On 8 October 2026 Italy's data protection authority, the Garante per la protezione dei dati personali, published a consolidated account of its deepfake enforcement. It is the clearest picture yet of how one EU member state handles non-consensual sexual deepfakes, a form of digital gender-based violence. It uses data-protection law as the fast administrative tool and keeps a separate criminal offence for the worst conduct.
What the Garante actually did
The account covers four actions, and the sequence matters.
- Clothoff (1 October 2025). The Garante's President signed a provisional limitation order on the processing of personal data by the operator of the "nudification" app. The page says the company had no adequate measures to keep minors out or to stop users uploading images of minors or other people, no valid legal basis, and no efficient watermarking to flag artificial nude images. The press release of 3 October 2025 describes an urgent order with immediate effect against a company based in the British Virgin Islands. Punto Informatico adds that an information request sent in early August went unanswered and that the only marking was a "Fake" label that "can easily be removed".
- Warning no. 789 (18 December 2025). Under art. 58(2)(a) GDPR, the Garante warned all controllers and processors using services that generate content from real people's voices or images that such processing "may plausibly" breach arts. 5(1)(a), 6 and 9 GDPR, "with all consequences, including sanctions". This is general notice to the market, not a penalty on one firm.
- Grok/X (2 January 2026). The Garante opened an inquiry into X's Grok over sexually explicit images generated and posted without consent. Because X is established in Ireland, the matter went to the Irish authority. On 8 January 2026 that authority confirmed X was cooperating, up to disabling Grok's nudification function.
- R.T.I./Mediaset (23 July 2026). The Garante admonished R.T.I. Spa over the "Mentana case". Episodes of Striscia la notizia used an AI-dubbed deepfake of journalist Enrico Mentana to comment on the news. The Garante held that deepfakes, "even for satirical purposes", must respect dignity and the principles of lawfulness, fairness and transparency.
Alongside these sits art. 612-quater of the Penal Code, introduced by Law 132 of 23 September 2025, in force from 10 October 2025. According to the Garante's account, it punishes with one to five years' imprisonment anyone who causes unjust harm by disseminating, without consent, AI-generated or AI-altered images, video or voices that are likely to deceive about their authenticity. It is generally prosecuted on the victim's complaint, with ex officio exceptions.
The strongest case for this approach
The case for Italy's model is real. Victims of nudification need speed, and criminal proceedings are slow. An administrative authority that can freeze processing within days acts before an image spreads. The Grok episode shows the effect: six days passed between the Italian inquiry and the Irish authority's confirmation that the feature had been switched off. The GDPR also reaches the supply side, meaning the tool makers, which no individual prosecution of a poster can do. A criminal offence then gives victims a route to real accountability. A regulator-only approach risks treating a violation of bodily dignity as a compliance matter.
Where proportionality needs watching
The division of labour is sensible, but three risks deserve attention from anyone who wants an open internet that still protects people.
First, the Mentana admonishment tests the line between abuse and speech. Nudifying a real woman has no expressive value that outweighs the harm. A satirical show using a public journalist's likeness is a different thing. The Garante's reasoning, that satire must respect dignity and transparency, is a data-protection standard stretched over a speech question that courts and press law normally handle. It was an admonishment, the mildest corrective step, and no fine. But a regulator that polices the tone of satire creates a chilling effect even when it is gentle. Clear carve-outs for parody and journalism, with a labelling expectation rather than a prohibition, would serve better than case-by-case dignity review.
Second, the criminal offence is narrow by design, and should stay narrow. Its elements are consent, harm and deceptive realism. That keeps it aimed at the real wrong. The danger is drift. Il Sole 24 Ore's coverage notes that the Garante's communiqué reports no criminal proceedings for the cases it covers. That does not show the offence is failing, because it is under a year old. It does mean there is not yet evidence of how often it is used, or whether courts will read "likely to deceive" strictly. Italy should publish prosecution and conviction data before anyone proposes widening the offence.
Third, GDPR enforcement against offshore operators has limits. Clothoff's operator is in the British Virgin Islands and ignored an information request. A limitation order binds only what the Italian authority can reach in practice, such as app-store listings, payment rails and hosting. Warning no. 789 works as a deterrent only if the Garante follows it with fines on identifiable European users and providers. A warning that is never enforced becomes noise. Pushing these cases into the one-stop-shop channel, as happened with Grok, also shows that big-platform enforcement depends on Dublin, not Rome.
What good practice looks like
The most defensible parts of the Italian record are those where harm is unambiguous: sexual imagery of real people, no consent, tools with no age gate and trivially removable markings. The policy lesson is to match each instrument to its target:
- Fast administrative limits against services that are built to produce non-consensual sexual imagery.
- A narrow criminal offence for those who knowingly distribute it.
- Transparency and labelling duties, not dignity review, for satire and journalism.
- Published enforcement statistics, so the public can judge whether the system protects victims or only produces press releases.
Italy has shown that existing data-protection law can move quickly against abusive tools. Whether the model is a template or a cautionary tale depends on how the Garante and the prosecutors handle the cases that are not obvious.