Essex Man Sentenced to Five Years in Prison for Having Generated and Shared Deepfake Pornography of at Least 20 Women and a Minor

Between March 2023 and May 2024, Brandon Tyler of Essex used AI to generate explicit deepfake pornography of at least 20 women he knew personally, including a 16-year-old. He manipulated their social media photos and shared them, along with their personal details, in online forums promoting sexual violence. He was sentenced to five years in prison in April 2025 under the UK's criminal law against sharing sexually explicit deepfakes, in what is one of the first major prosecutions of its kind.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The perpetrator used AI to generate non-consensual sexually explicit deepfakes to target, humiliate, and harass specific victims for personal gratification.

Additional risk subdomains

• 1.2 Exposure to toxic content: The generated explicit deepfakes were shared on a public forum glorifying rape culture, exposing users and victims to highly toxic and abusive content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by a human perpetrator who intentionally used deployed AI tools to generate and distribute non-consensual deepfakes to harass and humiliate victims.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI system was used to generate deepfakes, which are subject to specific transparency obligations under the EU AI Act.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Image Generation; Decensoring
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Brandon Tyler
• Alleged harmed parties: Victims of Brandon Tyler, General public

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Minor
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Negligible

Malicious content

Reported: The report explicitly describes toxic and malicious content created and spread directly and indirectly by the incident.

Directly caused: The perpetrator used AI to generate 173 posts containing sexually explicit deepfake images of the victims.

Indirectly caused: The posts attracted sexualized and explicit comments from other users in an online forum glorifying rape culture.

Inferred additional harm: It is likely the generated content remains accessible or was archived by other users on the forum, continuing to circulate.

Civil rights

Reported: The report explicitly describes violations of human and civil rights caused directly by the incident.

Directly caused: The non-consensual sexualization and distribution of the victims' likenesses violated their personal dignity and rights to bodily autonomy and privacy.

Privacy

Reported: The report explicitly describes privacy violations caused directly by the incident.

Directly caused: The perpetrator posted the victims' real names, social media handles, and phone numbers alongside the deepfake images.

Psychological

Reported: The report explicitly describes severe psychological and mental-health harm to the victims, including extreme distress, humiliation, and feeling violated.

Directly caused: At least two victims wept in court, describing feeling 'completely violated', 'mortified and disgusted', and experiencing long-term relationship breakdown and ongoing harassment.

Inferred additional harm: It is highly likely that all 21 targeted victims suffered significant psychological distress, anxiety, and humiliation due to their private images being sexualized and shared publicly.

Child sexual exploitation and abuse

Reported: The report explicitly describes a CSEA incident involving a minor.

Directly caused: The perpetrator used AI to generate sexually explicit imagery of a 16-year-old minor by editing her prom night photograph.

People affected

• Occurrences reported: 1
• People reportedly harmed: 21
• People reportedly exposed: 21

Potential causes

Technology

• AI Deepfake Tools: AI algorithms allowed easy removal of clothing from photos.
• Online Forums: Anonymized forums facilitated sharing and glorification of abuse.

Data Inputs

• Public Social Media Photos: Victims public photos on Instagram were harvested for manipulation.
• Personal Information: Victims names and phone numbers were input to maximize distress.

Human Factors

• Toxic Masculinity: The perpetrators desire to humiliate and degrade women.
• Porn Addiction: Perpetrator struggled with a long-term porn addiction.

Process and Methods

• Social Media Trawling: Targeted planning by scraping images from victims accounts.
• Malicious Image Editing: Systematic process of editing and uploading graphic deepfakes.

Regulatory Environment

• Lagging Creation Laws: Legislation to criminalize deepfake creation was only in committee stage.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, detailed factual information about the court case, the number of victims, the nature of the AI's use, and the resulting harms. There is no ambiguity about the perpetrator's intent or the consequences of his actions.
• Ambiguities identified: The specific AI software or platform used by the perpetrator is not identified.

A domestic criminal case in the UK involving the creation and distribution of non-consensual explicit deepfakes of 21 individuals. While representing a severe violation of individual privacy and a landmark legal prosecution under the Online Safety Act, the incident carries negligible national security implications as it did not target critical infrastructure, state functions, or population-scale stability.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United Kingdom
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The perpetrator has been prosecuted and sentenced, representing a resolved case with no immediate ongoing threat.
• Autonomy: Human-controlled. The AI system was used strictly as an image-generation tool directly controlled by the human perpetrator.
• Novelty: Evolved capability. Represents an evolved threat where accessible AI tools are increasingly leveraged for targeted harassment, leading to novel legal prosecutions.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or kinetic targets were impacted by this domestic criminal incident.
• Information security: Negligible. While deepfakes were generated, they targeted private individuals for harassment rather than state institutions or leadership for intelligence or information warfare.
• Sovereignty: Negligible. No government functions, electoral systems, or sovereign decision-making processes were disrupted or targeted.
• Economic security: Negligible. No strategic technology was compromised, and the incident had no impact on national economic or technological security.
• Societal stability: Minor. The incident represents a severe violation of individual privacy and human rights for the 21 victims, but lacks the population-scale impact to threaten broader societal stability.