Deepfakes and faces used without consent: what to do.

The use of a person’s image through artificial intelligence systems to create photographs, videos, or other artificially manipulated content represents one of the new frontiers of personal protection in the digital environment. The phenomenon of deepfakes indeed allows for the use of an individual’s face, voice, or other identifiable elements to construct seemingly realistic content, attributing to the represented person behaviors, statements, or situations that they have never actually engaged in. The legal issue becomes particularly delicate when the image is used without consent and the content is subsequently published, shared, or disseminated through social networks, digital platforms, messaging applications, or websites. In these cases, it is not merely a graphical alteration of a photograph but a possible violation of fundamental rights of the individual, including personal identity, image, reputation, privacy, and, depending on the content created, also dignity and sexual freedom. The Data Protection Authority highlighted in 2026 that the use of images and voices of real people for the generation and dissemination of content through artificial intelligence systems can lead to serious violations of rights and fundamental freedoms when done without a valid legal title. Therefore, the absence of consent takes on central importance, but the legal classification of the conduct must be made based on the specific ways in which the image is used. The right to one’s image is indeed protected under the legal system, and the reproduction or dissemination of a person’s likeness is subject to specific conditions, except for cases provided for by law. When the face is manipulated through artificial intelligence and placed in a situation completely unrelated to reality, one must also consider the consequences that the content can produce on the identity and reputation of the represented person. The creation of sexually explicit deepfakes can be particularly severe. In such cases, the situation can take on a specific criminal dimension, especially when images or videos intended to remain private are disseminated without the consent of the represented person. Italian law indeed provides for specific criminal protection against the unlawful dissemination of sexually explicit images or videos, and the regulations must be applied carefully, assessing the modalities by which the content was created and subsequently disseminated. When a person discovers that their face has been used to create a deepfake, the first need is to preserve the evidence. It is crucial to keep the content in its original form, take screenshots of pages where it appears, record the internet address of the site or profile that published it, note the date and time of the discovery, and document any comments, shares, messages, or other forms of dissemination. It is not advisable to limit oneself to immediately deleting the content without first preserving adequate documentation, as proof of publication and its actual circulation may be of decisive importance. At the same time, one can request the removal of the content from the platform on which it has been published, identifying the most appropriate procedure related to the nature of the violation. When personal data are involved, the tools provided by personal data protection legislation may also be relevant. If conditions are met, initiatives against the data controller and further protective measures recognized by the legal system may also be considered. The situation must be assessed with particular urgency when the content has already gone viral, as subsequent sharing can make it extremely difficult to control its circulation. The Authority has indeed emphasized the need for timely interventions in cases of deepfakes, highlighting the risk that uncontrolled dissemination of content may cause serious and difficult-to-reverse harm. From a civil law perspective, the consequences of the conduct can also be significant. When the abusive use of a person’s face has caused an injury to their image, reputation, personal identity, or private sphere, it is necessary to evaluate the possibility of requesting the cessation of the conduct, the removal of the content, and, when pertinent, compensation for both material and non-material damages. The damage must be assessed concretely, taking into account the nature of the content, its dissemination, the duration of its online presence, the characteristics of the involved person, and the actual consequences produced. The situation is even more delicate when the deepfake is used to attribute to the victim statements never made, behaviors never realized, or conduct capable of compromising their personal or professional reputation. In these cases, the injury may directly concern the person’s identity, as artificial intelligence is used to construct an artificial representation of their figure and present it to the public as authentic. If the dissemination of the content also constitutes a criminally relevant conduct, the victim may consider filing a complaint or report, providing the authorities with all collected documentation and indicating, as far as possible, the origin of the content, the profiles used for publication, and the methods through which the material was disseminated. It is important to understand that liability does not depend solely on the person who physically created the deepfake. The situation must be reconstructed in its entirety, verifying who provided the image, who generated the content, who published it, and who subsequently disseminated it, as the different actions may carry different legal significance. The deepfake, therefore, does not constitute a free zone where personal identity can be freely manipulated. Technological evolution does not eliminate fundamental rights of the person and does not allow the face or voice of an individual to be used as freely available material. When a person’s face is used without consent to create artificial content, especially if offensive, misleading, sexually explicit, or potentially harmful to their reputation, it is necessary to intervene promptly to preserve evidence, halt dissemination, and identify the most appropriate protective measures. Protecting identity in the age of artificial intelligence thus requires an evaluation that successfully combines civil law, criminal law, image protection, personal data protection, and regulation of new technologies. In a reality where an image can be artificially transformed and disseminated in minutes across the globe, the timeliness of legal intervention can represent the first and most important form of protection for the individual.