Where to report a sexual Deepfake as a crime, country by country

01What a report can and cannot compel

Before choosing a route, be clear about what each body is for. A police force investigates an offender. A regulator supervises a platform. Neither of those is the same as an order to delete a file, and only some of the bodies below can issue one.

02Build the file before you report

Every route below asks you to identify the material precisely enough for someone else to find it. The eSafety Commissioner's guidance puts it in those terms: the material must be identifiable so the recipient of a notice can comply, for example through screenshots, URLs, usernames or time stamps. A report that cannot locate the item cannot be acted on.

Write the chronology before you speak to anyone. A report filed weeks later is judged on the record you kept, not on your memory.

03United States: the federal removal duty

Public Law 119-12, the TAKE IT DOWN Act, was enacted on 19 May 2025 and does two separate things. The first is a criminal offence. The second, which is what you use as a complainant, is a duty on platforms.

A covered platform had to establish a notice and removal process within one year of enactment. On receiving a valid request from the identifiable individual, or from an authorised person acting for them, it must remove the depiction as soon as possible and not later than 48 hours, and make reasonable efforts to identify and remove known identical copies.

A request is valid only if it is in writing and contains four things: a physical or electronic signature; identification of the depiction and information reasonably sufficient to locate it; a brief statement of your good-faith belief that it is non-consensual, with relevant supporting information; and your contact details. Draft every report to that list, including on platforms outside the statute.

Failure to comply reasonably is treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the FTC Act, enforced by the Federal Trade Commission. That is the lever when a platform ignores a properly drafted notice: the breach is the ignored notice, so keep the notice, the delivery proof and the dates.

04United States: police, IC3 and state law

The criminal offence in the same Act carries, for an authentic intimate depiction of an adult, a fine and up to two years; for a minor, up to three years. A threat involving a digital forgery carries up to 18 months where an adult is depicted and up to 30 months where a minor is.

File with your local police department or sheriff's office first, because that is where a case is opened. Then file with the FBI's Internet Crime Complaint Center. Understand what IC3 is before you rely on it: an analyst reviews the complaint and forwards it to law enforcement and partner agencies as appropriate, IC3 does not conduct investigations itself, and it states you will not hear back from it about the status. Anyone affected can file, including from outside the United States.

State law often gives the more usable charge. In New York, Penal Law 245.15 makes it a class A misdemeanour to disseminate or publish an intimate image with intent to cause harm to the depicted person's emotional, financial or physical welfare, where that person is reasonably identifiable. The definition expressly covers an image created or altered by digitisation, meaning realistic alteration using images of another person or computer-generated images, so a synthetic image is inside the offence. State provisions differ; check the one where you or the poster is located.

05United Kingdom: police, then Ofcom

In England and Wales the offence is section 66B of the Sexual Offences Act 2003. It applies to sharing a photograph or film that shows, or appears to show, another person in an intimate state without consent, which is the wording that brings a Deepfake inside it without any need to classify the file.

The bare sharing offence in subsection (1) is summary only. The variants involving intent to cause alarm, distress or humiliation, or sexual gratification, and the threat offence in subsection (4), carry up to two years on conviction on indictment. For a threat, subsection (7) means the prosecution does not have to prove the image exists or that it really shows an intimate state.

Report the offence to the police force covering where you live, by telephone or through its online reporting route for sexual offences, and ask for the crime reference number. You will quote that reference in every later platform report and in any civil application.

What Ofcom is for

Ofcom is the online safety regulator, not a takedown service. Its own guidance tells you to report to the service first, and states plainly that it cannot respond to or investigate individual complaints. It uses complaints to assess whether a regulated service is meeting its duties.

That still matters, because the sanctions are heavy. Ofcom can fine a service 18 million pounds or 10 per cent of qualifying worldwide revenue, whichever is greater, and in the most serious cases of continuing non-compliance it can ask a court for business disruption measures requiring internet service providers to block UK access. It says neither it nor the courts can shut a website down globally. So file with Ofcom to put the site on the regulatory record, not to get your item removed.

06European Union: the two parallel routes

In the EU the criminal offence is national and the platform supervision is European. Run both. The national report goes to the police or public prosecutor in your Member State. The platform report goes to your Digital Services Coordinator.

Each Member State designates one Coordinator for all matters relating to the application and enforcement of the Digital Services Act. A recipient of a service who meets an infringement on a platform may lodge a complaint with the Coordinator of the Member State where they are located or established. Coordinators can request data, order inspections and impose fines. For Germany the Coordinator is the Bundesnetzagentur; for France it is Arcom. The list of all national Coordinators is on the European Commission's page.

A trusted flagger is a separate mechanism and often misunderstood. The status is awarded by the Coordinator of the Member State where the applicant is established, only EU-based entities can apply, and a trusted flagger's notices must be treated by platforms with priority. An individual cannot hold the status, and a platform still decides whether to remove. Treat it as a way of getting faster handling through an organisation, not as a right you hold yourself.

07Germany and France as worked examples

The two largest EU markets illustrate how different the national criminal picture still is, which is why the Digital Services Act route exists alongside it.

Germany

The provision usually in play is section 201a of the Strafgesetzbuch. Subsection 1 covers recordings of the intimate area, of a helpless person or of a deceased person, and the making available of such recordings, punishable by imprisonment of up to two years or a fine. Subsection 2 attracts the same penalty for making available, without authorisation, an image of another person that is suitable for seriously damaging that person's reputation. Subsection 5 allows confiscation of the image carriers and the recording devices used.

Note the gap: a nude image of an adult is not caught as nudity as such, so a German report is normally framed on the reputational limb in subsection 2. Say which limb you are invoking. Subsection 4 excludes conduct serving overriding legitimate interests such as art, science or news reporting, and an overbroad report invites that defence.

France

France legislated directly for this. Article 226-8-1 of the Code penal, created by the loi SREN of 21 May 2024, penalises publishing a sexual montage made without the person's consent and covers AI-generated content, including sexual Deepfakes, that uses a person's words or image. The Ministry of Justice states the penalty as two years' imprisonment and a fine of 60,000 euros, rising to three years and 75,000 euros where the content is published through an online communication service.

08Australia: removal notices that bite

Australia is the one jurisdiction where the report itself is the removal route. Complaints go to the eSafety Commissioner through its image-based abuse report form.

• Who can complain. The person depicted, or someone they have authorised, or the parent or guardian of a child under 16 or of a person incapable of managing their own affairs. A declaration of authority is required when complaining for someone else.
• No precondition. You do not have to have reported to the platform first, and you do not have to know who shared the material.
• Who gets the notice. The online service provider, an end-user, or the hosting service, under sections 77, 78 and 79 of the scheme.
• The deadline. The recipient must take all reasonable steps to remove the material, or cease hosting it, within 24 hours or a longer period eSafety specifies.
• The sanction. Failing to comply can attract a civil penalty of up to 500 penalty units, with the unit value for an individual set at 313 dollars until 30 June 2026 and up to five times that maximum for a corporation.

The jurisdictional link is about people, not servers. The material does not have to have been posted in Australia or by an Australian: for a complaint, either the person depicted or the end-user must be ordinarily resident in Australia.

09Canada: the offence and a deletion order

The federal offence is section 162.1 of the Criminal Code: knowingly publishing, distributing, transmitting, selling, making available or advertising an intimate image knowing the person did not consent, or being reckless as to consent. It is punishable on indictment by up to ten years, or on summary conviction, and the threat offence in subsection (1.1) carries up to ten years on indictment.

Synthetic material is expressly inside the definition. An intimate image includes a visual representation made by electronic or mechanical means, including artificial intelligence software, that shows an identifiable person in the relevant state and is likely to be mistaken for a real recording of that person.

Canada also has a judicial deletion power. Under section 164.1, where a judge is satisfied on information on oath that the material is stored on and available through a computer system within the court's jurisdiction, the custodian can be ordered to hand an electronic copy to the court, stop storing and making the material available, and provide the information needed to identify and locate the person who posted it. That person is then given notice and an opportunity to show cause. Where the court orders deletion of an intimate image connected to a section 162.1 offence, deletion must occur within 48 hours of the order, and orders do not take effect until the time for a final appeal has expired.

The provincial civil route

Several provinces add a civil track. In British Columbia the Civil Resolution Tribunal issues protection orders requiring that an image be deleted, de-indexed, or removed from a website or platform, and these cover altered material, with Deepfakes given as an example. You can bring a protection order claim without naming a person or company, there is no tribunal fee for it, damages up to 75,000 dollars can be claimed, and non-compliance penalties run to 500 dollars a day for an individual and 5,000 dollars a day for a company. One practical catch: the tribunal does not serve the order for you. You send it to each platform and keep proof of how and when you sent it.

10Realistic timelines

These are the timeframes the bodies themselves state. Where no figure is stated, none should be promised to you.

Read that table as a sequencing instruction. The two routes with real deadlines are the US platform notice and the Australian removal notice; everything else is slower than the material spreads.

11What reporting does not do

A criminal report does not remove anything. It opens a file about a person. Even where a conviction follows, the copies on third-party sites are untouched unless something separately orders the host to delete them, and only Australia and the Canadian court route do that.

A regulatory complaint does not remove anything either. Ofcom does not investigate individual complaints, and an EU Digital Services Coordinator supervises the provider rather than adjudicating your item. Both are worth filing, because the regulatory record is what eventually moves a non-compliant site, but neither is a substitute for a takedown.

So the reporting workstream and the removal workstream run in parallel, and they need different material. Reporting needs a chronology, an identifiable suspect where one exists, and a statement. Removal needs per-URL evidence, the correct named report route on each platform, search de-indexing, and continuous monitoring for re-uploads, because a file that comes back under a new name is a new removal job regardless of how the criminal case is going.

SARAZIM LLC works the removal and monitoring side: evidence capture in the form each route requires, platform and search submissions, escalation to hosts and registrars, and monitoring for new copies. It does not practise law, does not act as your legal representative, and does not file criminal complaints on your behalf.