Where to report a Deepfake, and what each report must say

01What this page covers, and what it skips

Two other pages carry the background. How to judge whether an image is synthetic, how to capture evidence and how hash blocking works is set out in Deepfake removal. Which police force or agency takes a criminal report in each country is in reporting a sexual Deepfake as a crime. This page starts after both: the material is captured, and the reports now have to be written.

There are three kinds of report, and they run in parallel. A report to the platform under its own policy. A written request under a statute that gives the platform a deadline. A complaint to a regulator when the platform does not act. Each needs the same core facts in a slightly different shape, so write them once and adapt.

In practice the order is simple. File the platform report and, in the US, the written removal request on the same day, for every item. Go to a regulator only once you hold a reference number, a decision or a missed deadline, because each regulator below asks what the platform was told and when.

02Pick the category, not the nearest button

Every major service has a route for intimate or manipulated content, and none of them asks you to prove the file is synthetic. What they check is whether you are identifiable and whether you agreed. A report filed under general nudity or spam is reviewed against the wrong rule and is often closed on that ground alone.

X also distinguishes who may report. Anyone can report hidden-camera material, bounty posts and intimate images posted with revenge text or contact details. For other content X says it may need to hear from the person shown or an authorised representative, such as a lawyer. If a friend reported and nothing happened, file again yourself.

TikTok's rule matters for the wording of the report. If the person shown is a private individual, say so in the first line: the policy does not turn on whether the clip carries an AI label.

03The content of a report that works

Free-text boxes are read by a reviewer working through a queue. The report that gets acted on answers the reviewer's questions in the order they ask them, in plain sentences, without adjectives.

Keep emotion out of the box. A line describing what the post shows is weighed. A paragraph about how it feels is skimmed. Describe the material once, in neutral terms, and stop.

For video, give the timecodes where you appear, start to end, or say the whole clip. For an account that exists only to post this material, report the account as well as each post, and say in the account report how many items it has posted and when the first appeared.

Google asks for screenshots to help find the content and says you may edit them so only your face is shown. That is the one case where a cropped image is expected. Keep the full, unedited capture in your own file regardless.

04US: the written removal request

Under the TAKE IT DOWN Act, a covered platform must remove an intimate visual depiction, including a digital forgery, as soon as possible and no later than 48 hours after a valid request, and make reasonable efforts to remove known identical copies. The FTC began enforcing that duty on 19 May 2026.

A request is valid only if it is in writing and carries four things. Draft them as four separate paragraphs so none can be missed:

1. A physical or electronic signature of the person depicted, or of an authorised person acting for them.
2. Information reasonably sufficient to locate the depiction: the URL, and for video the timestamp.
3. A brief statement of your good-faith belief that it is not consensual, with any relevant supporting information.
4. Contact details sufficient for the platform to reach you.

Covered platforms are public-facing services that primarily host user-generated content, or that publish such depictions in the regular course of business. Broadband providers and email are excluded. Use the same four paragraphs on smaller sites that may fall outside the definition; they cost nothing and leave a dated record either way.

If someone files for you, the request should say who they are, that you have authorised them, and how the platform can confirm it. The statute allows a request from an authorised person acting for the individual; it does not let a stranger file on your behalf without that authority.

05US: when the 48 hours pass

A platform that does not act on a valid request within 48 hours, or that has no working removal process at all, is in breach. The FTC treats a failure to reasonably comply as an unfair or deceptive practice, and its consumer guidance puts the civil penalty at $53,088 per violation.

Complaints go to TakeItDown.ftc.gov, which the FTC set up for victims to report platforms that ignored a valid request or never built a process. Be realistic about what it produces. The FTC says reports help it investigate platforms and hold them accountable. It does not say it will resolve your individual item, so keep pressing the platform while the complaint sits on file.

• Attach the request exactly as sent, with its date and time.
• Attach the platform's acknowledgement, or note that none came.
• List the URLs still live, each checked again on the day you file.
• Note any identical copies the platform was told about and left up.

06EU: notice, reasons and appeal

Under the Digital Services Act, platforms must offer an easy-to-use flagging mechanism for illegal content, process reports in a timely manner, and explain removal decisions. In practice the platform's EU illegal-content form is the route. Name the national law the content breaches in plain words, give the exact URL, identify yourself, and confirm the information is accurate.

When a platform decides, it must explain why content was removed or limited. Ask for that statement of reasons if it does not arrive, and keep it: the internal complaint is written against it, line by line, and a refusal without reasons is itself something a Coordinator will want to see.

What changes the position is the decision. A refusal is not the end; it opens the ladder below, and each rung needs the reference from the one before.

Most people stop after the first refusal. The internal complaint costs nothing and is the step most likely to reverse a decision made quickly by a first-line reviewer.

07EU: dispute bodies and regulators

Out-of-court dispute settlement has been available to users since 17 February 2024. You can choose any certified body that covers your type of dispute, and it does not need to be in your country if it handles the relevant language. The Commission keeps the list of bodies on its dispute settlement page.

These bodies cannot impose a binding settlement. The platform is expected to engage in good faith, and their decisions carry weight, but if the platform ignores one, a court is the next step. Check each body's fee terms before filing; use is usually free or low cost.

A Digital Services Coordinator does not decide your item. It supervises the platform and can request data, order inspections and impose fines. File with it when the problem is systemic: no working report form, no statement of reasons, appeals that never get answered. Attach your references; they are the evidence.

08UK: the service first, Ofcom second

Under the Online Safety Act, in-scope sites and apps had to start implementing illegal content measures from 17 March 2025. Ofcom states that they must take down non-consensual intimate images once they become aware of them, and that reporting and complaints functions must be easy to find and use.

So write the UK report as an illegal content report, not a terms-of-service complaint. Say that the image is intimate, that it shows you, that you did not consent, and that you are asking for removal because it is illegal content in the UK. Keep the service's acknowledgement; that is the moment it became aware.

If the service answers with a template that ignores the illegality point, reply once, quoting your original wording and its date, and ask for the decision on the illegal content ground specifically. That exchange is exactly what Ofcom will want to see.

Ofcom itself is the second step, not the first. It says reporting to the service should be your first step and that it cannot respond to or investigate individual complaints. It uses complaints to assess whether a service is doing enough. File with Ofcom to build the regulatory record against a service that ignores reports. Its fines reach £18 million or 10 per cent of qualifying worldwide revenue, whichever is greater.

09Australia: report to eSafety directly

Australia is the one place where the regulator's report form is itself a removal route. The eSafety Commissioner's guidance states that intimate images can include digitally altered photos and videos, with Deepfakes as an example.

• You do not have to report to the platform first, and you do not need to know who posted it.
• Either the person shown or the person who posted must be ordinarily resident in Australia.
• Someone else can complain for you if you authorise them, with a declaration confirming it.
• The material must be identifiable so the recipient can comply: screenshots, URLs, usernames and timestamps.
• A removal notice can go to the service, the hosting provider or the person who posted it, with 24 hours to comply, or longer if eSafety specifies.

Report through the image-based abuse form. Build the identification section from the same six lines used for platform reports; eSafety needs exactly the same facts.

10Refusals, re-uploads and the record

Refused reports almost always fail for a reason you can fix before filing again with the same facts:

• The profile or a search page was reported instead of the exact URL.
• Several items were bundled into one report and only the first was reviewed.
• No sentence said the person shown is the reporter.
• The report went to the general nudity or spam route rather than the intimate content one.
• Someone else reported where the policy needed the person shown.
• The refusal was accepted instead of being taken to the internal complaint.

Re-uploads are the norm. Treat each new copy as a new report with its own URL, and cite the earlier reference and decision in the first line. Keep one log: URL, route, date sent, reference, decision, next step. That log is what every regulator above asks for, and what a lawyer will need if it goes further.

Write the log on the day, not from memory. Dates decide every escalation here: the 48 hours in the US, the six months for an EU complaint, the moment a UK service became aware. A report you cannot date is a report you cannot rely on.

SARAZIM LLC works on this administrative side: face-matching detection that finds copies from two or three reference photos, the reports in each platform's required form, the escalation ladder and monitoring for re-uploads each cycle. It keeps no footage, only metadata and hash values. It does not practise law and does not file criminal complaints for you.