What are the privacy laws in the UK?
What the UK rules cover
The UK GDPR is the version of the EU's General Data Protection Regulation that the UK kept after leaving the EU. It works alongside the Data Protection Act 2018 and sets rules for handling personal data, which is any information that can identify a living person.
A clear photo of a real face counts as personal data because it identifies someone. The Information Commissioner's Office (ICO) is the UK regulator that enforces data protection law and handles complaints about how personal data is used.
- UK GDPR and the Data Protection Act 2018 are the core laws
- Personal data includes images that identify a person
- The ICO investigates complaints and enforces the rules
- Purely personal use is treated differently from sharing images publicly
How it applies to face swaps
A face swap usually involves processing a person's facial image, which is why data protection law can apply when the image shows a real, identifiable person. Companies that run face swap apps generally have to explain what they collect, why they collect it and how long they keep it.
Separate from data law, UK rules on harassment, defamation and intimate image abuse can also apply to misleading or sexual face swaps. Sharing a sexual deepfake of someone without their consent is a criminal offence in the UK. This is general information only, and a solicitor or the ICO can advise on a specific situation.
Common mistakes
- Assuming a face swap is legal just because the app allows it, since the law still applies.
- Thinking that private use of an image automatically removes every legal risk once it is posted online.