What to Do If Someone Makes a Deepfake of You

Someone made a deepfake of you. Document it. Report it. Use every legal lever you have. The steps are concrete and they work. You are not powerless, and you do not have to handle this alone.

Document Everything Before You Report

Record the evidence before you do anything else. Open the page or app where the deepfake appears. Take a screenshot. Copy the URL. Note the date and time you saw it. If the material is in a private message, save the whole conversation. If it sits on a social network, capture the profile name and every comment thread.

This documentation is your foundation. It proves what was posted, when, and by whom. It preserves evidence for police. Do not edit the screenshots. Keep them original. Store copies in a safe place: a cloud drive, an external hard drive, or both.

What to Record

• The URL or direct link.
• Screenshots of the post, captions, and comments.
• The date and time you first saw it.
• The username or profile of the person who posted it.
• Any messages or threats sent to you about it.

Do not engage with the poster. No replies. No arguments. No demands to take it down. Engagement escalates the situation and can weaken your case later.

Report the Deepfake to the Service That Hosts it

Every major service has a process for reporting impersonation or explicit imagery shared without consent. You do not need a lawyer to file. Go to the safety or help centre and find the report form. Pick the option that fits: impersonation, harassment, or intimate imagery posted without your permission.

Use the evidence you documented. Supply the URL, the screenshots, and a clear description of why the material is non-consensual. State plainly that it is a deepfake. AI-generated fakes are handled differently from real photos on many services, so say so explicitly.

If the imagery involves someone under 18, use the National Center for Missing and Exploited Children's "Take It Down" service. That tool creates a hash, a digital fingerprint, of the image on your own device. The hash is then used to block the file across participating services without you ever uploading the image anywhere. This step is critical for minors.

What to Expect After You Report

Response times vary wildly. Some services act within hours. Others take days. If the material stays up, appeal. Keep a record of your report and every reply you receive. If the service is based in the United States, the TAKE IT DOWN Act may require removal within 48 hours of a valid request. That law, signed on 19 May 2025, covers intimate imagery shared without consent, including AI-generated "digital forgeries." Services had until May 2026 to build the removal process. That deadline has passed. The process should be in place now.

Use Hash-Based Blocking to Stop the Spread

Hash-based blocking is one of the most effective tools you have. It works by creating a unique digital fingerprint of the image or video on your own device. That hash is shared with participating services. They can then block the file from being uploaded or re-uploaded. The original file never leaves your device.

StopNCII.org, run by the UK charity SWGfL, offers this for adults. You upload the image to their site. They generate the hash and distribute it to participating companies. Those companies block the material automatically. This is not reporting. It is a proactive measure to stop the spread before it starts.

For people under 18, NCMEC's "Take It Down" service works the same way. It is designed for minors who have had intimate images shared without consent. Both services are free. Both are confidential. Using them does not require you to surrender control of the image.

Why Hash-Based Blocking Matters

A deepfake online gets copied and shared across services. Reporting one post does not stop re-uploads. Hash-based blocking interrupts that cycle. It is not a complete solution. It is a powerful layer of protection.

Use these services before you report the material to a platform. If you report first, the service may remove the original post. The same file can be re-uploaded later. Hash-based blocking prevents that re-upload.

Request Removal from Search Engines

Even after the original post comes down, search results can linger. Search engines index pages, and those results are visible to anyone. You can request removal of explicit imagery shared without consent from Google Search. Google accepts requests for synthetic images as well as real ones. Provide the URL of the page and confirm the image is non-consensual.

This process is separate from reporting to the hosting service. It removes the search result only, not the underlying page. But it cuts the chance of someone finding the deepfake when they search for your name.

Check other search engines too, though their processes differ. If the material sits on a site that is not indexed, contact the site owner directly. Some sites have abuse forms. Others require a legal request.

When the Material Sits on a Dedicated Abuse Site

Some sites are built to host material shared without consent. They ignore standard reports. In that case, send a legal takedown notice. A lawyer helps here. If you cannot afford one, contact a local legal aid clinic or a nonprofit that assists victims of image-based abuse.

Understand Your Legal Options

The law is catching up. In the United States, the TAKE IT DOWN Act criminalises publishing intimate imagery without consent, including AI-generated "digital forgeries." The person who made or shared the deepfake can face criminal charges. The Act also requires covered services to remove such material within 48 hours of a valid request.

In England and Wales, the Online Safety Act 2023 made sharing intimate images without consent, including deepfakes, a criminal offence from 31 January 2024. If you are in the UK, report the deepfake to the police as a crime.

Beyond criminal law, civil claims exist. Defamation. Invasion of privacy. Intentional infliction of emotional distress. The specifics depend on where you live and the facts of your case. A lawyer can advise on what applies.

When to Contact the Police

Contact the police if the deepfake involves threats, extortion, or harassment. Blackmail with a deepfake is a crime. A sexual deepfake of a minor is a crime. In those situations, call your local police department or go to a station. Bring your documentation.

Do not wait. Evidence disappears. Police may need to act fast to preserve digital records.

Consider the EU AI Act and Other Transparency Rules

If an AI system created or distributed the deepfake, the EU AI Act may apply. The Act imposes transparency obligations, including mandatory disclosure of deepfakes. These obligations apply from 2 August 2026. From that date, anyone who creates or shares a deepfake in the EU must clearly label it as synthetic. The label does not remove the material. It tells viewers the image is fake.

The EU AI Act is specific to the EU, but its reach is broader. If the service is based in the EU or serves EU users, the rules may apply. That can strengthen your case for removal or labelling.

This is general information, not legal advice. For your situation, consult a lawyer who understands the laws in your jurisdiction.

Protect Your Mental Health and Seek Support

A deepfake of you is a violation. Anger, fear, embarrassment: all normal. You do not have to go through it alone. Talk to someone you trust. Consider a therapist with experience in online abuse.

Online communities and nonprofits support victims of deepfakes made without consent. They offer emotional backing and practical advice. You are not to blame for what happened.

If you are in immediate danger, call emergency services. If you are being threatened, do not handle it yourself. Involve the police.