Legal Liability of Digital Platforms for Disseminating Deepfake Content that Violates Victims' Privacy and Reputation Rights

Abstract

Indonesian digital platforms cannot yet be held clearly liable for spreading deepfake content that violates victims' privacy and reputation, because platform duties are scattered across several regulations and no deepfake-specific norm exists. Using library research with statutory, conceptual, and comparative approaches, this article analyses the legal basis, forms, and limits of platform liability as electronic system operators (PSE). It finds that the Electronic Information and Transactions Law (Law 1/2024), the Personal Data Protection Law (Law 27/2022), Government Regulation 71/2019, and Ministerial Regulation 5/2020 give a basis for platform duties, chiefly takedown and the operation of reliable and secure systems, but sanctions remain mostly administrative. Civil liability under Article 1365 of the Civil Code and corporate criminal liability still depend on proving negligence without a defined duty of care. Comparison with the United States (TAKE IT DOWN Act), the European Union (DSA and AI Act), and South Korea points toward rules that combine fixed takedown deadlines, transparency duties, and enforceable sanctions. The article recommends deepfake-specific platform duties: notice-and-action with clear deadlines, labelling of synthetic content, re-upload prevention, and victim remedies.