By
Stuart Kerr, Technology Correspondent,
LiveAIWire
When actor Bryan Cranston successfully pushed OpenAI to tighten consent controls inside Sora 2, its AI video generation tool, the outcome was covered as a good-news story about a famous performer winning a reasonable argument. What it actually represented was something more structurally significant for deepfake governance: the first time a creative worker had shifted an AI company’s platform governance position through organised professional advocacy rather than legislation, regulation or litigation alone.
That distinction matters for everyone whose likeness, voice or creative output is at risk of being replicated by AI systems that are becoming simultaneously more capable and more accessible. The deepfake problem has become a mainstream policy challenge faster than anyone in the entertainment industry anticipated, and the Cranston moment established a deepfake governance template that other professional groups are already examining for their own situations.
What Cranston Actually Won
Cranston’s specific concern was that Sora 2’s consent architecture, as initially designed, allowed users to generate video content using realistic likenesses of identifiable individuals without first obtaining consent from those individuals. The platform operated on an opt-out model: harm could occur unless specific individuals had been proactively added to a block list, which placed the burden of protection on the person at risk rather than the person seeking to use a likeness.
Cranston raised the issue through SAG-AFTRA, Hollywood’s principal performers union, which had been tracking AI-generated likeness concerns systematically since the 2023 strike. OpenAI’s response was to shift Sora 2’s default consent architecture toward a model that requires affirmative consent signals before recognisable individual likenesses can be generated. Trade publications Variety and Deadline confirmed the architecture change. Business Insider reported that OpenAI simultaneously threw its support behind the proposed NO FAKES Act, the federal legislation that would create a private right of action for individuals whose AI-generated likenesses are used without their consent.
The consent architecture shift is the detail that carries the most long-term significance for deepfake governance. Platform defaults determine the majority of user behaviour at scale. An opt-out system allows harm to occur and then requires remediation after the fact. An opt-in system prevents the harm before it occurs. The difference between those two states, operating across a platform serving millions of users, is not marginal. It is the difference between a governance framework that functions and one that requires constant enforcement against a volume of violations that no moderation team can keep pace with.
The Research That Explains Why the Stakes Are High
The urgency behind Hollywood’s response to deepfake governance is not only about income protection or reputation management for individual performers, though both are real. It is also driven by research showing that deepfake content causes durable belief change even when audiences are explicitly told they are watching fabricated material before they watch it.
A study published in January 2026 by researchers Simon Clark and Stephan Lewandowsky at the University of Bristol, published in the peer-reviewed journal Communications Psychology, found across three preregistered experiments involving 673 participants that most people relied on the content of a deepfake video even after being explicitly warned it was fake. Participants updated their beliefs about the people depicted based on the video content even when they reported believing the warning. The effect was present and significant even for individuals who said they knew the material was fabricated.
That finding has profound policy implications that are not yet reflected in most current legislative approaches. If warnings do not neutralise the influence of deepfake content, then regulatory frameworks that focus primarily on labelling, disclosure and transparency are addressing a problem that may be structurally unsolvable through disclosure mechanisms alone. Prevention at the point of creation, platform consent architecture requirements and criminal liability for production are the policy tools that the research evidence actually supports for effective deepfake governance. Labelling is necessary but not sufficient.
Where the Law Stands as of October 2025
Legislative progress on deepfakes in the United States has accelerated substantially in 2025. The TAKE IT DOWN Act, which makes it a federal offence to knowingly publish non-consensual intimate imagery including AI-generated synthetic images, passed the Senate and House with strong bipartisan support and was signed into law in spring 2025. It requires platforms to remove flagged content within defined timelines and gives affected individuals a statutory basis for demanding removal that did not previously exist at the federal level.
The NO FAKES Act, which addresses a broader category of AI-generated likeness use including entertainment, commercial and political applications, was still under active legislative consideration as of October 2025. SAG-AFTRA, major talent agencies and a coalition of entertainment industry bodies have been among its most consistent advocates, arguing that federal legislation is the only mechanism capable of creating a consistent, enforceable consent framework across state jurisdictions that currently vary considerably in scope and enforcement capability.
In Europe, the EU AI Act, which requires visible labelling on AI-generated content depicting identifiable individuals, was in active national implementation as of autumn 2025. Enforcement responsibility sits with national competent authorities, which means the practical experience of those requirements will vary across member states for the foreseeable future. Deepfake governance at the platform level, of the kind Cranston influenced, is moving faster than either of these legislative tracks.
The Volume Problem No Policy Is Keeping Up With
Policy processes move at the speed of legislative chambers. Deepfake technology moves at the speed of model releases. The gap between the two is not narrowing, and the actual scale of the problem is essential context for evaluating whether current governance frameworks are proportionate to the challenge.
According to data from cybersecurity firm DeepStrike, the number of deepfake videos accessible online grew from approximately 500,000 in 2023 to around 8 million by 2025, representing an annual growth rate approaching 900 percent. Voice cloning has crossed what researchers have called an indistinguishable threshold: a few seconds of audio are now sufficient to generate a synthetic voice complete with natural intonation, breathing patterns and emotional inflection. Major retailers have reported receiving more than 1,000 AI-generated scam calls per day using cloned executive voices.
The entertainment industry’s concern about performer likeness exists alongside but is distinct from the broader fraud and misinformation threat. Both are serious. Both are worsening faster than most governance frameworks are designed to address. What the Cranston moment established is that targeted professional advocacy from an organised constituency can move platform consent architecture on a faster timeline than legislative processes typically allow. Other professional communities facing equivalent risks are aware of this and are watching closely.
What the Precedent Means for Other Professions
The Cranston moment was specific in its context but general in its mechanism. A professional union identified a concrete governance gap in a platform used at scale by its members’ potential adversaries. It made a specific, technically coherent demand about consent architecture rather than a general objection to AI. The platform’s commercial and reputational incentives aligned with compliance. And the change was made.
That mechanism is available to professional communities well beyond Hollywood. Journalists whose likenesses, reporting styles and on-air personas can be replicated. Politicians whose voices and faces are among the most targeted for political deepfake campaigns. Educators whose recorded lectures are being used without consent to train commercial AI products. Executives whose voices are being used in fraudulent financial scam calls. Each of these groups has the professional organisation structure, the affected membership constituency and the specific deepfake governance demand necessary to run the same play.
For context on how AI is intersecting with the legal and law enforcement dimensions of deepfake harms, our analysis of whether AI is transforming law enforcement and why the evidence is troubling covers the investigative and evidential challenges that deepfake proliferation creates for authorities. And for a wider view on who controls AI capabilities and on what terms, our piece on the open-source AI dilemma between freedom and governance addresses the commercial and political dynamics that shape platform decisions like the one Cranston influenced.
The deepfake governance story is not resolved, and the Cranston precedent does not resolve it. What it demonstrates is that individuals and professional communities are not limited to waiting for legislation. Platform architecture can move faster than law when the right pressure is applied to the right lever by an organised constituency with a credible case. That knowledge is now part of the toolkit.
About the Author
Stuart Kerr is Technology Correspondent at LiveAIWire, covering artificial intelligence, cybersecurity, and the social impact of emerging technology. He publishes daily at LiveAIWire.com.