Private Use Ends Where an Escaped File Would Do Harm

Which AI generation for one's own use is the maker's to decide, and which rules against it are justified

Position note · private generation, copyright, sexual deepfakes, the risk a stored file carries, and the rules that follow

Andraž Đurič

Version 1 · September 2026

Abstract

This note asks which AI-generated media made for the maker's own use, on the maker's own devices, is the maker's to decide. The line it draws is not private versus shared. It is what an output would do to someone else if it left the maker's control. A private feature-length adaptation of a copyrighted comic falls on the permitted side: one copy displaces no identifiable sale and presents nothing to anyone. A sexual image of an identifiable real person, made without consent, is the hard case. Whether making it privately wrongs that person is contested, and the side holding that it does is currently the weaker one. What separates the file from a fantasy is that the file persists and can escape, that no one can know in advance which files will stay contained, and that the setback if one escapes is severe and cannot be undone. Relative to a polity's persistence conditions, ordered by the leximin floor, a narrow rule against creating such images is justified, and broad bans on private generation are not. The United Kingdom has enacted such a rule. The EU directive that member states, Slovenia among them, must transpose by 14 June 2027 does not require one.

STANDING A position note. Its normative claims are indexed to a named bearer (§5). Whether a private deepfake wrongs the depicted person is left open; the rule-level result does not depend on the answer. The philosophical literature on deepfakes was reviewed at abstract level unless marked otherwise in the references. The legal texts were checked against primary sources except where marked.

1. The claim under test

The corpus forecasts a market of one: cinema generated on demand for a single viewer (The Death of Generic Media). In that regime most generation is private. The claim under test is the one a maker in that regime would state: what I generate on my own devices, with my own local software, for my own use, is mine to decide.

The clean case is a feature-length adaptation of a comic arc, generated locally and watched only by its maker. One such file displaces no identifiable sale. No rightsholder sells a feature-length adaptation made to one viewer's specification. The first licence of a major studio's franchise characters to a consumer video generator, the three-year agreement between Disney and OpenAI announced on 11 December 2025, covers only stills and short-form video. In its announced terms, Marvel characters appear in animated or illustrated form, without actors' likenesses or voices, and long-form video is excluded. The file is shown to no one, so no claim about how the work is presented to the public is engaged. In kind it is imagination carried out with better tools, continuous with drawing a comic's characters or writing fan fiction that stays in a drawer. The rightsholder is a firm. Under the corpus's moral-weight gate (Value as Persistence), a firm's claims run through the people who work for it and own it, and one private file sets none of them back.

Aggregate substitution is a separate question. Cheap private generation, taken together, competes with licensed media for attention; the market-of-one forecast predicts exactly that. The effect attaches to the technology rather than to any file, and its costs fall on markets and livelihoods, which are setbacks that distribution can reach after the fact. It belongs to the distribution question the corpus treats on its own terms (Directed Automation and the Cost Floor, Part III), not to a rule against private use.

2. A rule that relied on a cost fact

German copyright law separates making an adaptation from publishing it. Under §23(1) UrhG an adaptation may be published or exploited only with the author's consent, and making one is free. §23(2) lists four cases in which consent is required already for the making; the first is the film adaptation of a work (Verfilmung). The commentary literature reports the legislator's reason: the production of a film cannot take place in a private setting. The source given is the explanatory memorandum to the 1965 Act (BT-Drs. IV/270, p. 51); the memorandum itself was not read for this note.

The reason is a fact about cost. In 1965 a film required crews, equipment and capital, so a rule that attached at the making could not reach anyone's private life. Generative video removes the fact and leaves the text. The rule's text now reaches a person who renders an adaptation alone on a home computer, a case its drafters had no occasion to consider. The same should be expected wherever a rule's scope was set by what was expensive: as execution cost falls toward its floor (Directed Automation and the Cost Floor), such rules widen their reach without amendment. Slovenian copyright law is not assessed here.

3. The hard case, and where the act-level question stands

The continuity argument from §1, that private generation is imagination carried out with better tools, applies without change to a sexual image of an identifiable real person, made without consent and never shown to anyone. That image is a sexual fantasy carried out with better tools. Öhman calls this the pervert's dilemma: the intuition that deepfake pornography is wrong is hard to justify without also condemning sexual fantasy, which is not ordinarily condemned. His own resolution finds no morally relevant difference between the two at the level of the individual act and places the wrong at the social level, in the context of gender inequality. The literature since then divides into two groups.

• Accounts on which the private act wrongs the depicted person. Benn (2025) holds that creating sexual imagery of a person requires that person's consent because the image is of them, independent of any act it depicts. Patrone and Viola (2026) hold that non-consensual sexual deepfakes are a direct personal harm even when the depicted person never learns of them, because narratives about a person become parts of that person, and because imagery recognized as fake still shapes viewers' implicit associations. Acocella (2026) holds that immersive virtual-reality versions may violate privacy without any disclosure, while granting that existing privacy frameworks do not establish this for ordinary private deepfakes.

• Accounts on which the serious wrong requires circulation. Story and Jenkins (2023) place the wrong in tampering with a person's social identity through distribution, and judge private creation worrying but possibly not wrong in itself. Rini and Cohen (2022) describe harms of deepfakes in circulation, among them the forced public denial of fabricated recordings and the systematic undermining of a person's memory by repeated fabrications.

Assessment. The first group is currently the weaker side. None of its accounts yet separates a private deepfake from a vivid private fantasy without one of two moves. The first move routes the harm through viewers. In the private case the only viewer is the maker, and a maker's altered perception of the depicted person is also what fantasy produces, so this route separates the cases only by degree; outside the private case it is the escape route of §4. The second move rests the wrong on a difference of degree, vividness or immersion, whose effect on the depicted person is unmeasured and which, taken as the ground of the wrong, would make vivid fantasy wrong in proportion. Benn's consent requirement needs a line between images and imagination, and Öhman argues that materiality alone does not draw one; the abstract-level reading done here does not show where her full text draws it. The first group is not refuted. A measured difference in how private deepfakes and fantasies change a maker's conduct toward the person depicted would carry it, and so would a sovereignty account that brings a person's likeness under their independence. Ripstein's sovereignty principle grounds wrongs without harm in examples involving body and property (trespass without damage, secret medical interference, embezzlement repaid with interest); whether likeness belongs with them is the contested extension. The rule-level result in §6 holds on either answer.

4. A file is not a thought

Whatever the act-level answer, a file differs from a fantasy in one respect that needs no theory of the act's wrongness: it persists and can leave the maker's control. The harm-principle defence of private AI pornography has already been noted to depend on containment (Prindle Institute, 2024). Three facts decide how much that condition can carry.

1. The harmless set can only be identified afterwards. "No harm, now or later" is an outcome settled at the end of a file's existence. No one, the maker included, can sort files into that set in advance.

2. Containment can be raised but not certified. Keeping a machine offline closes the network path. The remaining paths are human: the maker's later self, after a breakup or in anger; people with access to the device; repair, resale, loss and theft; and the handling of devices after the owner's death. For ordinary users a further path is default cloud synchronization, which moves files off a device without a decision. A file outlives the state of mind it was made in, so the decision not to share it has to be made again for as long as it exists.

3. The escape rate cannot be read from cases. Files that never escape leave no record, so every observed case is an escaped one, and the rate of escape per file made cannot be estimated from the cases. This note treats the rate for ordinary makers as not negligible, on the ground of point 2. That is an assumption, not a measurement.

If a file of this kind escapes, the setback to the person depicted is severe and practically irreversible: an intimate image in circulation cannot be recalled.

5. Relata

Every ought in this note names its bearer and the persistence conditions it is indexed to (Name the Relata).

R1, the maker's liberty. Where no other agent's persistence conditions are coupled to an output, including in the case where it escapes, no ought other than the maker's own bears on making it.

R2, the rule. The rule-level ought is borne by a polity, an agent in the sense of What Can Bear an Ought, and is indexed to its persistence conditions. The note takes as a premise that those conditions include the persistence conditions of the polity's members. The ground offered for it: a polity persists through its members, and one that leaves them exposed to severe, irreversible setbacks from one another, with no rule against a separable cause, spends the trust and cooperation it runs on. Options are ordered by the leximin floor in two steps. First, prefer an option under which no party's persistence conditions are set back. Where every option leaves some risk, prefer the option whose worst-placed party is best placed.

R3, the maker to the person depicted. What the maker owes the depicted person directly is a transitive ought. It runs through κ, the coupling density the corpus holds open (Preservation Is a Coupling Problem). This note does not rely on it.

Setback is graded. Persistence is a graded quantity above an absorbing barrier, so a setback here means movement down that gradient, in standing, relationships, work and the capacity to function, not only dissolution.

The leximin floor is domain-bound. It ranks a polity's rule options over the parties the rule touches. It is not a global optimization target.

6. The rule-level result

Applied to a rule against a private activity, the ordering in R2 compares the world with the rule and the world without it. Without the rule, the worst-placed party is whoever an escaped output sets back furthest. With it, the worst-placed party is whoever the rule itself sets back furthest, which includes makers who would never have caused harm. Two conditions decide whether a rule passes.

1. The setback it prevents cannot be repaired after the fact. If distribution, compensation or correction can restore the party later, the polity has an option, allowing the activity and repairing the damage, under which the worst-placed party is better placed than under a ban. Prevention is the only lever for setbacks that cannot be undone.

2. The element that carries the risk is separable from the activity, so that removing it leaves the rule's own worst-placed party only slightly set back.

The two conditions keep the ordering from forbidding nearly everything. Leximin ignores probability, and applied to every residual risk it would bar most activity, since nearly all activity risks a severe outcome for someone. This is the paralysis problem of the risk-imposition literature (Hayenhjelm and Wolff, 2012) and the centre of Harsanyi's objection to maximin (1975). Driving fails condition (b): its risk is not separable from the travel. Market substitution fails condition (a): its setbacks can be reached by distribution.

Case	Party set back if the output escapes	Setback	Repairable after the fact?	Risk element separable?	Rule
Private adaptation of a copyrighted work	The rightsholder, a firm whose claims run through its people	Negligible per file	Yes	Not applicable	Not justified
Sexual imagery of a synthetic person with no real referent	No identifiable person	None to a person	Not applicable	Not applicable	Not justified on this ground
Sexual imagery of an identifiable real person, without consent	The person depicted	Severe	No	Yes: the identifiable person	Narrow rule justified
Non-sexual use of a real person's likeness	The person depicted	Graded by content, usually small	Usually	Yes	No general rule; content that would humiliate or defame moves toward row 3

Row 3 passes both conditions. What the narrow rule removes is the real, identifiable person. Fiction, synthetic persons, consenting partners and imagination all remain, so a maker constrained by the rule loses little, while the party the rule protects faces a setback that cannot be undone. Neither world meets the first step of R2, since the rule lowers the risk without removing it, so the second step decides. An expected-value ordering reaches the same verdict unless the escape rate for ordinary makers is negligible, which §4 gives no ground to assume. The two orderings diverge only where the residual risk is very small and a rule's cost is substantial, and none of the four rows sits there. Every rule of this kind is over-inclusive (Schauer, 1991): it binds makers whose files would never have escaped. The over-inclusion is the price of writing a rule for a population whose harmless members cannot be identified in advance (§4, point 1), and it is acceptable here because what the rule takes from them is small.

The rule should attach at creation, not only at sharing. Under a sharing-only offence, a deliberate share and an escape look the same afterwards, and "it leaked; I never shared it" is available as a defence in every case. Attaching at creation removes that ambiguity and aims at the element that carries the risk.

7. Where the law currently stands

The United Kingdom attaches at creation. Section 138 of the Data (Use and Access) Act 2025 inserted sections 66E to 66H into the Sexual Offences Act 2003. Section 66E makes it an offence to intentionally create a purported intimate image of an adult without consent or a reasonable belief in consent; section 66F covers requesting such an image, whether or not it is made. A reasonable-excuse defence applies. The provisions came into force on 6 February 2026 (S.I. 2026/31).

The European Union attaches at sharing. Article 5(1)(b) of Directive (EU) 2024/1385 requires member states to criminalize "producing, manipulating or altering and subsequently making accessible to the public" material that makes it appear that a person is engaged in sexually explicit activities, without that person's consent, where the conduct is likely to cause serious harm. Recital 19 confirms that production is covered only in so far as the material is subsequently made accessible to the public. Private creation is therefore outside the directive. Fedorczyk (2025) identifies the gap and cites France, the Netherlands, Australia and England and Wales as addressing it more fully. The directive sets minimum rules and leaves member states free to adopt more stringent criminal law (recital 91). Transposition is due by 14 June 2027 (Article 49).

Relative to R2, with Slovenia as the bearing polity, the transposition should extend the offence to creation, as the United Kingdom has. As described by the Slovenian hotline Spletno oko, Slovenia's current provision for sexual images of adults (Article 143 KZ-1, misuse of personal data) attaches at disclosure or publication, and the description does not address fabricated images. The code itself was not checked for this note.

8. Result

Private generation is the maker's to decide whenever nothing it produces could seriously set back another party's persistence conditions if it got out. Where something could, and the setback could not be undone, a narrow rule against the element that carries it is justified, whether or not the maker's private act wrongs anyone.

9. What would change this

• A differentiator between a private deepfake and a vivid fantasy that neither routes through other viewers nor condemns fantasy. Effect: the act-level question in §3 closes against the maker, and the rule gains a second ground. The rule-level verdict stands.

• A measured difference in how private deepfakes and fantasies change a maker's conduct toward the person depicted, the route Patrone and Viola's account opens. Effect: the same as above, by degree.

• Evidence that ordinary makers' files essentially never escape. Effect: the expected-value ordering would no longer support the rule, the leximin ordering still would, and the result would rest on the choice of ordering alone. Such evidence is structurally hard to obtain (§4, point 3).

• A showing that "identifiable" and "intimate" cannot be drafted without catching satire, art or reporting at material cost. Effect: condition (b) weakens, and the rule needs narrower drafting or fails.

• Evidence that single private adaptations displace identifiable sales. Effect: §1 reopens.

Left open: whether the private act wrongs the person depicted (§3); the transitive route R3, which waits on κ; how Slovenian copyright law treats private adaptation; and the distribution effects of aggregate substitution.

References and verification status

1. Acocella, N. M. (2026). The privacy paradox of deepfake virtual reality porn. AI and Ethics, 6, 88. doi:10.1007/s43681-025-00934-y — Immersive deepfake pornography as a possible privacy violation without disclosure; grants that current frameworks do not establish harm from private, unshared deepfakes. Abstract read · September 2026
2. Axios. (2025, 11 December). Walt Disney to invest $1 billion in OpenAI, license characters for Sora. Source — Terms of the licensing arrangement: stills and short-form video only, no voices, no long-form video, a joint committee monitoring user creations. Source checked · September 2026
3. Benn, C. (2025). Deepfakes, pornography and consent. Philosophers' Imprint. PhilArchive — Consent is required for creating sexual imagery of a person because the image is of them, independent of any depicted act. Abstract read · September 2026
4. Data (Use and Access) Act 2025, section 138, inserting sections 66E to 66H into the Sexual Offences Act 2003. legislation.gov.uk — Offences of creating and of requesting a purported intimate image of an adult without consent; in force 6 February 2026 (S.I. 2026/31). Primary text checked · September 2026
5. Directive (EU) 2024/1385 on combating violence against women and domestic violence. Official Journal of the European Union, L, 24 May 2024. EUR-Lex — Article 5(1)(b), recital 19 and recital 91 checked in the primary text; the Article 49 transposition date is taken from two secondary accounts (Fedorczyk, 2025; Wikipedia). Primary text checked · September 2026
6. Fedorczyk, F. (2025). The EU approach to non-consensual sexual deepfakes: criminal law, tech regulation and the risk of fragmentation. Oxford University Research Archive — The directive's sharing requirement leaves private creation outside it; comparison with national approaches. Source checked · September 2026
7. Harsanyi, J. C. (1975). Can the maximin principle serve as a basis for morality? A critique of John Rawls's theory. American Political Science Review, 69(2), 594–606. Source — The objection that maximin gives absolute priority to worst outcomes regardless of their probability. Standard
8. Hayenhjelm, M., & Wolff, J. (2012). The moral problem of risk impositions: A survey of the literature. European Journal of Philosophy, 20(S1), e26–e51. UCL Discovery — The paralysis problem: absolute protection from imposed risk would forbid nearly all activity. Abstract read · September 2026
9. Öhman, C. (2020). Introducing the pervert's dilemma: a contribution to the critique of Deepfake Pornography. Ethics and Information Technology, 22, 133–140. doi:10.1007/s10676-019-09522-1 — The dilemma between condemning deepfakes and permitting fantasy; the resolution at the social level. The author's own summary is at the Oxford Internet Institute. Abstract and author summary read · September 2026
10. Patrone, F., & Viola, M. (2026). Deeply personal. Non-consensual sexual deepfakes as direct personal harm. Philosophy & Technology. doi:10.1007/s13347-026-01107-3 — Non-consensual sexual deepfakes as direct personal harm, including when never discovered by the person depicted. Abstract read · September 2026
11. Prindle Institute for Ethics. (2024, 15 April). Deepfake porn and the pervert's dilemma. Source — The harm-principle defence of private AI pornography depends on its containment. Source checked · September 2026
12. Rini, R., & Cohen, L. (2022). Deepfakes, deep harms. Journal of Ethics and Social Philosophy. PhilArchive — Objectification, illocutionary wronging and panoptic gaslighting as harms of circulated deepfakes. Abstract read · September 2026
13. Ripstein, A. (2006). Beyond the harm principle. Philosophy & Public Affairs. doi:10.1111/j.1088-4963.2006.00066.x — The sovereignty principle and wrongs without harm; the examples cited in §3 are taken from a revised draft. Draft reviewed · September 2026
14. Schauer, F. (1991). Playing by the Rules: A Philosophical Examination of Rule-Based Decision-Making in Law and in Life. Clarendon Press. — Rules as entrenched generalizations, and the over- and under-inclusion that comes with them. Standard
15. Spletno oko, hotline of the Slovenian Safer Internet Centre. Seksting: pravna podlaga. Source — Criminal Code provisions applied to sexual images shared without consent: Article 143 KZ-1 for adults, Article 176 for minors; no treatment of fabricated images. Secondary account
16. Story, D., & Jenkins, R. (2023). Deepfake pornography and the ethics of non-veridical representations. Philosophy & Technology, 36(3). doi:10.1007/s13347-023-00657-0 — The wrong of distribution as tampering with social identity; private creation judged worrying but possibly not wrong in itself. Abstract read · September 2026
17. The Register. (2025, 11 December). Disney turns to dark side, licenses IP to OpenAI for videos, images. Source — The licence excludes actors' likenesses and voices; live-action Marvel and Star Wars characters appear only in animated or illustrated versions. Source checked · September 2026
18. The Walt Disney Company. (2025, 11 December). The Walt Disney Company and OpenAI reach landmark agreement to bring beloved characters from across Disney's brands to Sora. Source — Primary announcement: three-year license, more than 200 characters, Marvel and Lucasfilm characters in animated or illustrated versions. Source checked · September 2026
19. Urheberrechtsgesetz (UrhG), §23. Statute text — Consent required already for making a film adaptation. Primary text checked · September 2026 The legislator's reason is reported, citing BT-Drs. IV/270, p. 51, in the commentary at mein-urheberrecht.de. Secondary account

Verification key: “Primary text checked” means the provision cited was read in the statute or directive itself; “Source checked” means the cited work was located and the relevant passage reviewed; “Abstract read” means only the abstract or an abstract-level summary was reviewed, so the characterization may miss qualifications in the full text; “Draft reviewed” means a pre-publication version was reviewed; “Secondary account” marks a claim about a primary document that was not itself read; “Standard” marks a broadly established source.

Internal lineage

• The Death of Generic Media — the market-of-one forecast this note assumes; its rights requirement covers public media only.
• Directed Automation and the Cost Floor — execution cost falling toward its floor, and distribution treated as its own question (Part III).
• Name the Relata — every ought names its bearer and ends.
• What Can Bear an Ought — the agency gate a polity passes to bear the rule-level ought.
• Value as Persistence — the moral-weight gate applied to the firm in §1.
• Preservation Is a Coupling Problem — κ, the coupling density on which R3 waits.
• Slovenia Is Complicit in a Genocide — earlier use of a polity's own persistence conditions as the bearer of an ought.

Author: Andraž Đurič, Slovenia.

This note inherits the corpus's machinery and does not re-derive it: persistence as a graded quantity above an absorbing barrier, the agency and moral-weight gates, and the is–ought firewall. On any conflict the corpus governs.

Developed through dialogue with Claude (Anthropic), beginning from the author's position that what he generates on his own devices for his own use is his to decide, and from his proposal to rank rule options by a polity's persistence conditions ordered by the leximin floor. The literature supplied adjacent work and vocabulary; the author retains responsibility for the framing, synthesis, claims, and final text. Contributions are assessed by their content rather than their origin.

License: CC BY 4.0.

private use · generative video · copyright · sexual deepfakes · risk imposition · leximin floor · Epistemic Forge