The law
Publishing an intimate image without consent: an altered photo counts too
There is no statute here called a deepfake law, and none is needed: the definition of an intimate image already contains the words "has been altered".
Short answer
Publishing an intimate image of someone without their consent is an offence under section 159AAE of the Crimes Ordinance (Cap. 200), and so is threatening to publish one. The maximum is five years’ imprisonment, and the section has been in force since 8 October 2021. An edited photograph is not a way around it: the definition in section 159AA covers an image that has been altered to appear to show an intimate part of that person.
Hong Kong never had to pass a separate deepfake law, because the definition already carries the word “altered” — which is why this page starts with the wording and only then reaches the penalties. The kind of service this applies to is the subject of the services this applies to.
Section 159AA
What the definition actually covers
One clause decides whether an edited photograph sits inside the offence or outside it.
| Element | What the ordinance says | What that means in practice |
|---|---|---|
| The image | An image showing an intimate part of the individual, or the individual doing an intimate act. | It applies whether or not the part shown is in fact that person’s. |
| An altered image | The definition includes an image that has been altered to appear to show an intimate part of the individual, or the individual doing an intimate act. | A photograph of a real person put through one of these services is an intimate image of that person. |
| The exclusion | It does not include an image so altered that no reasonable person would believe that it shows that individual. | The question is whether the result still reads as them, not whether the body in it is real. |
| Intimate part | Genitals, buttocks, anal region or breasts, whether exposed or only covered with underwear, and the underwear covering those parts. | Underwear is inside the definition, so a result that stops short of nudity is not outside it. |
Sections 159AA to 159AAF were inserted by the Crimes (Amendment) Ordinance 2021 and the wording is in the official text of the Crimes Ordinance (Cap. 200), with a plain-language summary of the publication offence from the Community Legal Information Centre. The products concerned: the six services and what they charge.
Four offences
Five years is the ceiling on all four
The 2021 amendment added a block of offences rather than a single one, and they share a maximum.
| Section | Conduct | Maximum | Who acts on it |
|---|---|---|---|
| 159AAB | Voyeurism: observing or recording an intimate act where there is a reasonable expectation of privacy. | 5 years | The Police. |
| 159AAC | Unlawful recording or observation of intimate parts, the provision behind upskirting and down-blousing cases. | 5 years | The Police. |
| 159AAD | Publication of images originating from either of those two offences. | 5 years | The Police, who also hold the earlier offence. |
| 159AAE | Publishing an intimate image without consent with intent to cause humiliation, alarm or distress, or reckless as to that, and threatening to publish one. | 5 years | The Police; the e-Report Centre takes the links and screenshots. |
The Security Bureau confirmed the commencement date and the five-year maximum in its statement of 8 October 2021; the meaning of “publishes” is set out in the Community Legal Information Centre note on publication of unlawful images.
The edge of the wording
Where the section stops, and where it does not
The statute speaks about an image of a specific individual, and that limit cuts both ways.
Inside the wording
The ordinary case with these services is squarely covered.
- A photograph of a real person, altered so that it appears to show an intimate part.
- A result that a reasonable person would still take for that individual.
- Publication, or a threat of publication, without that person’s consent.
- It makes no difference which site, app or bot produced the file, or who operates it — see who operates these websites.
Not described by the wording
The words computer-generated, synthetic and deepfake appear nowhere in the definition.
- An image built from nothing, showing no identifiable person, is not an intimate image “of an individual” on the text of section 159AA.
- Where an image shows anyone under 18, a separate and much heavier body of law applies, and nothing on this page changes that.
Beyond Cap. 200
Three ordinances that reach the same conduct
Obscenity, personal data and advertising each cover a different part of this.
| Ordinance and section | What it reaches | Maximum | Who acts on it |
|---|---|---|---|
| PDPO s.64(3A) | Disclosing someone’s personal data without consent, intending or reckless as to specified harm. | HK$100,000 and 2 years | The Privacy Commissioner, who may also serve a cessation notice under section 66D. |
| PDPO s.64(3C) | The same disclosure where the specified harm is actually caused. | HK$1,000,000 and 5 years | The Privacy Commissioner. |
| COIAO Cap. 390 | Publishing an obscene article; publishing an indecent one outside the statutory conditions. | HK$1,000,000 and 3 years; HK$400,000 and 12 months on a first conviction | The Obscene Articles Tribunal classifies the article into Class I, II or III. |
| Trade Descriptions Ordinance s.13E | A commercial practice that hides material information or fails to identify its commercial intent. | HK$500,000 and 5 years | The Customs and Excise Department. |
Sources: the official texts of the Control of Obscene and Indecent Articles Ordinance (Cap. 390) and of section 13E of the Trade Descriptions Ordinance; the Office for Film, Newspaper and Article Administration on the classification of articles, the Privacy Commissioner on the anti-doxxing provisions, and the Customs and Excise Department on the penalties under that ordinance.
In practice
What the section means from where you are sitting
Four situations that reach this page, and the part of the wording each one turns on.
A picture of you exists
Nothing asks you to prove the body in the image is yours: the section covers an image altered to appear to show an intimate part of you, whether or not the part shown is in fact yours. Save the links and screenshots before reporting anything — the evidence leaves with the post. Money demanded over it falls under the same section even if no image was ever made.
One was sent to you
Passing it on is the act the section names: to publish means to distribute, circulate, make available, send, give, lend or show an image to another person, so forwarding it once to one friend is publication in the same sense as posting it publicly. That is one reason these pictures travel the way they do — how images spread through channels.
You run a group or a channel
“Makes available” sits inside the same definition, so posting such an image into a group is publication by whoever posted it, whatever the group’s size or privacy setting. Where a name, an employer or a phone number travels with the picture, the doxxing provisions apply on their own footing and the Commissioner can order removal without waiting for a prosecution.
You are about to pay for a run
A payment is a record in somebody’s name. Two of the six take a card, which puts the charge on a statement; the ones that bill in cryptocurrency put a wallet address, an amount and a timestamp on the account instead. Neither is anonymous in the way the advertising implies, and the price is the easy part to check first — what a paid run actually costs.
Questions
What readers ask about this section
The answers follow the statutory text; how any single case ends is for the prosecution and the courts.
Is making the image an offence by itself?
Section 159AAE is about publication and threats to publish, not about the act of editing a file — a narrower question than most people expect, and the reason a threat is treated so seriously: the offence is in play the moment the file moves to anyone else or is used as leverage. Where the image was obtained by voyeurism or unlawful recording, sections 159AAB to 159AAD reach that earlier conduct as well.
Does it help that the body in the image is not real?
No. The definition applies whether or not the intimate part shown is in fact that person’s, and expressly includes an image altered to appear to show one. The only exclusion is for an image altered so heavily that nobody reasonable would believe it shows that individual — a test about recognisability, not about how the file was made.
The service is based overseas. Does that matter?
It changes who is easy to reach, not what the law says about the person publishing. Most of these operators sit outside Hong Kong and answer only through a support mailbox, so nobody local audits what happens to an upload — and installing their software brings its own problems: the risk beyond a bad install file.
An image of me is already circulating. What now?
Save the evidence first: posts take it with them when they come down. Then the desks in order — take-down support, the police and, where personal data was disclosed, the Privacy Commissioner — as set out in the order of takedown steps.