Hong Kong's deepfake toolkit is a guide, not a law

Hong Kong’s privacy regulator has just published a toolkit that quietly admits something regulators elsewhere have been reluctant to say outright: the deepfake problem is now a schools problem. The Privacy Commissioner for Personal Data (PCPD) published guidance on the abuse of AI-generated deepfakes alongside the findings of a separate CCTV privacy investigation, on 17 December 2025. The document is aimed squarely at teachers and parents, not platforms or model-makers.

What the toolkit actually contains is telling. The “Abuse of AI Deepfakes: Toolkit for Schools and Parents” sets out risks including cyberbullying, scams and falsified intimate images, and stresses that misusing personal data to create or spread deepfakes can trigger existing civil and criminal liability, including the doxxing offence under the Personal Data (Privacy) Ordinance, which carries fines up to HK$1 million and up to five years’ imprisonment. There is no new offence created here, no licensing regime for face-swapping apps, no obligation placed on the companies that make the tools frictionless to distribute. The regulator’s contribution is explanatory rather than architectural: a reminder that the law already covers this, aimed at the people least equipped to act on that knowledge without help.

The gap being closed here is not legal but practical — awareness, not authority.

That distinction matters because it describes the default posture most jurisdictions have settled into, though it is worth noting the alternative isn’t necessarily neglect: some regulators have chosen targeted rules aimed at non-consensual intimate imagery specifically, rather than general-purpose deepfake law, and Hong Kong’s approach of leaning on the PDPO’s doxxing provisions is itself a form of that targeting. Deepfake generation has become trivial and cheap faster than legislatures have moved, so the interim response is almost always the same: point back to existing fraud, harassment and data-protection statutes, and hand out a guide explaining how they apply to a fifteen-year-old’s phone. It is a sensible stopgap, not obviously a tacit confession of failure — schools and parents are, after all, the people actually managing the day-to-day incidents. But it remains true that nobody yet has a rule reaching the tool itself, only the harm it produces once it has already been used.