Germany has roughly ten months left to transpose a directive it helped negotiate. Directive (EU) 2024/1385, adopted by the European Parliament and Council on 14 May 2024, requires all member states to criminalize non-consensual sharing of intimate images, cyberstalking, cyberharassment, and cyber incitement to hatred or violence on grounds of gender — with transposition due by 14 June 2027, per the official EUR-Lex summary. Germany's Federal Ministry of Justice, under Justice Minister Stefanie Hubig (SPD), published its response on 17 April 2026: a draft "Gesetz gegen digitale Gewalt" (Law Against Digital Violence).
What the draft actually does
The ministry's press release describes three new criminal offenses. A new §184k StGB would cover the unauthorized creation and distribution of intimate imagery — including AI-generated deepfakes, voyeuristic filming of nude or sexualized body parts in public, and non-consensual sharing of real intimate images, regardless of whether the content is real or synthetic. A new §201b StGB targets distribution (not creation) of deceptive deepfakes capable of seriously damaging someone's reputation — fabricated footage depicting a person committing a crime, for instance — with an explicit satire carve-out. A new §202e StGB folds covert GPS trackers and stalkerware apps into existing anti-stalking law. Victims also gain civil-law tools: the right to compel platforms to disclose a perpetrator's identity through judicial process, court-ordered data preservation, and a requirement that foreign platforms designate a domestic legal representative, according to netzpolitik.org's reporting. Non-consensual intimate-image offenses carry up to two years' imprisonment.
This is, on its narrow terms, well-targeted lawmaking. Each offense maps to a specific, identifiable harm — a real person's image, real GPS coordinates, a real technical act of surveillance — rather than to a broad category of "bad speech." That the draft criminalizes creation of non-consensual intimate imagery, not merely distribution, goes beyond what the EU directive strictly requires, but it closes an obvious loophole: a person who generates a deepfake and holds it as leverage without ever posting it currently faces no clear liability. Narrow, harm-specific criminal law of this kind is exactly the kind of proportionate response critics of overbroad online-safety regulation should welcome.
The gap the government isn't closing
But the directive requires more than image-based abuse and stalking. Article 7 obligates states to criminalize cyberharassment — both individually threatening conduct and coordinated online pile-ons — and a separate provision covers cyber incitement to hatred or violence on grounds of gender. Here, Germany's government has told the Bundestag it sees no need to act. Responding to a parliamentary inquiry from Die Linke, the government stated it considers existing pornography statutes under §184 StGB sufficient to cover unsolicited explicit imagery sent to adults, and that it has "nothing planned" to add gender as a protected category to the Volksverhetzung (incitement) paragraph, per netzpolitik's account of the inquiry response. Some of this delegates responsibility to the Länder; other pieces are simply parked.
There is a real case for caution here, and it deserves a fair hearing rather than a dismissal. Cyberharassment and hate-speech offenses are much harder to draft narrowly than image-based abuse: "coordinated threatening or insulting conduct likely to cause serious psychological harm" is a genuinely difficult standard to apply without chilling ordinary, if heated, online argument, and Germany's Volksverhetzung paragraph already sits at the center of long-running free-expression disputes. A government that wants to get the criminal-law text right before legislating group-harassment offenses is not obviously wrong to slow down on that specific piece, even while moving fast on stalkerware and deepfakes.
The problem is that "we'll get there" is not a transposition strategy with ten months left on the clock. The directive does not offer an à la carte menu; leaving cyberharassment and gender-based incitement uncriminalized past 14 June 2027 exposes Germany to an EU infringement procedure, the same mechanism now used against member states over other unimplemented digital-rules directives. If Berlin believes the cyberharassment provisions need narrower drafting to survive constitutional speech protections, that is an argument for starting the drafting work now — not for silence in a parliamentary answer.
Funding is the harder problem
Set the criminal-law timeline aside and a second gap looks worse. Germany's Gewalthilfegesetz, passed in early 2025, already establishes a legal right to counseling for victims of digital violence. But according to netzpolitik's reporting, that right does not take full effect until 2032 — six years after Hubig's own bill would create the new offenses it is meant to support, and five years after the EU deadline for transposition itself. A criminal offense without a funded support infrastructure behind it is a symbolic law: victims of deepfake abuse or GPS stalking would gain a right to sue and a prosecutor's office empowered to charge, but not necessarily anywhere to turn for counseling or a hotline resourced to handle the caseload the new offenses will generate.
This is the more legitimate regulatory failure. Proportionate, narrowly drawn criminal offenses like the ones in Hubig's draft are good policy. Passing them years ahead of the support infrastructure they presuppose — and leaving a directive-mandated harassment offense unaddressed with the clock running — turns a genuinely well-calibrated bill into an implementation problem the next government will inherit.