TL;DR On October 7, 2026, Germany's federal cabinet approved Justice Minister Stefanie Hubig's bill against digital violence. It creates new crimes for sexualized deepfakes and damaging deepfakes, each punishable by up to two years in prison, and a court process that can force platforms, web and cloud hosts and group-chat services to preserve data, identify users, remove content and block accounts. The Bundestag still has to pass it.
Germany is moving to make deepfakes a crime. On Wednesday, October 7, 2026, the federal cabinet approved the government's "Gesetz zur Stärkung des zivilrechtlichen und strafrechtlichen Schutzes vor digitaler Gewalt," a bill to strengthen civil and criminal protection against digital violence. Tagesschau and heise both reported the cabinet decision that day, and the Federal Ministry of Justice published the government draft the same day.
Most coverage focuses on the criminal side: sexualized deepfakes, hidden sauna recordings, fake profiles. For a small company, the civil side matters more. If you run a forum, a community feature, a file-sharing product, a web host, or a chat app with group channels, the bill would let a German court order you to freeze data, hand over a user's identity, take content down, or lock an account. This page explains both halves from the draft text and gives a runbook for handling those orders.
Event date: October 7, 2026 (cabinet decision). First reports: October 7, 2026 (tagesschau, heise, Spiegel). We read the government draft published by the ministry.
What the cabinet approved
The bill has two parts. Article 1 creates a new standalone statute, the Gesetz gegen digitale Gewalt (GgdG). Article 2 amends the Criminal Code (StGB). The ministry first published a draft on April 17, 2026. Heise reports the government developed that April draft "at central points," adding broader civil claims against platforms such as TikTok, Instagram and Facebook.
Hubig, quoted by tagesschau and heise, said: "Digitale Gewalt ist wie ein Flächenbrand," roughly "digital violence is like a wildfire." She said the law would end "Straflosigkeit für Täter im digitalen Raum," impunity for offenders online.
The bill now goes to the Bundesrat and the Bundestag, heise reports. Nothing is in force yet. Under Article 17 of the draft, most of the law would take effect on the first day of the quarter after it is published. The draft leaves that date blank.
The new crimes
| Section of the Criminal Code | What it covers | Maximum penalty |
|---|---|---|
| 184k (rewritten) | Making or sharing, without authorization, an intimate image of a real person, including a computer-made image that falsely appears to show a specific person nude or in sexual acts | Two years or a fine; three years if the image shows a rape |
| 184k(2) | Accessing, obtaining or possessing a recording of a rape | Two years or a fine |
| 201b (new) | Sharing computer-made or altered content that appears to show a real event involving another person and can seriously damage that person's reputation | Two years or a fine |
| 201c (new) | Sharing damaging content while pretending to be another person, such as through a fake profile | Two years or a fine |
| 202e (new) | Repeated or ongoing covert tracking of someone's location or activity using technology, such as GPS trackers | Two years or a fine |
Four details matter for anyone who builds or hosts generative tools.
First, section 184k reaches production, not only distribution. The draft punishes anyone who "unbefugt herstellt oder einer dritten Person unbefugt zugänglich macht," makes without authorization or makes available to a third person.
Second, section 201b covers damaging deepfakes outside the sexual context, and it explicitly applies when the person shown has died.
Third, the draft keeps exceptions for "Kunst oder der Wissenschaft, der Forschung oder der Lehre, der Berichterstattung über Vorgänge des Zeitgeschehens," art, science, research, teaching and news reporting, in section 184k(5), and extends the same exceptions to 201b and 201c.
Fourth, most of these offenses are prosecuted only on the victim's complaint, unless prosecutors find a special public interest. Spiegel reported that, until now, making and distributing sexualized deepfakes without consent has not been a crime in Germany.
Who gets new duties under the GgdG
Section 1(2) of the new statute defines "Diensteanbieter," service providers, by reference to the EU Digital Services Act. Four kinds are covered:
- Online platforms as defined in DSA Article 3(i).
- Web hosting services that let users publish websites.
- Cloud hosting services that let users store, share and access files.
- Messaging services that are number-independent interpersonal communications services, but only where they allow group communication. A violation in a chat counts only if the group is so large that no single member can control further spread.
Internet access providers are covered separately for identity look-ups. Account blocking applies only to social networks, meaning platforms whose main purpose is users communicating and sharing content.
What a court could order you to do
All of this needs a court order first. The applicant goes to a regional court, the Landgericht, which has exclusive jurisdiction. Here is the sequence in the draft:
| Step | Section | What the provider must do |
|---|---|---|
| 1. Preservation | 3(1)-(2) | Once a disclosure case is pending, not delete the user data, make a copy of the content, and send both to the court "unverzüglich," without undue delay |
| 2. Notify the user | 6(2) | If the court does not know the user, tell the user about the case, which content is challenged, with dates and screenshots, and the court's deadline. Let the user reply anonymously or under a pseudonym, confirm to the court that notice was given, and forward replies |
| 3. Disclosure | 2 | If ordered, give the victim the user's name, date of birth, address, email, phone number, the IP address and port used, timestamps with time zone, and a copy of the content |
| 4. Deletion of the data | 3(5) | After the case ends, irreversibly delete the preserved data and copy |
| 5. Content removal | 4(5) | For social networks, remove the unlawful content if a court orders it |
| 6. Account block | 4(1)-(3) | For serious violations with a risk of repetition, block all known accounts of the user for a reasonable period. A blocked user cannot post, comment or share, but read-only use should remain. The provider must stop the user opening new accounts during that period where technically and economically reasonable |
Some process points make this workable for a small team. The provider is a party to the case. Courts may send informal documents by email to the single point of contact you already named under DSA Article 11. Appeals must be filed within two weeks. Disclosure cases are handled with priority.
Non-EU social networks need a German contact
Section 9 requires social networks with no EU home country to name an authorized recipient in Germany "spätestens mit Anbieten des Dienstes," at the latest when they start offering the service there, and to point to that person clearly in the product. Section 10 sets a fine of up to 500,000 euros for failing to do so, enforced by the Federal Office of Justice. A court can also order an EU-based network to name a German recipient for a pending case. The same draft repeals the Network Enforcement Act (NetzDG), whose recipient rule this replaces.
Reactions
Bitkom, the German digital industry association, welcomed the bill. Its managing director Bernhard Rohleder told heise it was overdue and said a quarter of people in Germany have experienced digital violence, 43 percent among 16- to 29-year-olds. Civil liberties groups are more critical. Heise reports the Gesellschaft für Freiheitsrechte had warned that broader disclosure claims could undermine anonymous speech, and that account blocks could lead to overblocking. The German Judges' Association's Sven Rebehn told tagesschau that new laws alone are not enough without more judges.
Runbook: handling a German digital violence court order
If you run a product in one of the four categories, prepare now. The draft can still change, but the steps below match its current structure. Have counsel review before use.
GgdG Court Order Runbook (draft, review with counsel)
Owner: [name, role] Backup: [name, role] Last reviewed: [date]
0. Intake
- Orders may arrive by email at our DSA Art. 11 point of contact: [address].
- Log: court, file number, date received, order type, deadline.
- Non-EU social network? Confirm our German authorized recipient: [name].
1. Preservation order (GgdG s. 3)
- Freeze deletion for the named account: profile data, IP address and port
used for the post, last-access IP and time with time zone, phone number.
- Make a copy of the challenged content.
- Send data and copy to the court in text form without undue delay.
- Do NOT send this data to the applicant before the court allows it.
2. User notice (GgdG s. 6)
- If the court instructs us, notify the user: case type, content and dates,
screenshots (none if the content itself is illegal to possess), requests
made, and the court's deadline.
- Provide a way to reply anonymously or under a pseudonym: [channel].
- Confirm to the court that notice was sent. Forward any reply.
3. Disclosure order (GgdG s. 2)
- Release only the data fields the court lists, only once the order is final.
4. Removal or account block (GgdG s. 4)
- Removal: take down the specified content, keep a record.
- Block: disable posting, commenting and sharing for the period set.
Keep read-only access. Watch for new accounts by the same user where
technically and economically reasonable.
5. Close-out (GgdG s. 3(5))
- When told the case is final, irreversibly delete preserved data and copy,
unless another legal duty requires keeping it. Record the deletion date.
6. Appeal check
- Decide within days whether to appeal. The appeal window is two weeks.
If your product generates images or video, also review your own rules. Our acceptable use policy template has a section for prohibited outputs, and the AI incident response plan template covers how to log and escalate a harmful output. Labeling duties for AI-generated content under EU law are separate; see our EU AI Act Article 50 guide.
For comparison, the US is moving through the courts rather than the criminal code: Minnesota's ban on nudification apps is paused while xAI's challenge proceeds, as covered in our xAI Minnesota tracker. In Norway, the government plans a temporary ban on AI glasses in selected places, covered in our Norway AI glasses article. German courts have also been active on AI liability; see the German court ruling on Google AI Overviews.
What we could not verify
We read the government draft (Regierungsentwurf) PDF published by the Federal Ministry of Justice on October 7, 2026, and the ministry's legislative page. Section numbers, penalties, definitions and procedures come from that draft. The translations are ours. Quotes from Hubig, Bitkom and the Judges' Association come from tagesschau and heise, which we opened. We did not read the ministry's FAQ or synopsis documents, or the full Spiegel article beyond its free opening.
The draft does not set a date for parliamentary votes, and its entry-into-force date is left blank. The bill can change in the Bundestag. We have not seen a cost estimate for companies beyond the draft's statement that business compliance costs are small. We found no verified social post from the ministry about the cabinet decision, so this page has no embed.
