the Hong Kong-based Association Concerning Sexual Violence Against Women noted that distinguishing AI-generated content is becoming increasingly challenging due to rapid advancements in technology.
For instance, he pointed out that in just the last two years, recognizing face-swapping in existing pornographic content has become more difficult.
“Glitches and distortions were more apparent [a few years ago], but now, the outcomes can appear very lifelike unless scrutinized closely,” he explained.
In the past year, Chan’s organization received 11 requests for assistance related to deepfake intimate images, marking a 38% increase compared to the preceding year.
Hong Kong’s privacy authority has initiated a criminal probe into the situation involving the University of Hong Kong law students. However, barrister Michelle Wong, who assists individuals affected by sexual assault and harassment, emphasized that the privacy commissioner’s authority is limited.
Hong Kong-based barrister Michelle Wong supports victims of sexual assault and harassment and notes that the privacy commissioner’s power to combat AI deepfake pornography is limited. (Submitted by Michelle Wong)
She explained that their main focus is on the disclosure or misuse of personal data, which complicates applying this case to their jurisdiction.
Wong mentioned that Hong Kong criminalizes the creation of fake images involving children under the age of 16, indicating that there is a framework addressing such offenses.
“I believe the original intent of the legislation is to protect children. However, it seems there is a growing argument that adults over 16 should also receive similar legal protections,” she asserted.
‘The Internet Feels Quite Lawless’
W., 30, who was a victim of AI-generated pornography approximately five years ago, chose to remain anonymous as she is unaware of the perpetrator’s identity. She recalls when friends sent her forwarded images they received via direct messages on social media, inquiring if they were of her.
“They believed it was real. I also thought it looked remarkably similar to reality in those images, including my facial features,” she told CBC, referring to a mole on her face.
W. mentioned that during that time, she cried daily and experienced nightmares. She avoided going to work, fearing to leave her home, worried that the individual who shared the images knew her whereabouts.
She also refrained from reporting the incident to the police, concerned about their sensitivity in handling her case.
W. suspected that the offender had taken images from her social media profile. Four years later, she still wonders about their identity and wishes they could be apprehended. She remains wary of unfamiliar men approaching her.
Although she appreciates the increasing awareness of AI-generated explicit content, she feels powerless about potential solutions.
“The internet feels quite lawless,” she stated. “Even if legislation is enacted, how it’s enforced remains a significant question.”