Consent has now become a myth. AI is now on every app, every website and even now on our phones, often without our consent. Nowadays when one searches on Google for the meaning of a word, instead of a dictionary website popping up, an “AI overview” will start explaining things, one did not ask for. The horrors of the use of AI do not end here. A person's face can now be placed on another person's body. Their voice can be cloned. A video can make someone appear to say words they never said and within seconds that content can reach thousands of people. And surprisingly, the semblance of consent is nowhere to be found. Many people are now unable to differentiate between original content and AI generated content. This mere fact shows how our social media pages are oversaturated with AI content. AI has become part of our lives. As the technology is advancing at extraordinary speed, the law is not.
The question, therefore, is not simply whether AI has become a part of our daily lives, often without our consent, but whether our existing legal framework is equipped to deal with the consequences of its use. The problem is that laws designed for an earlier digital environment may struggle to address harms created by technologies that did not exist when those laws were drafted. AI-generated content involving a person’s identity raises particularly difficult questions of consent, privacy and accountability. A person’s face, voice or likeness can be manipulated and circulated without their knowledge, yet determining who should be held responsible and what legal remedy should be available is not always straightforward. AI will not wait for legislation to catch up. Pakistan will have to build a legal framework capable of addressing these emerging harms before technology creates consequences that existing laws are simply not equipped to address.
Existing cybercrime provisions may provide some avenues for prosecution, but they do not clearly answer the questions that AI generated content now raises: who owns a person's digital identity, who is responsible when that identity is manipulated and what immediate remedy is available to the victim?
Pakistan’s primary legislation dealing with cybercrime is the Prevention of Electronic Crimes Act, 2016 (PECA). However, the legislation was enacted at a time when the technological landscape was considerably different from what it is today. The law addresses offences such as unauthorised access, electronic fraud, cyberstalking and offences involving the misuse of information systems but it does not contain a specific legal framework dealing with deepfakes, AI-generated impersonation or voice cloning. The 2025 amendment to PECA introduced Section 26A, which criminalises the intentional dissemination of false or fake information that is likely to cause fear, panic, disorder or unrest. While this provision may apply to certain AI-generated content, it does not specifically address the unique nature of deepfakes. A manipulated video, cloned voice or AI-generated image may not necessarily be created to cause public panic or unrest. It may instead be used to damage an individual’s reputation, impersonate them, violate their privacy or create an entirely false representation of their identity.
This creates a significant legal gap. The harm caused by a deepfake is not limited to whether the information portrayed is “false”. It may concern the unauthorised use of a person’s face, voice or likeness and the absence of consent. Existing cybercrime provisions may provide some avenues for prosecution, but they do not clearly answer the questions that AI-generated content now raises: who owns a person’s digital identity, who is responsible when that identity is manipulated and what immediate remedy is available to the victim? As AI becomes increasingly capable of reproducing not only what a person looks like but also how they sound and appear to behave, Pakistan’s cyber laws will have to evolve accordingly.
The law addresses offences such as unauthorised access, electronic fraud, cyberstalking and offences involving the misuse of information systems but it does not contain a specific legal framework dealing with deep fakes, AI-generated impersonation or voice cloning.
Other jurisdictions have already begun responding to these emerging forms of harm. The European Union’s AI Act, for example, introduces transparency obligations for certain AI-generated and manipulated content, while countries such as the United States have begun introducing legislation specifically targeting the creation and distribution of non-consensual deepfake content. These developments demonstrate that AI-related harms are no longer being treated solely as conventional cybercrime. They are increasingly being recognised as a distinct legal challenge requiring specific rules and remedies.
The problem is already appearing in Pakistan. In June 2026, a man in Bahawalnagar was arrested for allegedly creating an AI-generated obscene video of a female TikToker and uploading it to social media. The incident demonstrates how AI can be used to fabricate content involving a real person, creating a form of harm that is fundamentally different from conventional online harassment.
PECA provides a legal framework to deal with cybercrime, but it was designed to cater to the hazards that technology and its misuse could create at the time of its enactment. The rampant use of deepfakes, AI-generated impersonation and voice cloning further demonstrates that the existing legal framework may no longer be sufficient to address every hazard arising from the use of AI. Pakistan need not be afraid of the advancement of AI, but rather of its adverse consequences. The law must evolve with technology so that the evolution of technology does not come at the expense of privacy, dignity and individual rights. AI is already a reality of our lives. The law cannot afford to remain a step behind. Technology will not wait for the law. The question is whether Pakistan will.