That's You in the Photo, But the Event in the Image Never Happened: The Criminal Law Aspects of AI-Generated Obscene Content

A simple photograph taken from someone's social media account can be transformed into an obscene image within minutes. The person's face, body, voice, and facial expressions can be used in a way that is extremely realistic. However, the person in the image may not have consented to the creation of such an image, may not have appeared in the image, and may never have engaged in the sexual behaviors depicted.

AI-generated obscene content cannot be categorized solely as "fake images" or "montages." Depending on the nature and intended use of the content, it may constitute multiple offenses, including obscenity, violation of privacy, unlawful dissemination of personal data, defamation, blackmail, threats, and slander.

However, the fact that obscene content has been produced using artificial intelligence does not, in itself, mean that the same crime has been committed in all cases. In order to determine criminal responsibility:

• Whether the image represents an adult or a child,
• Whether or not a real person's face or voice is used,
• Whether the content was produced or also sent to others,
• Whether the content was used for the purpose of threat, blackmail or defamation,
• Whether the image is presented as if it were of a real person,
• How the content was obtained and published

They should be examined individually.

What is AI-generated obscene content?

AI-generated obscene content can be created using various methods:

• The process of placing a real person's face onto another body
• Artificially making a clothed photograph appear naked,
• Adding a person's face to a sexual image in which the person is not present,
• Altering body parts or movements in the actual video,
• Producing sexually explicit conversations by imitating a person's voice,
• Creating obscene images featuring entirely fictional characters,
• The use of synthetic characters resembling children in sexually explicit content.

The first legal distinction regarding this content should be made between deepfake content that uses the identity of a real person and content consisting entirely of fictional characters.

Using the face, voice, or other distinguishing features of a real person may lead to crimes against that person. However, in content consisting entirely of fictional characters, the provisions regarding obscenity under Article 226 of the Turkish Penal Code become more relevant.

The Crime of Obscenity under Article 226 of the Turkish Penal Code

Article 226 of the Turkish Penal Code defines the crime of obscenity not as a single act, but as a group of offenses consisting of different behaviors.

The article criminalizes acts such as showing obscene products to children, displaying, selling, distributing, advertising, and publishing such content in places where children can see it. Furthermore, harsher penalties are stipulated for obscene products that use children, images of children, or individuals who appear to be children.

Therefore, the use of artificial intelligence technology does not prevent the application of Article 226 of the Turkish Penal Code. What is essential from a legal standpoint is not whether the tool used is artificial intelligence or not, but rather the nature of the resulting product and the perpetrator's behavior regarding that product.

However, not every sexual or nude image is automatically considered obscene under Article 226 of the Turkish Penal Code. The content must be evaluated based on whether it severely violates public decency and morals, its presentation, accessibility, target audience, and whether any of the acts specified in the law have been committed.

According to the principle of legality of crimes and punishments, content cannot be criminalized simply because it is offensive or morally objectionable. The act must conform to the definition of a crime in the law.

Creating Deepfake Obscene Content About an Adult

If an adult's face is superimposed onto a pornographic image, the mere fact that the image was generated by artificial intelligence does not automatically constitute a single type of crime.

First, the following questions must be answered:

1. Was the image stored solely on the perpetrator's device?
2. Has it been sent to the victim or to third parties?
3. Has it been published on social media or a website?
4. Has it been claimed that this is a real image?
5. Was the money used to solicit sexual favors or other behavior?
6. Was the victim's actual photograph, voice recording, or private footage used?

The production of ordinary adult deepfake content solely for private use and without any sharing may not necessarily constitute a crime under Article 226 of the Turkish Penal Code. However, if the content is published through the press or the internet, shown to children, offered for sale, or if any of the other actions listed in the article are carried out, the crime of obscenity may be discussed.

If the content includes violence, animal abuse, the use of dead human bodies, or other serious behaviors specified in Article 226/4 of the Turkish Penal Code, then acts such as producing, storing, making available for use by others, and possessing the content are also punishable.

It is not necessary to use a real child in child-themed artificial content

One of the most serious legal consequences of AI-generated obscene content arises from the inclusion of images of children.

Article 226/3 of the Turkish Penal Code does not only cover content involving real children. The law explicitly states:

• Children,
• Representative images of children,
• People who look like children

It regulates that those who use substances in the production of obscene products will be punished. This act is punishable by imprisonment for five to ten years, as well as a judicial fine.

Due to this regulation, the use of child-like characters in sexually explicit content, even if entirely synthetically created using artificial intelligence, may be evaluated under Article 226/3 of the Turkish Penal Code.

In other words, the absence of a real child in the image, or the fact that no child is used in front of the camera during production, does not automatically eliminate criminal liability. The specific use of the terms "representative image of a child" and "person appearing to be a child" in the law allows for synthetic and artificial content to also fall within the scope of criminal offenses.

Article 226/3 of the Turkish Penal Code also regulates criminal liability for those who import, reproduce, sell, transport, store, export, possess, or make available to others these products.

Adding a photograph of a real child to an artificial image

If a real child's face or body image is transformed into obscene content through artificial intelligence, the application of Article 226/3 of the Turkish Penal Code becomes highly probable.

Using a real photograph of the child;

• Unlawful processing of a child's personal data,
• Attacks on a child's privacy and personal values,
• The production and storage of the image,
• Sending or publishing the content to others

This may require the assessment of more than one offense.

However, the mere creation of an artificial image does not, in every case, mean that the crime of child sexual abuse under Article 103 of the Turkish Penal Code has been committed. For Article 103 of the Turkish Penal Code to apply, concrete sexual conduct towards the child and the other elements specified in the article must be present.

However, if the child was forced to appear in a video, threatened, directed towards sexual behavior, or abused during a video call, Article 103 of the Turkish Penal Code, concerning blackmail, threats, and obscenity, may be considered together depending on the specific circumstances of the case.

Crime of Violating the Right to Privacy

Article 134 of the Turkish Penal Code punishes the violation of the privacy of individuals and the unlawful disclosure of images or sounds relating to private life. In the current text of the Turkish Penal Code, the acts of violating and disclosing the privacy of private life are subject to separate penalties.

The application of Article 134 of the Turkish Penal Code is clearer when a real sexual image is altered using artificial intelligence and then published. This is because the victim has a real, private image or audio recording, and this content is being disclosed, even if altered.

Conversely, the application of Article 134 of the Turkish Penal Code is more debatable when a person's publicly available facial photograph is superimposed onto a completely fictitious sexual image. In such a case, there is no actual private life event or real sexual image.

Since criminal law does not establish crimes through analogy or expansive interpretation, it may not be possible in every case to accept a completely synthetic image as a "real private life image.".

However, publishing synthetic content under the pretense that it reflects the victim's real sexual life constitutes a serious interference with the victim's sexual identity and privacy. In such a case, the offenses of defamation under Article 125 and data breach under Article 136 of the Turkish Penal Code may be more directly applicable.

Crimes under Article 134 of the Turkish Penal Code are, as a rule, subject to complaint, in accordance with the provisions of Article 139 of the Turkish Penal Code. However, crimes related to the unlawful disclosure or acquisition of personal data do not require a complaint.

Unlawful Use of Personal Data

A person's face, voice, name, image, and other characteristics that make the person identifiable constitute personal data.

Uploading a photograph taken from the victim's social media account to an artificial intelligence system, analyzing facial features, generating a new image, and sending this image to third parties should also be evaluated in terms of personal data.

Article 136 of the Turkish Penal Code punishes the unlawful disclosure, dissemination, or acquisition of personal data. Therefore, the publication of a victim's facial image combined with synthetic obscene content on social media may be deemed to fall under Article 136 of the Turkish Penal Code, depending on the specific circumstances of the case.

The fact that a photograph is found on the victim's public social media account does not mean that the image has been used without restriction. Permission to view the photograph is entirely different from consenting to be made the subject of an obscene deepfake content.

However, for the application of Article 136 of the Turkish Penal Code, it must be concretely determined which personal data was obtained by whom, to whom it was given, or through what medium it was disseminated.

The Use of Artificial Obscene Content for Insult Purposes

Sharing a deepfake image with the intention of damaging a person's honor, reputation, and dignity may constitute the crime of defamation under Article 125 of the Turkish Penal Code.

For example, a person's:

• She had an extramarital affair
• He produces sexually explicit content for money
• He/She engaged in certain sexual behaviors,
• He broadcast obscene content

Creating the impression that someone is being humiliated may warrant an assessment of the crime of insult.

Presenting artificial content as if it were real can increase the severity of the attack. If the image is shared on social media or in a group with a large number of people, the provisions regarding publicity and cumulative offenses may also be discussed depending on the specifics of the case.

However, for the crime of defamation to occur, it is not sufficient for the victim to simply be disturbed by the image. The content must contain a concrete act that is likely to offend the person's honor and dignity, or it must be of a vulgar nature.

Use for Blackmail and Threat Purposes

One of the most common uses of AI-generated obscene content is blackmail.

The perpetrator to the victim:

"I'll send this image to your family."

"If you don't pay me, I'll post it on social media."

"If you don't meet with me, I'll send it to your workplace."

They may send messages like this, demanding money, sex, new photos, or other benefits.

In this case, the crime of blackmail under Article 107 of the Turkish Penal Code comes into play. Whether the image is real or artificial is not a determining factor in the occurrence of the crime of blackmail. What is important is that the perpetrator attempts to obtain an unfair advantage by threatening to disclose something that would harm the victim's honor or reputation. The Turkish Penal Code regulates blackmail, threat, insult, and crimes against private life as separate types of offenses.

Even if the perpetrator hasn't yet shared the image, the crime of blackmail may have occurred if they have demanded money or other benefits. If the image is published later, liability may arise not only for blackmail but also for obscenity, defamation, and crimes against personal data or privacy.

Submitting a Fake Obscene Image to the Prosecutor's Office or Institution

AI-generated content may not only be published online. The perpetrator may use the fake image to:

• To the Public Prosecutor's Office,
• To the employer,
• To the school administration,
• To the disciplinary committee,
• To spouse or family members,
• To public institutions

By presenting this, they can create the impression that the victim has committed a crime or engaged in unlawful behavior.

If the perpetrator provides the image to the authorities as if it were real, with the aim of initiating an investigation or administrative sanction against the victim, the crime of defamation under Article 267 of the Turkish Penal Code may be invoked.

In this case, it must be proven not only that the image is fake, but also that the perpetrator knew the image was fake and intended to initiate unlawful proceedings against the victim.

If the image was obtained by accessing the information system

The photos or videos used in deepfake production are sometimes obtained not from the victim's publicly accessible account, but from a phone, cloud account, or social media account that has been illegally acquired.

If the perpetrator cracks the password, gains unauthorized access to the account, or copies images from the system:

• Unauthorized access to an information system, within the scope of Article 243 of the Turkish Penal Code
• Altering, destroying, or inserting data into a system, within the scope of Article 244 of the Turkish Penal Code,
• Obtaining personal data within the scope of Article 136 of the Turkish Penal Code,
• Violation of the right to privacy under Article 134 of the Turkish Penal Code

These crimes can be considered together. The Turkish Penal Code regulates unlawful access to an information system, as well as the alteration and transfer of data within that system, as separate crimes.

Will the AI ​​system or software developer be held responsible?

Artificial intelligence systems themselves cannot be punished. In Turkish criminal law, criminal liability belongs to natural persons. The liability of the software developer or platform administrator does not arise automatically simply because the tool could be misused.

For liability to arise, a person must:

• Contributing knowingly and willingly that content will be produced,
• Setting up the system to commit crimes against a specific victim,
• Acting in concert with the perpetrator,
• Deliberately facilitating the production or dissemination of criminal content

There must be concrete evidence demonstrating the intention to participate, such as the aforementioned.

The creator of a general-purpose artificial intelligence system is not automatically liable for the individual and unlawful use of the system by a user. Criminal liability is personal, and the perpetrator's intent must be concretely proven.

How should an investigation be conducted under the Code of Criminal Procedure?

In investigations into AI-generated obscene content, the primary goal is not just to find the image, but to uncover the entire production and distribution chain.

The following matters should be investigated by the public prosecutor's office:

• The device on which the content was originally produced,
• The artificial intelligence system used,
• The user account that carried out the production,
• Source photos uploaded to the system,
• Prompt and transaction history,
• The file's creation time,
• First sharing account,
• IP and session logs,
• The people to whom the content was sent,
• Fee or subscription payments,
• Previous communication between the perpetrator and the victim,
• Phones, computers, and cloud accounts where the content is stored.

The victim or their representative may request the collection of evidence, investigation of relevant accounts and devices, and expert examination under the Code of Criminal Procedure.

Searching and Seizing Phones and Computers

A search may be conducted under Article 116 and subsequent articles of the Code of Criminal Procedure if there is reasonable suspicion that evidence of a crime may be found in the suspect's residence, workplace, telephone, or other belongings. The search warrant or order must clearly state the act, the place to be searched, and the period during which the warrant is valid.

Telephones, computers, external hard drives, and other devices that constitute evidence of a crime or are subject to confiscation may be seized or kept in custody under Article 123 of the Code of Criminal Procedure. However, the physical seizure of a device does not mean that all the data contained within it can be examined without restriction.

Detailed search, copying, and analysis operations on computers and digital records are subject to the specific conditions in Article 134 of the Code of Criminal Procedure.

According to Article 134 of the Code of Criminal Procedure, there must be strong grounds for suspicion based on concrete evidence, and there must be no other way to obtain evidence. The urgent decision given by the public prosecutor must be submitted to the judge for approval within twenty-four hours. The article also stipulates that data must be backed up while processing the device, and a copy of the backup must be given to the suspect or their lawyer.

How should evidence be examined?

Determining whether an image was generated by artificial intelligence requires technical expertise. Therefore, an expert examination should be conducted under Article 63 of the Code of Criminal Procedure.

Depending on the nature of the incident, the expert panel may:

• Forensic IT expert,
• Image and video analysis specialist,
• Artificial intelligence or machine learning expert,
• Sound analysis specialist,
• If images of children are involved, the relevant experts..

It can be found.

The parties may also obtain a scientific opinion from an expert and submit it to the file within the scope of Article 67 of the Code of Criminal Procedure.

The following methods can be used in the investigation:

• Calculating the hash value of the file,
• Examining metadata information,
• Investigating re-encoding and compression traces,
• Comparing the harmony of light and color between the face and the body,
• Examining the anatomical consistency between the squares,
• Investigating AI watermarks or manufacturing information,
• Matching the source photograph with the generated image,
• Examining the production history in the artificial intelligence account,
• Searching for deleted files and project remnants,
• Comparison of sharing and upload times.

A conviction should not be based solely on the probability ratio provided by an AI detection program. The name and version of the program used, its margin of error, the analysis method, and the technical findings on which it was based should be explained in the report.

The Importance of the Original File and Hash Value

A screenshot provided by the victim may help show that the content was published; however, it is often insufficient for technical review.

If possible:

• Original image or video file,
• The phone containing the message,
• The link to the social media post,
• Sender account and number information,
• The file before it was downloaded

It must be protected.

Calculating the hash value upon file receipt helps verify that the file has not been altered during the examination. The examination should be performed on a forensic copy whenever possible, and unnecessary changes should not be made to the original device.

A matching hash value does not prove the image is authentic. It only indicates that the file has not been altered since it was received. A file generated by artificial intelligence from the outset can also be considered intact digital evidence.

Identifying the perpetrator is separate from determining that the image is fake

The expert's finding that the content was generated by artificial intelligence does not, in itself, prove who prepared the image.

In order to identify the perpetrator:

• Login records for the AI ​​account,
• IP addresses,
• Payment information,
• User email and phone information,
• The source files on the device,
• Prompt history,
• Sharing accounts,
• The perpetrator's messages to the victim,
• The times the file was first created and sent

They should be evaluated together.

The mere presence of the image on the suspect's device may not prove they are the creator. The possibilities of the file being automatically downloaded, sent by another person, or found on a shared device should be investigated.

Conversely, the presence of source photos, project files, production instructions, and initial sharing records on the same device can strengthen the link between the perpetrator and the content.

Illegally Obtained Digital Evidence

In criminal proceedings, the aim of reaching the truth does not permit the use of unlimited methods.

According to Article 206/2-a of the Code of Criminal Procedure, the presentation of evidence obtained unlawfully is rejected. Furthermore, according to Article 217/2 of the Code of Criminal Procedure, the alleged crime can only be proven with evidence obtained lawfully.

Because:

• Conducting unauthorized or unregistered digital searches,
• Examining the entire device in a way that is irrelevant to the subject of the investigation,
• Failure to document the copying and storage processes,
• Failure to protect data integrity,
• Misuse of third-party data that does not belong to the suspect

This could render the legality of the evidence questionable.

The court must examine not only what the digital content shows, but also the legal means by which it was obtained.

Including artificial images as evidence in the case file should not further harm the victim

Even if the image in question is fake, it creates a serious privacy and reputation problem for the victim. Therefore, the image should not be unnecessarily reproduced in the investigation and prosecution files.

Contents:

• It should only be shown to those who need to review it
• Avoiding the creation of unnecessary copies
• The expert report should avoid including explicit images that are not necessary
• Concealing personal information when necessary,
• The file should not be used for purposes other than its intended use

This is important for the protection of the victim.

Investigation procedures are, as a rule, confidential in accordance with Article 157 of the Code of Criminal Procedure. However, confidentiality cannot be applied in a way that eliminates the right of defense or prevents the parties from effectively participating in the technical examination.

Confiscation of Content and Devices Used

Under Article 54 of the Turkish Penal Code, a confiscation order may be issued for items used in the commission of a crime or constituting the subject matter of the crime.

The conditions for confiscation should be evaluated in relation to AI-generated obscene files, recording media, and devices used for criminal purposes. However, the fact that a phone or computer has been used in a crime does not, in every case, mean that the entire device will be confiscated.

The device's connection to the crime, its ownership, whether it belongs to a bona fide third party, and whether the confiscation is proportionate to the act committed should be examined.

Economic benefits obtained from the sale or use of the content for blackmail purposes may also be subject to confiscation of proceeds under Article 55 of the Turkish Penal Code. The Turkish Penal Code regulates confiscation of property and proceeds as separate security measures.

What should the victim's requests be during the investigation?

Individuals or their legal representatives who are victims of AI-generated obscene content should not limit their criminal complaint to merely seeking the punishment of the perpetrator.

Depending on the specific case, the following claims may be made:

1. Identifying the accounts where the content was originally produced and published,
2. Requesting IP, session, and user logs from the relevant platforms,
3. Taking the necessary steps to ensure that messaging and sharing records are not lost
4. Proper digital examination of the suspect's phones and computers,
5. Research into source photographs, prompts, project and production history,
6. A forensic computer expert should conduct an examination of the original file
7. Determining whether the image is real, synthetic, or partially altered,
8. Identifying the individuals and accounts to whom the content was sent,
9. If blackmail is involved, financial and communication transactions should be examined
10. Application of seizure and confiscation provisions regarding proceeds of crime and vehicles used in the crime,
11. The victim's request to join the case was accepted
12. Preventing the reproduction and dissemination of images outside of the file.

Conclusion

In cases of AI-generated obscene content, criminal liability cannot be determined solely on the basis of whether the image is fake or not.

Depending on the nature of the content:

• Obscenity under Article 226 of the Turkish Penal Code,
• Violation of the right to privacy under Article 134 of the Turkish Penal Code
• Unlawful dissemination of personal data within the scope of Article 136 of the Turkish Penal Code,
• Insult under Article 125 of the Turkish Penal Code
• Blackmail under Article 107 of the Turkish Penal Code,
• Threat within the scope of Article 106 of the Turkish Penal Code
• Defamation under Article 267 of the Turkish Penal Code,
• Cybercrimes under Articles 243 and 244 of the Turkish Penal Code

It may come up on the agenda.

In the case of images of children, it is not necessary for a real child to be present in the image, as the law explicitly uses the terms "representative images of children" and "persons who appear to be children." Synthetic images of children created using artificial intelligence can also lead to severe criminal liability.

Deepfake content related to adults requires a more careful evaluation. Not every synthetic sexual image automatically constitutes a violation of privacy or an act of obscenity. It is necessary to determine how the content was produced, what personal data was used, to whom it was sent, how it was published, and for what purpose it was used.

From a criminal procedural standpoint, the most important aspect is that digital evidence is obtained lawfully and in a verifiable manner. Seizing a phone or computer alone is not sufficient. It is necessary to preserve the original file, obtain hash values, create a forensic copy, investigate the production history, and have it examined by an expert witness.

Conviction cannot be based solely on the image being offensive or on an automated program's assessment of it as "artificial content." The criminal nature of the content, the perpetrator's intent, the chain of production and sharing, and the connection between the digital evidence must be established beyond any reasonable doubt.

Artificial intelligence can generate an image in seconds. However, in criminal proceedings, whether one person is the perpetrator and the other the victim must be based not on assumptions, but on legally obtained, scientifically examined, and debated evidence in court.