Contributor: Okosa Chinwendu Marycynthia
Introduction
Deepfakes are forms of synthetic media created by digitally manipulating images, audio recordings or videos to replace or imitate a person’s appearance, voice or other identifying characteristics. Their increasing sophistication and accessibility have heightened concerns about their potential misuse and the resulting harm to privacy, reputation and personal identity.[1] This article examines the growing use of deepfake technology in Nigeria and the various forms of digital harm associated with it. It explains the concept of deepfakes and considers the risks arising from their misuse within the digital environment. It also analyses the extent to which existing Nigerian laws, particularly those governing defamation, cybercrime and data protection, protect individuals against harm caused by deepfake content.
The article further assesses whether these legal frameworks adequately address the emerging challenges posed by artificial intelligence-driven manipulation. It identifies gaps in the existing regulatory regime and proposes legal and policy reforms to strengthen protection against deepfake-related harm in Nigeria.
Concept of Deepfake
The rapid development of artificial intelligence has produced a particularly disruptive form of technology known as the deepfake. Deepfakes are highly realistic images, videos and audio recordings manipulated through artificial intelligence techniques, including generative adversarial networks (GANs), to depict individuals saying or doing things that never occurred.[2] Although deepfake technology was originally developed for legitimate creative and technological purposes, it has increasingly become a tool for spreading disinformation, invading privacy, damaging reputations and facilitating identity fraud.[3]
In Nigeria, the risks associated with deepfakes are no longer merely hypothetical. In May 2026, an artificial intelligence-generated audio recording that falsely imitated President Bola Ahmed Tinubu circulated widely on social media, sparking considerable public concern. In connection with the incident, law enforcement authorities arrested Ifechukwu Dennis in Benin City in June 2026.[4]
The incident highlights a significant legal challenge. Nigerian law does not expressly regulate the creation or dissemination of deepfake content. Consequently, prosecutors and victims must rely on laws that were not specifically designed to address artificial intelligence-generated impersonation and manipulation. This regulatory uncertainty forms the central concern of this article.
Legal Frameworks
Constitution of the Federal Republic of Nigeria
The Constitution of the Federal Republic of Nigeria 1999 (as amended) guarantees the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications.[5] A purposive interpretation of this provision may extend its protection to the unauthorised manipulation of a person’s digital image, voice or biometric data.
The Constitution also protects the dignity of the human person, thereby providing an additional constitutional basis for claims arising from deepfake-enabled non-consensual intimate imagery (NCII).[6] However, Nigerian jurisprudence on digital privacy remains underdeveloped, and the courts have yet to determine the application of these constitutional protections to deepfake-related harm.
Cybercrimes (Prohibition, Prevention, etc.) Act 2015
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 is the principal legislation governing technology-facilitated offences and crimes committed in cyberspace. It criminalises the intentional transmission of a message through a computer system where the message is grossly offensive, pornographic, obscene or knowingly false and is transmitted with the intention of causing harm to another person.[7] This provision may apply to the dissemination of deepfake content, including fabricated political audio recordings and non-consensual intimate imagery. The Act also criminalises identity theft committed through computer systems, which may cover certain forms of deepfake-enabled impersonation.[8]
The Nigeria Data Protection Act (NDPA) 2023
The Nigeria Data Protection Act 2023 (NDPA) classifies biometric data, including facial features and voice patterns, as sensitive personal data requiring enhanced protection.[9] It also imposes obligations of lawfulness, fairness and transparency on data controllers and processors.[10]
The creation of a deepfake ordinarily involves collecting and processing another person’s biometric data, often without that person’s knowledge or consent. Such conduct may therefore fall within the regulatory scope of the NDPA. However, the NDPA framework largely contemplates identifiable data controllers or processors with legal personality and a defined purpose for processing personal data. Anonymous individuals who use open-source tools to create and distribute deepfakes on social media platforms do not fit neatly into this framework. Moreover, the Nigeria Data Protection Commission’s capacity to identify and pursue individual offenders operating anonymously across digital platforms remains limited.
The Criminal Code Act
The Criminal Code Act defines defamatory matter as any spoken or written publication likely to injure a person’s reputation by exposing the person to hatred, contempt or ridicule, or by damaging the person’s profession or trade.[11] Deepfake content may satisfy the essential elements of defamation, namely publication, identification and reputational harm, where a person’s likeness is used to create a false and damaging impression.
Nevertheless, deepfakes present practical difficulties under defamation law, particularly in identifying the person responsible for creating or disseminating the content and in addressing the unauthorised use of an individual’s likeness.
Limitations of Existing Legal Frameworks in Addressing Deepfakes
A review of the legal frameworks discussed above reveals a significant structural problem: no Nigerian statute expressly regulates deepfakes, artificial intelligence-generated synthetic media or the specific harms arising from their misuse. The relevant statutory provisions were enacted before deepfake technology attained its present level of sophistication. Consequently, they did not contemplate the realistic fabrication of a person’s image, voice or statements in a manner capable of deceiving large audiences.
Although section 24 of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 is broadly framed, its application requires proof that the accused knew the content was false and intended to cause harm. Establishing these elements may prove difficult where creators conceal their identities or operate through anonymous digital accounts.
The 2026 Ifechukwu Dennis case illustrates this difficulty. Despite the suspect’s arrest, no clear statutory provision appears to address specifically the use of artificial intelligence-generated audio to impersonate another person.
Defamation law presents similar challenges. Traditional defamation principles generally contemplate a statement attributable to an identifiable human publisher or speaker. Deepfakes complicate this framework by fabricating a person’s appearance, voice, or statements, even if the person did not make the alleged publication. Similarly, although the Nigeria Data Protection Act 2023 applies to the processing of personal and biometric data, its enforcement mechanisms may be difficult to invoke against anonymous deepfake creators. The Act also does not establish a comprehensive liability regime for social media platforms that disseminate deepfake content.
A further challenge arises from the difficulty of identifying a person or legal entity against whom proceedings may be commenced. Nigerian defamation and cybercrime proceedings ordinarily require an identifiable defendant or accused person. Where deepfake content is created and circulated through anonymous accounts, automated systems or unregistered online operations, a victim may suffer a legally recognisable wrong but remain unable to identify the responsible party. The problem becomes more acute where the creator operates from a foreign jurisdiction beyond the effective reach of Nigerian law enforcement authorities.
Developments in other jurisdictions further demonstrate the limitations of Nigeria’s existing framework. The United Kingdom’s Online Safety Act 2023 introduced specific measures addressing the non-consensual sharing of intimate images, including certain digitally altered images. The European Union’s Artificial Intelligence Act 2024 also imposes transparency obligations regarding artificial intelligence-generated or manipulated content, including deepfakes. Unlike Nigerian legislation, these instruments expressly recognise synthetic media and prescribe clearer legal consequences for its misuse.
Existing Nigerian laws also fail to adequately address the “liar’s dividend”: the phenomenon in which individuals exploit public awareness of deepfakes to dismiss authentic recordings or evidence as fabricated. General cybercrime and defamation provisions are ill-suited to this form of harm because they were not designed to regulate the broader evidential and social consequences of synthetic media.
Proposed Legal Reforms
Accordingly, the most fundamental reform required is the express legislative recognition of deepfake technology. The Digital Rights and Freedom Bill, which seeks to guarantee the application of fundamental human rights in the digital environment, represents an important step towards protecting online freedoms in Nigeria.[12] However, the Bill was conceived before the widespread emergence of generative artificial intelligence and contains no express provisions regulating deepfakes, synthetic media or artificial intelligence-generated impersonation. Although its broad human rights protections may provide indirect safeguards, it does not adequately address the distinct legal challenges posed by modern deepfake technology.
The liability gap identified in this article also requires a two-pronged response. First, any new legislation should impose clear obligations on social media companies and online platforms operating in Nigeria. These obligations should include establishing effective mechanisms for reporting and removing harmful deepfake content and cooperating with lawful investigations by law enforcement agencies.
Second, platforms should be required, subject to judicial oversight and applicable data protection safeguards, to retain sufficient user information to identify persons who create or disseminate harmful deepfake content. Although anonymous expression remains an important aspect of digital freedom, it should not shield persons who use anonymity to inflict serious harm on others.
Conclusion
Although several Nigerian laws may be invoked to address certain harms arising from deepfakes, the existing legal framework remains largely inadequate. Statutes such as the Cybercrimes (Prohibition, Prevention, etc.) The Act 2015, the Nigeria Data Protection Act 2023, and applicable defamation laws provide only indirect and fragmented remedies for a technology that poses distinct threats to privacy, reputation, identity, and public trust.
The 2026 arrest of Ifechukwu Dennis in connection with the circulation of an artificial intelligence-generated audio recording impersonating President Bola Ahmed Tinubu further highlights the absence of a clear legal framework specifically regulating deepfakes and synthetic media. As the use of generative artificial intelligence continues to expand, Nigeria urgently requires targeted legislation to directly regulate the creation, dissemination, and misuse of deepfake content.
Reference:
- Ramluckan, T, ‘Deepfakes: The Legal Implication’ (Research Gate, March 2024) <(PDF) Deepfakes: The Legal Implications> accessed 25 June, 2026. ↑
- Alanazi, S, & Asif, S, ‘Exploring Deepfake Technology: Creation, Consequences, and Countermeasures’ (Springer Nature Link, 18 September, 2024), <Exploring deepfake technology: creation, consequences and countermeasures | Human-Intelligent Systems Integration | Springer Nature Link> accessed 25 June, 2026. ↑
- Ibid. ↑
- Ugbodaga, K, ‘Man who Fooled Thousands with Fake Tinubu’s Voice has been Arrested’ (PM News, 4 June, 2026), <Man who fooled thousands with fake Tinubu’s voice has been arrested – P.M. News> accessed 25 June, 2026. ↑
- CFRN 1999, s 37. ↑
- Ibid, s 34. ↑
- Cybercrimes Act 2015, s 24. ↑
- Ibid, s 22. ↑
- NDPA 2023, s 65. ↑
- Ibid, s 24. ↑
- CCA, s 373. ↑
- Muhammed-Nurudeen, M, ‘Nigeria Digital Rights and Freedom Bill Reintroduced as PIN Reinforces Online Human Rights’ (Joy Online, 28 October, 2024), < Nigerian Digital Rights and Freedom Bill reintroduced as PIN reinforces online human rights – MyJoyOnline> accessed 25 June, 2026. ↑
