Audit finds 46 women MEPs targeted by sexual deepfakes

Austrian Green MEP Lena Schilling said she learned last month that nude deepfakes of herself were circulating online, made by digitally removing her clothing from photographs of an early press conference, and used a Guardian interview published October 18 to call for EU enforcement.

She is one of 50 MEPs, 46 of them women, that the Berlin think tank Agora Digitale Transformation found depicted in or associated with deepfake pornography. "I felt disgusted," Schilling told the Guardian. "I remember how nervous I was and how much I had prepared for the press conference."

ADT alerted her to the images. Its report, "Targeted and Ignored," was published October 5 and covered that day by Politico Europe, EUobserver and EU Perspectives. ADT puts the finding at roughly one in six women MEPs and calls the harm a "systemic threat to women in European politics."

Between September 26 and 30, ADT ran the names of all 720 sitting MEPs against 200 domains known to host deepfake pornography, "celebrity leaks" and candid images, using Google's Custom Search API. Eight MEPs, all women, had manipulated sexual imagery actively hosted. Twenty-two appeared on "gateway" pages that place a nudifier app beside a biography or official portrait. Twenty-six had results that persisted after a domain seizure. Exposure ran across the Greens/EFA, EPP, The Left, Renew, S&D, ESN and Patriots.

An earlier ADT audit searched 5,872 national parliamentarians across the 27 member states in July and found 138 women and nine men, one in 14 women against one in 500 men. After adjusting for age, prominence, political lean and national law, women were 33 times more likely to be depicted or associated. Countries with deepfake-specific statutes showed no lower exposure. The project is funded by ADT and the Mercator Foundation.

The EU's answer so far is a ban that has not started. The Digital Omnibus on AI, which Parliament approved on June 16 by 423 votes to 57, prohibits AI systems that generate images, video or audio of an identifiable person's intimate parts or sexually explicit activities without consent. Providers may not place such systems on the EU market unless they carry technical safeguards, and the prohibition also covers deployers who use them for that purpose. Companies have until December 2 to comply, and the AI Act service desk lists the new prohibitions as applying from that date.

The AI Act's transparency duties are already live. Article 50 has applied since August 2, 2026, and requires anyone deploying a system that produces a deepfake to disclose it at first exposure. The Commission's own guidance explains why that has not helped here. A person using an AI system in a personal capacity, and its example is generating deepfakes and posting them to social media, is not a deployer, and the guidance states that such use "is excluded from the scope of the AI Act." Professional or paid use brings that person back in.

Platform law has the same shape. ADT found no fixed removal deadline in the DSA, the GDPR or the Digital Omnibus, while the US TAKE IT DOWN Act and UK rules require removal within 48 hours. The DSA's strongest duty, a risk assessment covering gender-based violence, binds only very large platforms and search engines, and most of the 200 domains are small and often hosted outside the EU, covered only by notice-and-action. GDPR Article 9 forbids the processing, but enforcement starts with a victim's complaint.

Indexing runs on its own clock. Google's documentation says it removes pages on request for "explicit non-consensual fake content" and demotes sites with many valid personal removals. In the earlier audit, 47 records from the seized domain CFAKE still returned in Google results more than a month after seizure; in the MEP audit, results for 10 MEPs still hit it nearly four months on.

For a creator working with likeness, the line is consent and identifiability. Selling a nudifier is banned from December 2 unless it carries technical safeguards, and so is using one to make intimate imagery of a real person, which covers deployers as well as providers. A synthetic character with no real counterpart is not what the prohibition describes. Article 50 still covers deepfakes made in professional work, including freelance and paid jobs.

YouTube's harassment policy bars unwanted sexualization of an identifiable individual, including content that shares, requests or shows how to distribute non-consensual intimate imagery, with exceptions for documentary, artistic or public-interest material. In March 2026, YouTube extended likeness detection, which flags AI-generated matches to a face, to a pilot group of government officials, journalists and political candidates. Its announcement said "detection does not guarantee removal."

Schilling and the German Green MEP Terry Reintke initiated the letter that 119 MEPs signed, dated September 30 and addressed to the European Commission and member states, Agence Europe reported. The signatories ask for the ban to be enforced from day one, a resourced authority in every member state, DSA action against platforms and search engines, a faster X/Grok investigation, and national implementation of the violence against women directive before its June 2027 deadline. "A ban on paper protects no one until it is enforced," the letter said. Commission spokesperson Thomas Regnier said: "It is illegal and has absolutely no place in Europe."

December 2 is the first test: member states need designated authorities in place to enforce the ban, and the Commission has said it will act from day one.