Agents, avatars, and deepfakes: how Guernsey can protect rights online

12 Jan

Last June, global media hailed Denmark’s proposed copyright law as the first time a European jurisdiction would give copyright protection to people’s face and voice. This laudable initiative was positioned as the first time a jurisdiction enabled deepfake victims to protect their own image using copyright law. What reporters missed, however, is that Guernsey had already got there. In 2012, Guernsey created a registrable property right in personality and its associated images, and with it the means of protecting identities at scale..

In this article, we look at the urgent policy reasons for image rights online, how these can be protected, the economic opportunities that arise from them, and the 2012 Guernsey Image Rights Ordinance - another illustration of the role CDOT jurisdictions can play in the global tech economy.

Digital rights : an open question

What is a person?

None of us exist entirely in any of ourselves. There is our embodied self, the flesh and blood creature typing or reading these words. There are the people we appear to be to the different individuals and entities around us - partners, siblings, friends, colleagues, children; there is also you as seen through the eye of state bureaucracy, a data broker, or Google. Then there are online personas - the varying representations of ourselves that we make on platforms such as LinkedIn, Facebook, or Instagram, Youtube, Rolox, or even OnlyFans. Some of these we control. Others we do not

The explosive growth of AI and the pervasive nature of digital systems means it is easier and easier to create online personas. Using AI, they can be generated from content aggregated and synthesized across the web. These may represent fake individuals, but they can also represent, or otherwise be based on, real, living, flesh and blood people. By now, most of us are familiar with deepfakes - realistic looking fake video content of people doing or saying things they never did in real life. Used for memes, fraud, and political deception, they are especially associated with pornographic uses. A proliferation of generative AI based ‘nudification’ apps enable people to upload a clothed photo of someone else, and to alter these photos to show them either unclothed or engaging in sex acts; all too often, these are then used to shame and humiliate people.

But what about other AI avatars - one we might even choose to create and use ourselves? AI agents are proliferating throughout commercial life. In the influencer and creator economy, agents can be trained upon the attributes or behaviours of an individual human, and used to automate their online activities. Much of this use is uncontroversial; creators on many platforms use them to automate chats with subscribers, similar to the customer services bots or consumer corporations.

Yet the potential goes further. As is so often the case online, porn and gaming point to the future. OnlyFans and competitor platforms such as OhChat allow for the creation of AI models. In some cases, these are digital twins of real-life creators, who license their likeness to the platform. As a result, ‘they’ are creating content and interacting with subscribers when they themselves are unavailable - travelling, resting, sleeping. This also happens in gaming, where AI agents can be used in similar ways. In gaming platforms some creators train agents based on their gameplay, and use these to keep playing when they are away from the computer. This has extended to streaming; at the time of writing, an AI powered vtuber has become the world’s most popular streamer on Twitch. The AI can chat with viewers, react to videos, and play games.

Seeing this, a new wave of companies proposes to automate the influencer economy as a whole through the creation of AI influencers. Creatify, for instance, markets itself as an AI influencer generator, enabling the user either to synthesise an influencer from prompts, or to create a digital twin of a real person. The opportunity is present and real: in India and Spain, synthetic influencers like Naina Avtr or Aitana Lopez boast hundreds of thousands of followers; a chart-topping Christian musician in the USA, Solomon Ray, is an entirely synthetic creation; and ‘appearing' like Mia Zelu in the crowds at Wimbledon last year, these fake influencers can be represented as participating in real-world events.

All this creates a range of problems.

Deepfakes of real people: How can people be protected against unauthorized deepfakes?
Ownership of fake people: How do the creators of synthetic influencers and avatars ensure they own them - and, indeed, prevent these in turn from unauthorized misuse?
Enforcement: Behind (1) and (2) is the question of enforceability - for unauthorized deepfakes are easy to create, harder to track, and depending on what they were used for, even harder to enforce sanctions and remedies against.

Deepfake laws: porn-crime vs civil approaches

Laws addressing deepfakes largely split into those addressing nonconsensual deepfake (largely but not exclusively focused on pornography), and those addressing the wider commercial misuse of unauthorized deepfake images. In the USA, the 2024 TAKE IT DOWN Act made it a federal crime to publish or threaten to public nonconsensual intimate deepfakes, with US states also passing similar laws. Through the Online Safety Act, the UK made it a criminal offence to publish nonconsensual deepfake images; it also plans to ban nudification apps. An EU directive makes it a crime to publish nonconsensual sexual images. In addition, Germany is mulling a new law making it an offense to generate and distribute deepfakes, with higher penalties if these are pornographic. As of 2024, the French criminal code makes it an offence to share nonconsensual deepfakes, with deeper penalties where these are pornographic.

Criminal deepfakes are one thing. Wider commercial use of unauthorized deepfakes is another, with regulators alternatively promoting new rights in content, and requiring platforms to put new anti-deepfake protections in place. 2023 the US Senate introduced the NO FAKES Act, a bill that proposes to regulate non-pornographic deepfakes, and to create the right of personality in people’s likenesses and voice. In the UK, the regime for unauthorized and non-pornographic deepfakes is a mix; there is no standalone personality right or image right, meaning that avenues for dealing with them rely on copyright, passing off, and privacy law.

Within Europe, the EU Digital Services (DSA) and EU AI Act (AI Act) are the key civil rules against deepfake content. Article 35 DSA requires the largest online platforms to proactively mark deepfakes distributed on their platforms. Article 50 AI Act similarly obliges all deployers of AI to disclose that image, video, or audio deepfakes are AI-generated. In addition, EU states including Germany, France, Spain and others recognise personality rights, though to varying extents and with varying consequences; these all have implications for countering deepfakes. Broadly speaking, however, we can state that EU approaches are more dignity based rather than propertarian.

Slippery regimes: synthetic content and the challenge of pre-existing regimes

It is appropriate that the full force of criminal law be applied to pornographic and fraudulent deepfakes. But what about the wider commercial misuse of synthetic content?

As the above paragraphs show, protections against synthetic content are fragmented. The picture varies between jurisdictions. Even within specific jurisdiction, a legal patchwork of approaches includes

IP based rights: IP law is geared up for the reward and protection of work, innovation, and risk. Relevant areas include copyright, trademarks, and passing off, but these are imperfectly applied in the deepfake / synthetic personality context.

Copyright is an imperfect remedy: In the UK, EU, and USA, individuals do not have copyright in their own face of voice. Copyright may exist in images & recordings of their face and voice - but unless they recorded these with their own devices, the person who owned the camera / recorder may own the copyright. An additional complexity is that copyright often requires human agency. Take the US - a legal decision last year,, Thaler v. Perlmutter at the D.C. Circuit Court of Appeals reaffirmed that copyright protection requires human authorship. This means that works created entirely by AI, without meaningful human involvement, are not eligible for protection.
Passing off: though useful in addressing issues like false endorsements & misuse of someone's likeness in advertising, passing off laws general requires a commercial context and don't protect private individuals
Trademarks: Most people do not have registered trademarks, so this is not a relevant protection for the vast bulk of deepfakes associated issues.

Privacy rights: Focuses on unauthorized use of personal data, images, representations that relate to sensitive areas of a person's life. includes various potential rights such as data privacy, or in the UK the tort of misuse of private information. Useful in some situations, but limited, context dependent, and largely irrelevant to the commercial misuse of synthetic content.
Personality rights: Sometimes called the right of publicity, image rights, or right of personality. These focus more upon protecting persons rather than work. Depending on the jurisdiction, they have more or less relationship to traditional IP rights. Historically, these rights have tended to arise more from tort law or privacy law, and in civil law countries from fundamental personal rights. They do not arise from property rights, and thus are hard to protect using property related remedies. As a result, they are hard to scale and hard to enforce.

If the EU already had personal rights, why did Denmark’s proposal get so much publicity?

Although individual EU states already had some measure of personality rights, these were often broadly framed, non-codified, not clearly transferable, and reactive - focused on harms rather than prevention, and thus decreasingly suited to today's socio-technical context.

Denmark's proposal was to create identity as a copyright-like asset. This would mean people could have assignable, licensable, enforceable rights suitable for a context where synthetic images and content are highly automated, scalable, and commercialized.

The key thing here is having a right and actually being able to enforce it. Whereas post-harm litigation is painful and slow, a copyright-like personality right can plug rapidly and smoothly into pre-existing modes of IP enforcement. Denmark's proposed law would promote easier remedy and enforcement against the harms of non-consensual deepfakes.

The same principle is why Guernsey’s Image Rights Ordinance is potentially useful - it provides an earlier response to the problem, one creating clear property rights. Importantly for our story, it is much wider in scope. - unlike the proposed Danish law, Guernsey image right can be used to protect both real people and synthetic avatars.

The Guernsey Image Rights Ordinance

The Guernsey Image Rights Ordinance creates property rights in images, and a searchable register of those rights.

The law: creating image rights

The Guernsey Image Rights Ordinance 2012 (IRO), provides a mechanism which enables a person or corporation to adequately exploit and protect distinctive attributes of their character or personality. ‘Image’ is defined very widely, and includes:

…the voice, signature, likeness, appearance, silhouette, feature, face, expressions (verbal or facial), gestures, mannerisms, and any other distinctive characteristic or personal attribute of a personage, or……any photograph, illustration, image, picture, moving image or electronic or other representation (‘picture’) of a personage and of no other person …” (IRO, s 3(1)(b) and (c)).

Who can use the image rights ordinance?

Individuals, companies, and other groups can all make use of this law

Under Section 1(1) IRO, Personality refers to the characteristics of the “personnage” who has or is seeking registration under the Ordinance. A personnage can be one of the following:

a natural person,
a legal person,
two or more natural persons or legal persons who are or who are publicly perceived to be intrinsically linked and who together have a joint personality (“joint personality”),
two or more natural persons or legal persons who are or who are publicly perceived to be linked in common purpose and who together form a collective group or team (“group”), or
a fictional character of a human or non-human (“fictional character”),

The ordinance can therefore be applied to real humans, synthetic avatars of humans, and other synthetic non-human characters and personalities.

The image rights register: search image rights online

Crucially to all this, the Guernsey Image Rights Ordinance creates an image rights register - meaning rights holders, and those who use IP potentially owned by those rights holders, can search the register to see if their assets are there. This aids transparency and discoverability.

Image rights owners and licensees may be placed on the register, as too are any charges against the image rights.

Infringement: commercial focus

Guernsey' IR Legislation focuses on the commercial exploitation and protection of image rights, not an individual’s right to privacy. Image rights are thus only infringed, and the infringement proceedings available under the IR Legislation are only applicable, where an infringing image is used for a commercial purpose or a financial or economic benefit. As laid out in this helpful note, an infringing use is one where:

where, because the infringing image is identical or similar to a protected image, there exists a likelihood of confusion on the part of the public (including as to association with the registered personality); or
which uses an image identical or similar to a protected image and the use:
takes unfair advantage of the distinctive character of the personnage; or
is detrimental to the distinctive character of the personnage or the value of its personality or images,
in each case without the registered proprietor’s consent.

Only protected images can be infringed. A protected image is an image which is:

distinctive;
has actual or potential value; and
satisfies the requirements for registration under the IR Legislation (whether or not it is actually registered).

Registered images are presumed to be distinctive, as well as having actual or potential value; getting your image in the register thus automatically means it can be protected

Enforcement

Guernsey images rights are internationally enforceable. To enforce, one firstly needs to get a judgement from a Guernsey court. This judgement can then be taken to another jurisdiction and applied there, as long as the legal principles of that jurisdiction are consistent with the Guernsey law.

The fact that the Guernsey is a party to the WIPO Copyright Treaty and has (via the UK) ratified The Madrid Protocol supports the ability to enforce Guernsey Image Rights judgements in other jurisdictions which are parties to these protocols. Importantly, the USA, EU and China are parties to these treaties.

Practically speaking, infringements move at a pace far faster than a court process alone can handle. This is why, as discussed below, we welcome exploration of how the Guernsey IRO can be combined with anti-infringement platforms & tooling for greater effect.

What does all this actually mean?

Using the Image Rights Ordinance, individuals, companies and other bodies can register and protect their image. This has wide potential implications for online life, how we protect and maintain online trust, and about how we incentivise innovation and distribute benefits in the digital economy.

Because these rights are licenseable and assignable, updated business models can be called into being for the purposes of protecting and exploiting image rights. . Individuals - be they content creators, creatives, or ordinary citizens - will be able to transfer their rights to companies, and these companies can engage in the necessary work of protecting people online. This could include things like issuing takedown notices, proposing compensation, or similarly licensing IP and collecting revenue on behalf of rights holders.

This plays neatly into contemporary policy debates. Recent months have seen the UK engaged in a wider consideration of its copyright and IP related laws, with a lively public debate on whether or not data mining should be included within a fair use exclusion to copyright. Contemporary AI is based upon the scraping and analysis of gigantic datasets, datasets that often include copyrighted material; debate has centred on whether or not tech firms should be able to mine these datasets without taking account of copyright. Advocates of tech-focused economic growth have been set against representatives of the creative industries and other right-holding constituencies. Comparatively few participants seemed interested in asking what new & AI relevant forms of protection could emerge. Guernsey’s Image Rights Ordinance could be a useful resource in this live public policy issue, providing a model of protection for certain rights. UK policymakers should assess the extent to which the Ordinance - or a further iteration of the Ordinance - could assist UK aims.

Guernsey image rights and the age of AI: updates needed?

Guernsey’s Image Rights Ordinance is thus a powerful potential weapon in the fight against deepfakes. It is also of great potential utility as a way of protecting synthetic identities online. Despite this, the Guernsey Image Rights Ordinance has had comparatively little traction to date. In the view of CDOT Future, this is simply because it was so ahead of its time - launched in 2012, the Ordinance preceded public anxiety over deepfakes by well over a decade.

With the international digital economy in rapid evolution, and with surging public anxiety over the place and reliability of digital identities, the moment is right for a reconsideration & review of the Guernsey Image Rights ordinance. Through the Ordinance, Guernsey is well placed to contribute to the emerging needs of the UK and the wider world.

The key thing will be the ability to move at speed and scale. Digital infringements spread at the speed of the internet itself. For the IRO to be effective, it must be coupled with platforms that are capable of scraping and scanning both the open web and closed social media communities, and that are capable of turning their insights into enforcement action. Guernsey provides the legal framework; platforms and companies must provide the practical mechanisms by which people can asser their rights.

In Guernsey, we once again see the innovative role of the UK CDOTs as testing bed of legal innovation. UK policy bodies should assist Guernsey to improve and extend its regime.

James Kingston