Deepfakes and impersonation

How the law usually works

A deepfake is digitally altered or AI-generated audio, video, or image that appears to depict a real person. Impersonation can also involve fake accounts, altered emails, cloned voices, or messages sent in another person’s name.

Several legal theories may apply at the same time:

• Defamation: A false statement presented as fact that harms your reputation may support a claim. A realistic fake video or audio recording can be evidence of a false publication, but the exact requirements differ by place. Opinions, obvious parody, and truthful statements are generally treated differently.
• Privacy and image rights: Some places protect a person’s name, likeness, voice, private information, or personal data. Others provide narrower protection unless the material is intimate, commercially exploited, or obtained unlawfully.
• Non-consensual intimate imagery: Sexual deepfakes may be covered by laws addressing the sharing or creation of intimate images without consent. The law may apply even when the image is entirely fabricated.
• Harassment, stalking, and threats: Repeated targeting, threatening communications, or conduct that causes fear or serious distress may be criminal or civil misconduct.
• Fraud and identity-related offences: Impersonation used to obtain money, access accounts, deceive customers, or cause another person to act may amount to fraud, identity theft, or computer misuse.
• Data protection: Creating or distributing a fake that uses your face, voice, or other identifying information may raise data-protection issues, particularly when an identifiable person’s data is processed or published.
• Platform rules: Social-media and hosting services commonly prohibit impersonation, harassment, sexual exploitation, and deceptive manipulation. Platform removal is separate from a court claim or police investigation.

Truth, consent, satire, journalism, public interest, and freedom of expression can affect the result. A platform may remove material under its rules even when a legal claim would be uncertain.

Common processes

If the material involves an immediate threat, extortion, sexual abuse, or a risk of physical harm, people commonly contact emergency services or police first. They avoid meeting or confronting a threatening person alone.

1. Preserve evidence. People commonly save screenshots, screen recordings, URLs, usernames, account IDs, dates, messages, and evidence of sharing or harm. They preserve the original files where possible and avoid editing them. A written timeline can help show when the material appeared and what happened afterward.

1. Report the content and account. The person commonly uses the platform’s impersonation, privacy, intimate-image, harassment, or copyright reporting process. Reports usually identify the exact posts and explain why the material is unlawful or violates the platform’s rules. A request may also be made to search engines to remove a result from search listings, although that does not necessarily remove the original content.

1. Secure accounts and identity information. Common steps include changing passwords, enabling multi-factor authentication, checking account recovery details, warning trusted contacts, and reviewing financial or email activity. If money or identity documents are involved, people commonly contact the bank, payment service, or relevant identity-fraud reporting body.

1. Send a preservation or removal request. A lawyer or authorized representative may contact the platform, website operator, or person who posted the material. The request can ask for removal, preservation of logs, and confirmation of the account holder’s information. A formal legal notice is not automatically effective and should not contain threats that are unlawful or misleading.

1. Report suspected crimes. People commonly report threats, stalking, fraud, non-consensual intimate imagery, or hacking to local police or a specialized cybercrime agency. Authorities may request the original files, device information, account records, and a chronology.

1. Consider civil remedies. Depending on the jurisdiction, possible claims include defamation, privacy misuse, misuse of private information, harassment, breach of confidence, passing off, or interference with business. A court may be able to order removal, prohibit further publication, require disclosure of an anonymous poster’s identity, or award damages.

Deadlines and time limits

Civil claims often have short limitation periods. Defamation claims commonly have deadlines of about one year in England and Wales and many United States jurisdictions, while Canadian and Australian periods vary by province, territory, or state and are often around one to three years. Privacy, harassment, contract, and personal-injury claims may have different periods.

Criminal reports may not have the same civil limitation period, but delay can affect evidence, account logs, and the ability to identify an anonymous user. Platform reporting deadlines can also apply, especially for intimate-image complaints or appeals.

The applicable period can depend on where you live, where the publication occurred, when you discovered it, whether it was republished, and whether the defendant is identifiable. Sources commonly recommend confirming the deadline with the relevant court or a licensed attorney where you live.

Documents that usually matter

Useful material commonly includes:

• Original images, videos, audio files, and metadata, if available
• Screenshots and screen recordings showing the full page, account, date, and URL
• Copies of messages, emails, payment requests, or threats
• A chronology of creation, publication, reporting, and resulting harm
• Evidence of lost work, cancelled opportunities, medical treatment, or financial loss
• Proof of identity and evidence showing why the account or material is falsely associated with you
• Platform reports, automated responses, appeal results, and removal notices
• Police or cybercrime reference numbers
• Records showing consent, lack of consent, or requests to stop publication

People commonly keep an untouched copy separately from working copies and avoid forwarding unlawful intimate material unnecessarily.

How it differs by jurisdiction

United States: Defamation and privacy law is mainly state-based, and the First Amendment strongly protects truthful speech, opinion, parody, and some matters of public concern. The federal Violence Against Women Act includes a civil remedy for certain non-consensual sharing of intimate images, and federal criminal laws may apply to threats, fraud, hacking, or extortion. State laws increasingly address synthetic or non-consensual intimate images, but their coverage differs. Section 230 of the Communications Decency Act often limits claims against online services for user content, although it does not prevent all platform action or all claims based on a service’s own conduct.

England and Wales: The Defamation Act 2013 applies to defamation claims, including requirements concerning serious harm and available defences. Privacy claims may arise through misuse of private information, breach of confidence, data-protection law, or harassment law. The Online Safety Act 2023 gives Ofcom responsibilities concerning regulated online services, and criminal offences may apply to threats, fraud, stalking, harassment, and certain intimate-image conduct. Remedies and procedures depend heavily on the type of claim.

Canada: Defamation, privacy, and civil procedure are largely provincial or territorial, while criminal law is federal. The Criminal Code includes offences that may apply to identity fraud, criminal harassment, extortion, threats, unauthorized computer use, and non-consensual distribution of intimate images. Some provinces have privacy statutes or civil causes of action for privacy invasion. Charter protections for expression may affect the balance between reputation and speech.

Australia: Defamation is governed by substantially harmonized state and territory legislation, including the Defamation Act 2005 statutes. The federal Privacy Act 1988 may apply to covered organizations, but not every individual or small operator. Federal criminal law and state or territory offences may address fraud, stalking, threats, image-based abuse, and computer offences. The eSafety Commissioner has reporting and regulatory functions for certain serious online harms.

When people consult a lawyer

Legal advice is especially useful when the material:

• Shows sexual content, children, violence, or serious threats
• Is being used for blackmail, extortion, fraud, or workplace harm
• Has been widely shared or is damaging employment, business, or public reputation
• Comes from an anonymous person whose identity may need to be obtained
• Involves a public figure, journalist, employer, school, or government body
• May require an urgent court order
• Has been removed but is continuing to reappear
• Could expose you to legal risk if you publish accusations or retaliate

A lawyer can assess jurisdiction, limitation periods, evidence, takedown options, privacy issues, and whether contacting the poster could make matters worse.