‘Revenge porn’, ‘upskirting’ and ‘deep fakes’ are examples of phenomena currently covered by the already popular umbrella term ‘image-based sexual abuse’ (IBSA). However, the main threat does not lie solely in the actual imagery used to expose, extort or abuse victims, but rather in the ongoing datafication of human communication (including sexual communication) and the emerging opportunities for abuse. We use a wider approach to analyse the larger picture as data-based sexual abuse (DBSA) and define DBSA using three key elements: (1) the non-consensuality of one or more levels of the action, (2) a sexual connotation and (3) the execution of one or more levels by means of digital technology. The analysis of German national criminal law from an international law perspective, however, reveals considerable substantive gaps in criminal liability and challenges when prosecuting in practice. Especially with regard to AI-generated content, the German legislator is called on to expeditiously provide regulations – for this, the existing criminal offence of document forgery (Sec. 267 dStGB) can serve as a blueprint.