The criminalisation of non-consensual sharing of intimate material under EU law: Harm matters,privacy doesn’t

Introduction

In May 2024, the European Union adopted Directive 2024/1385 (‘the Directive’), the first binding legislation aimed at harmonising the legislative and policy responses to violence against women across all its Member States. ¹ Representing a historic moment for gender equality in the EU, the Directive criminalises widespread forms of cyberviolence, such as cyberstalking, cyber-harassment and incitement to hatred or violence, across the European Union. It also criminalises female genital mutilation and forced marriage. ²

One of its most significant provisions is Article 5, which requires Member States to establish criminal offences relating to a variety of acts. ³ One such behaviour is the non-consensual sharing of intimate material. According to Article 5, Member States shall punish as a criminal offence making accessible to the public, by means of information and communication technologies (‘ICT’), images, videos or similar material depicting sexually explicit activities or a person’s intimate parts, without that person’s consent, where such conduct is likely to cause serious harm to that person.

The EU’s competence to adopt the Directive was based on judicial cooperation in criminal matters under Article 82.2 of the Treaty on the Functioning of the European Union (TFEU), as well as on Article 83.1 thereof. According to the latter, the European Parliament and the Council have the authority to establish minimum rules and define criminal offences ‘in areas of particularly serious crime with a cross-border dimension, resulting from the nature or impact of such offences, or from a special need to combat them on a common basis’. ⁴ The areas of crime that fulfil the above criterion are listed in Article 83.1: terrorism; trafficking in human beings and the sexual exploitation of women and children, illicit drug trafficking, illicit arms trafficking, money laundering, corruption, the counterfeiting of means of payment, computer crime and organised crime. The non-consensual distribution of intimate material can fall within both computer crime and forms of sexual exploitation, thereby bringing it within the scope of Article 83.1. ⁵

The EU’s authority to establish minimum rules on criminal offences and sanctions is justified by the need to combat forms of criminality recognised as global security threats by the international community and the EU. Article 83.1 reflects this objective, limiting harmonisation to particularly serious crimes with a cross-border dimension. ⁶

Although the Directive represents a significant step towards a more coherent and victim-centred EU criminal law framework, its interpretation gives rise to several questions. One issue that has so far been overlooked in relation to Article 5 is whether Member States can make criminal liability dependent on a privacy element when criminalising the non-consensual sharing of intimate material.

While this may seem a technical question, it has significant implications for the scope of national criminal offences and the effective implementation of EU law. If Article 5 does not include a privacy element, national provisions incorporating it could narrow the Directive’s minimum scope of protection. As a result, implementation of the Directive would be incomplete, as national law would fail to criminalise all forms of conduct that EU law requires to be punishable.

This article argues that the EU criminalisation model does not include any privacy requirement. The Directive reflects a broader shift in the legal conceptualisation of image-based sexual abuse, moving from privacy-based frameworks towards models centred on sexual autonomy and harm. Consequently, Member States cannot make criminal liability dependent on a legitimate expectation of privacy when transposing Article 5. Doing so would narrow the scope of the offence by excluding situations in which intimate material is distributed without consent in circumstances likely to cause serious harm, thereby undermining the Directive’s minimum standard of protection.

Given the aim of this article, other debates concerning Article 5 will not be addressed. For example, it has been suggested that a significant limitation of Article 5 is that it only applies to the distribution or threat of distribution of materials. This means that the non-consensual creation or acquisition of intimate imagery is not covered. ⁷ Another limitation is that the legal protection provided by Article 5 applies only to material made accessible to ‘the public’. This could mean that distribution to the victim’s family, which could have catastrophic consequences, would not be considered public distribution. ⁸

The argument unfolds as follows: Section ‘Conceptualising non-consensual sharing of intimate material and the harms it causes’ revisits the harm caused by the non-consensual sharing of intimate material. Section ‘The criminalisation of non-consensual sharing of intimate material in Italy and Spain’ then outlines how Spain and Italy have criminalised this behaviour. These two legal systems have been selected because they are prime examples of European countries that have criminalised the non-consensual sharing of intimate material by introducing specific offences and incorporating privacy-related elements into them. Finally, Section ‘The criminalisation of non-consensual sharing of intimate material under EU law. Can Member States require a legitimate expectation of privacy?’ analyses Article 5 from textual, systematic and teleological perspectives to determine whether it incorporates a privacy element. It concludes that Article 5 does not include such an element and explores the implications of this finding.

One caveat must be noted. This article takes a strictly lex lata approach, and its argument is logical in nature. It claims that, since Article 5 does not include a privacy element, Member States that introduce such a requirement are narrowing the scope of the Directive and decriminalising conduct that EU law requires to be punished. Therefore, the argument is not affected by how privacy is conceptualised or understood. Consequently, it does not engage in broader theoretical debates on privacy. Furthermore, the article neither argues in favour of nor against the convenience of adopting one model or another.

Conceptualising non-consensual sharing of intimate material and the harms it causes

Non-consensual sharing of intimate material refers to the dissemination of intimate images or videos without the consent of those depicted. It constitutes a form of image-based sexual abuse, ⁹ a broader category encompassing the non-consensual creation, acquisition or distribution of such material. ¹⁰

Building on Kelly’s work, ¹¹ scholars have proposed that image-based sexual abuse comprises a range of practices which, when considered collectively, constitute a single concept. Furthermore, it has been argued that image-based sexual abuse exists on a continuum with other forms of sexual violence. ¹² Consequently, the non-consensual sharing of intimate material constitutes part of a continuum of sexualised harm primarily experienced by women and girls throughout their lives. ¹³

The non-consensual exploitation of intimate images is widespread and follows recurring patterns across jurisdictions. ¹⁴ As with other forms of online violence against women, the non-consensual sharing of intimate material is alarmingly common. For example, in 2020, over 100,000 images of Irish women and girls were leaked online which ultimately led to the introduction of new legislation criminalising all forms of image-based sexual abuse. Comparable experiences have been reported in other countries. ¹⁵ One of the first sites where non-consensual intimate material was shared, ‘IsAnybodyUp’, averaged between 150,000 and 240,000 unique page views per day in 2011. ¹⁶

Depending on how the conduct is defined, estimates of the prevalence of victimisation range from around 1 percent in adult or adolescent samples to 6 percent (adults) and 32 percent (young adults). ¹⁷ This wide variation reflects the different forms of non-consensual sharing behaviours. For example, posting an image online or distributing an image through social media is associated with relatively low rates of perpetration compared to sharing images privately. Victimisation is more prevalent among young adult women and among those who identify as part of a sexual minority. ¹⁸

Non-consensual dissemination can affect victims’ professional and educational opportunities. ¹⁹ As employers increasingly rely on online searches to screen candidates, the presence of intimate material may lead to adverse decisions based on perceived lifestyle, past online behaviour or reputational concerns. ²⁰

The psychological consequences are equally severe. ²¹ Victims frequently experience anxiety, depression ²² and post-traumatic stress disorder, alongside a loss of self-esteem, confidence and control over their bodies. ²³ Many report long-term trust issues and persistent emotional distress. ²⁴

The above negative consequences are exacerbated by new technologies’ unprecedented power to facilitate novel forms of social shaming that transcend geographic borders and reach diverse audiences at great speed. ²⁵ Once intimate material has been disseminated online, it can be copied, re-uploaded and redistributed indefinitely, rendering effective removal almost impossible. The technological dimension of this issue fundamentally alters the scale and duration of the harm caused, setting the non-consensual sharing of intimate material apart from offline forms of reputational damage or sexual exploitation. ²⁶ These harms are not limited to damage to one’s public image. Instead, they stem from the involuntary exposure of sexualised aspects of the self, which strikes at the core of personal sexual self-determination.

Unlike classic privacy violations, which focus on unauthorised access to information, this conduct turns sexuality into a means of coercion. Its wrongfulness cannot be fully captured by reference to confidentiality alone.

Understanding the distinction between privacy-based wrongdoing and violations of sexual autonomy is crucial for grasping the evolving legal responses to the non-consensual sharing of intimate material. Privacy-based approaches traditionally focus on controlling access to personal information or secluded spaces, and therefore tend to consider the circumstances in which the material was created. However, autonomy-based approaches take a different path. As sexual autonomy relates to an individual’s ability to decide how their sexuality is expressed, represented and perceived by others, these approaches focus on the perpetrator disseminating material without consent and the resulting harm. ²⁷

The criminalisation of non-consensual sharing of intimate material in Italy and Spain

The following section outlines how both Italy and Spain have criminalised the non-consensual sharing of intimate material. As will be demonstrated, both countries have incorporated privacy-related elements into the relevant criminal offences.

The criminalisation of non-consensual sharing of intimate material under EU law. Can Member States require a legitimate expectation of privacy?

Does Article 5 of the Directive incorporate a privacy-based element? If not, national provisions that incorporate such a requirement, like those in Spain and Italy, could narrow the minimum scope of protection set out in the Directive. Consequently, implementation of the Directive would be incomplete since national law would fail to criminalise all forms of conduct required by EU law to be punishable. Several arguments support the conclusion that the Directive does not contain a privacy-based element. Therefore, Article 5 establishes an independent obligation to criminalise the non-consensual sharing of intimate material, irrespective of whether the victim’s privacy has been breached.

First, the wording of Article 5 does not support the inclusion of a privacy-related element. As stated, the provision requires Member States to ensure that making material depicting sexually explicit activities or the intimate parts of a person accessible to the public by means of ICT, without that person’s consent, is punishable as a criminal offence where such conduct is likely to cause that person serious harm.

The text identifies three key elements: (1) conduct involving the making of material accessible to the public through ICT; (2) lack of consent from the person depicted; and (3) likely causation of serious harm. There is no reference to privacy, to the circumstances in which the material was produced or to any requirement that the victim possessed a legitimate expectation of privacy. Nor does the provision require that the material was created with the intention that it remain private.

Moreover, the use of the broader formulation ‘images, videos or similar material depicting sexually explicit activities or the intimate parts of a person’ suggests an intention to cover such material, regardless of the context in which it was produced. The decisive factor is the absence of consent for dissemination, rather than any privacy expectations at the time the material was created. From a purely textual perspective, therefore, there are no arguments suggesting that the offence set out in Article 5 includes an element of privacy. In fact, the Directive suggests the opposite, as Recital 19 states that the offence defined in the Directive should cover all types of material, including images, photographs, videos, audio clips and video clips, whether sexualised or not. The offence should cover situations where material is made accessible to the public via ICT without the victim’s consent, regardless of whether the victim consented to the creation of the material or transmitted it to a specific person.

Second, a systematic analysis of the Directive confirms that Article 5 is situated within a framework that protects sexual autonomy and integrity, rather than privacy. The aim of the Directive on combating violence against women and domestic violence is to standardise criminal responses to gender-based violence affecting women. Its substantive provisions address offences such as rape, sexual harassment and other forms of sexual exploitation, all of which focus on violations of sexual autonomy.

Classifying the non-consensual sharing of intimate material as an offence alongside these other offences is a deliberate choice. Unlike the Spanish and Italian models, the Directive considers the criminalised conduct a form of sexual or gender-based violence rather than an invasion of privacy. ⁵⁸ Consequently, under the Directive model, the harm caused by such acts stems from the violation of the victim’s right to sexual self-determination rather than from an invasion of privacy.

In this context, a privacy requirement would be unwarranted as it would suggest that victims whose intimate material was produced in semi-public spaces or via unsecured digital communication channels are not entitled to protection, even though the emotional, reputational and psychological harm they experience is similar. Such an interpretation would undermine the Directive’s framework, which focuses on the non-consensual nature of the act as the key factor in determining wrongfulness.

Moreover, introducing a privacy requirement at a national level could lead to the reintroduction of victim-blaming dynamics. Assessments of whether an expectation of privacy was ‘reasonable’ often scrutinise the victim’s behaviour, including their choices regarding self-representation, intimacy and digital communication practices. Such evaluative judgements are particularly problematic in cases involving women, whose sexual expression is often subject to greater moral scrutiny. By removing privacy expectations from the core definition of the offence, Article 5 decisively shifts responsibility onto a lack of consent. In this regard, some scholars have pointed out that the Directive ‘expressly rejects the victim-blaming approach adopted by some Member States, which consider the victim’s consent to the creation of the material when defining the offence; moreover, it avoids limiting punishment to cases where the offender acts with the intention of harming the victim’. ⁵⁹

Third, the Directive’s harm requirement, that is, that the conduct must be likely to cause serious harm, already performs the limiting function that a privacy element might serve. According to Recital 18, ‘when assessing whether the conduct is likely to cause serious harm, the specific circumstances of the case should be taken into account, without prejudice to judicial independence. The likelihood of causing serious harm can be inferred from objective factual circumstances. This Directive establishes a minimum legal framework in that regard, and Member States are free to adopt or maintain more stringent criminal rules’. ⁶⁰

The harm requirement allows national legislators to limit criminal liability to cases where the dissemination of material is severe enough, without making protection contingent on a reasonable expectation of privacy. The harm requirement in Article 5 plays a qualitatively different role in a privacy-based limitation. While privacy acts as a binary gatekeeper, harm operates as a graduated criterion, enabling national authorities to evaluate the practical impact of dissemination. This approach is better suited to capturing the realities of the non-consensual sharing of intimate material. By focusing on harm rather than secrecy, the Directive links criminal liability to the severity of the consequences rather than to formal notions of spatial or informational privacy.

Fourth, one of the purposes of the Directive is to harmonise Member States’ criminal laws on gender-based violence, thereby ensuring that victims receive equivalent protection across the EU. In this regard, Recital 17 states that it ‘is necessary to provide for harmonised definitions of offences and penalties regarding certain forms of cyber violence where violence is intrinsically linked to the use of information and communication technologies (“ICT”) and those technologies are used to significantly amplify the severity of the harmful impact of the offence, thereby changing the characteristics of the offence’.

Allowing Member States to include a legitimate expectation of privacy requirement could undermine this goal of harmonisation, as it would create differences between national legal systems by enabling some Member States to exclude cases where the material was created in non-private settings, or where the victim’s privacy expectations were deemed unreasonable. Conversely, other Member States would be unable to introduce such a requirement. As a result, victims in different Member States would receive unequal protection for the same conduct, thereby contradicting the purpose of the aforementioned Directive.

This conclusion is reinforced by the need to implement EU criminal law effectively. Member States must ensure that national measures do not render EU obligations ineffective or overly challenging to fulfil. Introducing a legitimate expectation of privacy requirement could render Article 5 ineffective by excluding cases where harm is most severe, but privacy expectations are contested or deemed unreasonable. This would shift the focus from the perpetrator’s lack of consent to the victim’s behaviour and situational choices, thereby reintroducing the kind of normative judgements that the Directive appears designed to avoid.

In closing, textual, systematic and teleological arguments all reinforce the conclusion that Article 5 does not include any privacy requirement or element concerning the intimate material. Consequently, when transposing Article 5 of the Directive and criminalising the non-consensual sharing of intimate material, Member States cannot make criminal liability dependent on a privacy element. Introducing such a requirement would narrow the scope of the offence by excluding situations in which intimate material is disseminated without consent in circumstances likely to cause serious harm, even though such conduct falls within the scope of Article 5.

This interpretation has an immediate consequence: national provisions that make criminal liability dependent on a privacy requirement could conflict with the Directive. As illustrated in Section ‘The criminalisation of non-consensual sharing of intimate material in Italy and Spain’, the offences in both Italy and Spain incorporate elements that function as privacy-based limitations. In Italy, Article 612-ter requires that the material be intended to remain private. Meanwhile, in Spain, Article 197.7 of the Criminal Code links criminal liability to the dissemination of material obtained in a home or elsewhere, out of the sight of third parties. To effectively implement EU law, the Italian and Spanish legislatures may need to reconsider the structure of their respective offences. Legal provisions that make criminal liability dependent on a privacy element exclude cases that fall within the Directive’s minimum scope of criminalisation. To align national law with the EU model, the offence must be decoupled from privacy-based requirements and focus instead on the elements identified in Article 5: absence of consent and likelihood of serious harm. Eliminating the privacy requirement would not result in unlimited criminal liability, since the Directive’s harm threshold already acts as a limiting criterion.

Conclusions

This article has shown that Article 5 of Directive 2024/1385 does not include a privacy requirement. Therefore, Member States cannot make criminal liability dependent on a privacy element when transposing Article 5 of Directive 2024/1385.

Article 5 focuses on three elements: dissemination, lack of consent and likelihood of serious harm. It does not refer to the circumstances of production or to any expectation of privacy. None of these elements refers to the circumstances in which the material was produced, or to whether there was a legitimate expectation of privacy.

A broader interpretation of the Directive supports this conclusion. As it forms part of an instrument aimed at combating violence against women and domestic violence, the offence of non-consensual sharing of intimate material is framed as a form of gender-based cyberviolence rather than a traditional privacy violation. This reflects a shift in norms away from secrecy-based rationales and towards protecting sexual autonomy and dignity. Within this framework, introducing a privacy requirement would be conceptually inconsistent, as protection would depend on the circumstances in which the material was produced rather than on the perpetrator’s decision to disseminate it without consent.

The harm requirement in the Directive further reinforces this interpretation. Article 5 already provides a mechanism for restricting the scope of criminal liability, limiting criminalisation to situations where the dissemination of material is likely to cause serious harm. This criterion allows national authorities to differentiate between less harmful behaviour and cases where dissemination results in significant psychological, reputational or social consequences. Consequently, there is no need to rely on privacy as an additional gatekeeping concept.

A comparative analysis of Italy and Spain illustrates the practical significance of this issue. In both countries, criminal liability for non-consensual sharing of intimate material is linked to the existence of a protected private sphere. In Italy, Article 612-ter of the Penal Code requires that the material be intended to remain private. Similarly, Article 197.7 of the Spanish Criminal Code criminalises the non-consensual sharing of intimate material obtained with the victim’s consent, provided that the material was taken in a home or elsewhere out of the sight of third parties. While these provisions aim to address the harms caused by the non-consensual sharing of intimate material, their reliance on privacy-based criteria may limit the scope of protection compared to the model adopted by the Directive.

If Article 5 is interpreted as this article proposes, Member States that incorporate privacy requirements into their domestic offences may fail to criminalise certain conduct within the minimum scope of application of the Directive. Situations in which intimate material is disseminated without consent and is likely to cause serious harm could fall outside the scope of national offences simply because the circumstances in which the material was created do not satisfy a privacy threshold. From the perspective of EU law, such limitations may constitute an incomplete transposition of the Directive.

Consequently, ensuring effective implementation of Directive 2024/1385 may require Member States to reconsider criminalisation models that rely on privacy as a condition for liability. Aligning national offences with the Directive’s structure, therefore, requires focusing on the absence of consent and the likelihood of serious harm rather than on whether the victim could reasonably expect the material to remain private.