Deepfakes: What to Do If Your Image Is Used Without Consent

Deepfakes are no longer a noveltyGenerative AI has made it cheap and fast to create convincing fake videos and images of real people. What started as...

Deepfakes are no longer a novelty

Generative AI has made it cheap and fast to create convincing fake videos and images of real people. What started as a technical curiosity is now a tool for fraud, extortion and harassment. In Spain and across the EU, businesses and public figures are increasingly targeted, and the law is slowly catching up. If you or your company appear in a deepfake, the first reaction is usually panic. The second should be a clear, methodical response.

Is a deepfake illegal?

The short answer is: it depends on the context and jurisdiction. Across the EU, the AI Act will soon ban systems designed specifically to create non-consensual intimate imagery. In Spain, the Organic Law on the Protection of Personal Data and the Criminal Code already cover identity theft, fraud, extortion and the distribution of intimate images without consent. If the person depicted is a minor, the content is illegal in virtually every member state. Outside intimate imagery, legality hinges on purpose: if the deepfake was made and shared without consent for fraud, blackmail, defamation or impersonation, it is likely unlawful. For businesses, a fake video of a CEO announcing a fake merger or asking for payments can be a serious reputational and financial risk.

Step one: preserve the evidence

Before you report anything, secure proof. Take screenshots of the page or account, save the URL, note the username, date and time, and copy any accompanying text. Do not engage with the person who posted it — interaction can amplify distribution. If the content is hosted on a platform, use its reporting tools; if it is on a website, note the hosting provider. In Spain, you can also file a complaint with the Spanish Data Protection Agency (AEPD) if the deepfake involves your personal data, as GDPR gives you the right to request erasure.

Step two: use platform reporting and search removal

Most major platforms have reporting mechanisms, though rarely a dedicated deepfake button. You will usually need to select the closest category — harassment, impersonation or fraud — and explain that the content is AI-generated and harmful. Google offers a personal information removal tool and a legal removal request form to de-index pages from search results, which reduces visibility even if the original content stays online. Meta platforms (Facebook, Instagram) allow you to report posts and videos under impersonation or harassment. TikTok has a specific reporting path for synthetic and manipulated media. YouTube offers a privacy complaint process for altered or synthetic content that uses your likeness. Document every report you file, including reference numbers.

Step three: legal and technical escalation

If the content is intimate, involves a minor, or is tied to extortion, contact the police (Policía Nacional or Mossos d'Esquadra in Catalonia) immediately. For business impersonation, notify your legal team and consider a cease-and-desist letter to the host. At the same time, review your technical defences. Deepfakes often spread through phishing campaigns and compromised accounts. Ensure your mail servers and web infrastructure are hardened: this is where a service like ALMC's Abuse Shield helps. It centralises server protection with automatic blocking of malicious IPs, managed fail2ban across multiple machines, and a shared IP reputation feed between all your servers. If an attacker tries to use your infrastructure to host or distribute fake content, Abuse Shield can cut off the source quickly.

Prevention for businesses in Catalonia

Beyond reaction, prepare. Train staff to recognise AI-generated voice and video, especially in payment requests. Implement verification protocols for financial transactions. Keep an incident response plan that includes deepfake scenarios. And remember that GDPR gives you leverage: you can request removal of personal data, and you can escalate to the AEPD if platforms do not respond. In Barcelona, Lleida, Tarragona and Girona, the local business community is increasingly aware of these threats, and sharing experiences helps. The key is not to panic, but to act fast, document everything, and combine legal, platform and technical measures.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.