1. What Legal Rights Deepfake Victims Have under Federal and State Law
The DEFIANCE Act gives victims of nonconsensual AI-generated intimate imagery the right to sue in federal court without needing to prove commercial motive, public figure status, or a specific financial loss.
The Act covers any digitally altered or AI-generated image or video that depicts an identifiable real person engaged in sexual conduct, in a state of nudity, or with their intimate parts exposed, when the depiction was created or shared without that person's consent. The defendant must have known the depicted person had not consented, or must have acted with reckless disregard of that fact. This standard is significantly easier to meet than the actual malice standard required in defamation cases involving public figures.
Recoverable damages under the DEFIANCE Act include actual damages for the full harm suffered, statutory damages up to $150,000 per violation when actual damages are difficult to quantify, punitive damages in cases of particularly egregious conduct, and attorneys' fees. Each separate act of sharing the content is a potential independent violation, meaning a defendant who posted the content to multiple platforms faces separate damages exposure for each platform.
How State Ncii Laws Fill Gaps the Defiance Act Does Not Cover
The DEFIANCE Act applies specifically to AI-generated or digitally altered intimate imagery. State NCII statutes often cover a broader range of conduct, including authentic intimate images shared without consent, and may provide additional remedies or different procedural advantages depending on the jurisdiction.
More than forty states have enacted nonconsensual intimate imagery statutes. Some states explicitly cover deepfake content in their definitions. Others cover any intimate image shared without consent regardless of whether it was authentic or AI-generated. A victim whose images may include both authentic and synthetic content, or whose case crosses multiple state lines, may have overlapping claims under the DEFIANCE Act and applicable state statutes simultaneously.
State statutes vary in whether they create civil liability, criminal liability, or both. Several states classify NCII as a misdemeanor for a first offense and a felony for repeat violations or conduct targeting a minor. Filing a criminal complaint with local law enforcement alongside a civil lawsuit is not only possible but often strategically important. An attorney who handles cyber harassment and NCII cases can map the applicable federal and state laws against the specific facts and identify which combination of claims produces the strongest legal position.
| Legal Framework | Who It Covers | Required Mental State | Maximum Recovery |
|---|---|---|---|
| DEFIANCE Act (2024) | AI-generated or altered intimate imagery | Knowing or reckless disregard of non-consent | $150,000 statutory per violation |
| State NCII statutes | Varies by state, many include deepfakes | Varies: knowing, intentional, or negligent | Varies by state statute |
| State criminal NCII | Victim reports to law enforcement | Intentional in most states | Misdemeanor to felony depending on state |
| Defamation | Any false depiction causing harm | Negligence (private) or actual malice (public) | Actual and punitive damages |
2. How to Get Deepfake Content Removed from Platforms
Removal is the first priority, and the process differs by platform, by the type of content, and by which legal framework the removal request invokes.
Most major platforms maintain dedicated reporting mechanisms for nonconsensual intimate imagery that operate separately from general content violation reporting. These mechanisms were created in response to advocacy around authentic revenge porn and have been updated by many platforms to cover AI-generated content. A removal request through the NCII-specific reporting channel typically receives faster review than a general terms-of-service complaint and does not require the victim to prove the content is a deepfake, only that it depicts them without consent.
The DEFIANCE Act creates a notice-and-takedown obligation for platforms that applies after receiving a qualifying notice from the victim. This parallels the DMCA's notice-and-takedown structure for copyright infringement and creates legal exposure for platforms that fail to act after receiving proper notice. Submitting notice that satisfies the Act's requirements is not the same as filing a general content report, and the format and content of the notice affects whether the platform's immunity is preserved or lost.
What to Document before Requesting Removal
Evidence preservation must happen before any removal request is submitted. Once a platform removes content, the metadata, URL structure, engagement data, and account information associated with the post may become inaccessible.
Before requesting removal, take timestamped screenshots of every instance of the content found, capturing the full URL, the posting account's username and profile information, the platform name, any visible engagement metrics, and any comments or tags. Download the content itself where the platform permits, preserving the original file with its embedded metadata. Record the date and time each instance was documented. Use a web archiving tool to create a permanent record of the page as it appeared at the time of discovery.
This documentation serves multiple purposes. It establishes the scope of distribution for purposes of damages calculation. It provides the identifying information about the posting account that may be needed to subpoena the platform for the account holder's real identity. And it creates the evidentiary record of the content's existence before any modification or deletion that the defendant might later attempt to claim as grounds for dismissal. An attorney who handles online defamation and NCII litigation can advise on the specific documentation format that courts have found most useful in these cases.
Platform removal and legal action are not mutually exclusive, but they do run on different timelines that can work against each other if not coordinated. A platform that removes content before the account information is subpoenaed may have already purged the account data as part of its standard deletion process. The sequence of removal requests, legal preservation demands, and subpoenas requires coordination from the start rather than as separate steps.
3. How to Find Out Who Did This and Build a Case against Them
Identifying the person who created or shared a deepfake is often the most difficult step in NCII litigation, and it requires a combination of digital forensics, platform subpoenas, and legal process that takes time to execute.
A platform subpoena, served after filing a lawsuit, compels the platform to produce account registration information, IP addresses used to access and post from the account, device identifiers, and any payment information associated with premium features. This information typically leads to the account holder's real identity, though defendants who created accounts through anonymizing tools or public networks require additional forensic analysis to identify.
IP address records connect a posting to an internet service provider, and a second subpoena served on the ISP compels disclosure of the account holder associated with that IP address at the relevant time. This two-subpoena process is the most common attribution chain in anonymous online harm cases. Courts routinely grant early discovery motions to serve these subpoenas before the normal discovery schedule opens because delay allows the platforms and ISPs to purge the records under their standard data retention policies.
When Criminal Prosecution Is Available Alongside the Civil Case
A civil lawsuit for damages and a criminal complaint to law enforcement are not mutually exclusive in NCII cases, and pursuing both simultaneously often produces better outcomes for victims than relying on either track alone.
Criminal prosecution under applicable state NCII statutes, and in some cases under federal cyberstalking or harassment statutes, gives law enforcement investigative tools that civil litigants cannot access independently. Law enforcement can execute search warrants on devices, compel production of encrypted communications, and access platform records through criminal process that is faster and less limited than civil discovery. Information developed through the criminal investigation can in some cases be used in the parallel civil case to establish liability.
The criminal process also creates pressure on the defendant that the civil lawsuit alone does not. A defendant facing felony criminal charges under a state NCII statute simultaneously with a federal civil lawsuit under the DEFIANCE Act is in a significantly different position than one facing only civil liability. That combined pressure can accelerate settlement negotiations in the civil case. An attorney who handles cyber harassment and social media defamation cases involving NCII can coordinate the criminal complaint and civil filing to maximize the pressure on the defendant while keeping both tracks moving toward resolution.
What Happens When the Deepfake Was Created by Someone the Victim Knows
In a significant percentage of NCII cases, the person who created or distributed the deepfake is not a stranger. They are a former partner, an acquaintance, a coworker, or someone from the victim's immediate social circle.
When the perpetrator is known to the victim, the attribution challenge disappears. The evidentiary challenge shifts to documenting the perpetrator's access to the tools and images used to create the deepfake, establishing that they had the technical ability to create the content, and connecting them to the specific accounts or devices from which the content was posted. Text messages, emails, or other communications in which the perpetrator referenced the content, threatened to create it, or acknowledged having created it are among the most direct forms of evidence.
A protective order or restraining order may be available immediately upon filing when the perpetrator is known and the victim faces continued harassment or the threat of additional content being released. This civil protective order operates separately from any criminal proceeding and can prohibit the perpetrator from creating or distributing additional content, from contacting the victim, and from accessing the victim's accounts or images. An attorney who handles online defamation and cyber harassment cases can file for protective relief simultaneously with the initial civil complaint.
In known-perpetrator cases, the window between when the victim discovers the content and when the perpetrator becomes aware legal action is coming is often measured in hours. During that window, the perpetrator may delete accounts, destroy devices, or create new distribution channels. Coordinating the preservation demand, the restraining order application, and the initial civil filing to happen simultaneously closes that window before the perpetrator can respond to it.
4. Frequently Asked Questions about Deepfake Litigation
Victims of deepfake intimate imagery arrive at a first legal consultation in crisis, with urgent and specific questions about what can be done, how fast it can happen, and whether their identity will be protected through the legal process. The most common of those questions are answered here.
What Is Deepfake Litigation in the Ncii Context and Who Can File a Claim?
Deepfake litigation for nonconsensual intimate imagery covers civil lawsuits filed by people whose face or likeness was used without consent in AI-generated sexual or intimate content. Any person depicted in such content without their consent can file a federal civil claim under the DEFIANCE Act regardless of whether they are a public figure and regardless of whether any financial harm resulted. State NCII statutes provide additional or overlapping causes of action depending on where the victim and perpetrator are located.
Does the Defiance Act Require Me to Know Who Made the Deepfake before I Can Sue?
No. A lawsuit can be filed against unknown defendants using a "John Doe" complaint, and the discovery process including subpoenas to platforms and internet service providers is then used to identify the responsible party. Courts routinely grant early discovery to serve these subpoenas before the normal discovery schedule opens because delay allows platforms and ISPs to purge the records that would identify the defendant.
Can I Get the Content Removed before Identifying the Person Who Posted It?
Yes. Platform removal requests through NCII-specific reporting channels do not require identification of the creator. Most major platforms will remove nonconsensual intimate imagery upon a qualifying report from the depicted person. A legal preservation demand can also be sent to the platform simultaneously with the removal request, requiring the platform to preserve the account information and posting records even after the content itself is removed. Preservation and removal should be coordinated, not sequential.
Will My Name and Identity Be Protected If I File a Lawsuit?
Courts can grant permission to file under a pseudonym in NCII cases when public disclosure of the victim's identity would cause additional harm. Victims who file under their real name in public court records face the risk that the lawsuit itself publicizes the existence of the content to people who might not otherwise have encountered it. Requesting pseudonymous filing at the outset of the case is a procedural step that requires a specific legal motion, and the court's decision depends on the specific circumstances of the case.
What If the Deepfake Was Created by a Former Partner or Someone I Know?
When the perpetrator is known, the lawsuit can be filed against them by name immediately without a John Doe attribution phase. The evidentiary focus shifts to establishing their access to the tools and images used to create the content and their connection to the accounts used to distribute it. A civil protective order or restraining order may be available immediately to prohibit further creation or distribution of content and to restrict contact. Criminal charges under state NCII statutes can be pursued simultaneously through a report to local law enforcement.
How Long Does Deepfake Litigation Take and What Does It Cost?
Cases that reach early settlement through platform attribution and perpetrator identification typically resolve in months. Cases that require full discovery and trial can take one to three years. Many attorneys who handle NCII deepfake litigation offer contingency fee arrangements for the civil case, meaning the attorney's fee is taken as a percentage of the recovery rather than charged hourly, which eliminates the financial barrier for victims who cannot afford upfront legal costs. The availability of contingency representation depends on the strength of the case and the collectability of any judgment against the defendant.
26 May, 2026
