Deepfake Law UK: What Happens If Someone Makes One of You?

Short answer: Somebody can take an ordinary photograph of you from a work page or a social account and use an app to produce a fake explicit image. It takes minutes and no skill. Deepfake law UK is catching up, and the Government says it will make creating sexually explicit deepfakes a criminal offence. But the questions people actually need answered first are practical ones: how these images spread, what to do in the first hour, and who can get them taken down. This post covers those.

In short:

• An ordinary headshot is enough raw material. Nothing private has to be taken from you.
• The people this happens to are usually the last to find out.
• Save the web address before you do anything else, because deleting your own account destroys the trail.
• StopNCII can help stop an image being shared further, and the Revenge Porn Helpline supports adults directly.
• Reporting to the platform usually moves faster than anything else, so start there.

How these images actually get made

A deepfake is a fake image or video of a real person, produced by an app.

The part that surprises people is the raw material. Nobody needs a private photo, a hacked account, or anything you sent to anyone. A headshot from a company website, a picture from a LinkedIn post, a photo from a friend’s holiday album is enough.

Somebody feeds that into an app and gets back something realistic enough to pass a glance on a phone screen. It costs almost nothing, takes a few minutes, and requires no technical skill whatsoever.

Then it travels the way everything travels now: a group chat, a private server, a forwarded message. The person in the image is very often the last to learn it exists, and usually hears about it from somebody else.

That combination is why this has moved so fast from a curiosity to something ordinary people have to think about.

Where deepfake law UK currently sits

This is the part to read quickly and then take to somebody qualified.

The Government has said it will make creating sexually explicit deepfake images a criminal offence, describing new offences and noting that women and girls are usually the target. Separately, the Online Safety Act 2023 governs a great deal of what platforms themselves must do about illegal and harmful content.

What any of that means in a particular case is a question for a solicitor or the police, not for a blog. Kids n Clicks works on the technology rather than the law, which is what the rest of this post covers.

The useful thing to know about deepfake law UK is that this is not a grey area anybody has to argue their way into. It is taken seriously, and there are people whose job is to help.

What deepfake law UK does not tell you: the first hour

Order matters here, and the instinct most people have is the wrong one.

Do not delete your own accounts yet. The very first urge is usually to wipe everything and disappear. Understandable, and it destroys the trail. Whoever helps you later will need to know where the image appeared and who posted it.

Save the web address. Copy the link to wherever the image is. Not just a screenshot of the image, the actual address of the page or the post. That is what a platform needs to act, and it is what nobody thinks to keep.

Take a screenshot with the surroundings visible. The username, the date, the number of shares. A cropped screenshot of the image alone proves very little about where it came from.

Report it to the platform. This usually moves faster than anything else, because platforms have their own rules against this whatever the legal position. Report from the post itself rather than through a general contact form.

Then get help from people who do this daily. StopNCII is a free tool that can stop an image being shared further across participating platforms, without you having to send the image anywhere. The Revenge Porn Helpline supports adults in this situation directly and will deal with platforms on your behalf. Report Harmful Content helps when a platform has ignored a report.

If the person in the image is under eighteen, that is a different and more serious situation, and the police should be involved straight away.

Why this matters at work

Most of these images involve somebody the maker knows, and a great many of them come out of a workplace.

The reason is simply availability. A company website with a “meet the team” page, a LinkedIn profile, a photo from the summer party posted on a company account. All of that is public, findable in minutes, and perfectly ordinary for an organisation to publish.

Employers rarely think of their own website as the supply. It is worth a look, and it is worth deciding how much you need to publish about each person.

The second thing employers miss is that nobody reports this. There are no comfortable words for telling a manager what happened, and the person affected usually assumes nothing can be done anyway. Naming it out loud in training changes that, because somebody who has heard it described knows it is a thing that happens to other people too.

Kids n Clicks covers the wider picture in our post on staff wellbeing and online harassment, our post on misogyny in the workplace and our post on third party harassment.

What not to waste your energy on

Two things people chase that rarely help.

Trying to prove it is fake. The impulse is to find the detection tool that will settle it. Those tools are unreliable, they date quickly, and platforms do not generally need one to act. Reporting works better than proving.

Arguing with whoever shared it. It feels necessary and it usually makes things worse, because it tells that person the image is landing. Report, record, and let somebody else make the approach.

Where the training fits

The remaining gap for most organisations is knowledge rather than process. Your advisers know the law. Nobody in the building tracks what an image app can now build from a work headshot, or how quickly something spreads once it enters a private group.

Our training programmes cover that. A session shows what these tools actually produce, what your own website and social accounts give away, what somebody should do in the first hour, and how to name this in training so people start reporting it. Kids n Clicks also runs continuing support for corporate organisations, because this area changes every few months.

The session teaches the technology, not the law. Your advisers already know the law. What often goes missing is a clear read of what actually happened on the phones, the apps and the accounts, and that is the gap this session fills. It is a specialist session, delivered online or in person, to a whole workforce or to a single team.

If you lead people, wellbeing or inclusion in your organisation, connect with Parven on LinkedIn or explore our training programmes to book a session for your team.

Parven Kaur is a digital parenting and online safety expert, and the founder of Kids n Clicks. She works with employers on the technology side of online harm and its effect on staff wellbeing. She won the Scottish Cyber Security Award, and she sits on the National Board of Advisors for Barnardo’s Scotland.