It is not you. It looks like you. That is enough to ruin a week, a job, a relationship. Someone took an ordinary photo of you and fed it to an app that undressed it. Now the result is moving through group chats, a fake account, a porn site, a coworker's phone. You did not take the photo. You did not send it. You did not consent to any of it. None of that stops the image from spreading, and none of it is your fault.
The law has started to catch up, but not evenly, and the gaps matter. The federal TAKE IT DOWN Act gets the image down and makes posting it a crime. It does not give you the right to sue anyone. That right comes from state law, and not every state gives it to you. So the order matters. Proof first. Takedown second. Then the crime, the person who posted it, and in some cases the company whose tool made it.
How little it took
A nudify app needs one clear photo. That photo usually came from somewhere public: your Instagram, a company bio page, a LinkedIn headshot, a photo a friend tagged. The app swaps your face onto a body that is not yours or strips the clothes off the photo you actually posted, and the result is realistic enough that a reasonable person believes it. Nobody needed your phone. Nobody needed a nude photo of you. They needed a picture of your face, and the internet is full of those.
Save the proof first
That sounds backwards. Your instinct is to report the post and make it disappear, but the report button is the fastest way to destroy your own evidence. Screenshot every post with the URL visible. Write down every place the image appears, the account names, the dates, the times. If the image carries a watermark, a logo, or a caption naming the app or site that made it, capture that too, because it may be the key to suing the company behind the tool. A platform deletes on request, and a screenshot does not, so report after you have the proof, not before.
One exception, and it is not optional. If the person in the image is under 18, do not download, save, or screenshot the image itself. Record the URLs, account names, and times, and report it to the National Center for Missing and Exploited Children's CyberTipline and to police. A sexual image of a minor is illegal to possess even when it is fake, and even when you are only trying to help. Let law enforcement collect it.
Stop the spread at the source
Do not fight one post at a time. For adults, StopNCII.org turns the image into a hash, a digital fingerprint, on your own device. The image never leaves your phone. The hash goes to participating platforms, and if someone tries to upload a match, the platform can block or remove it. StopNCII expressly accepts deepfakes and synthetic images of you. Two limits: it only works on its partner platforms, and a crop or filter can defeat a hash, so hash every version you find. If the person depicted was under 18, NCMEC runs a parallel service called Take It Down that works the same way.
Get it out of search results too. Google has a removal request form specifically for involuntary fake pornography, and when a request is granted, Google says its systems will also try to filter similar explicit results about you and remove duplicate images from Search.
Then there is the route most people miss. If the fake was built from a photo you took yourself, you own the copyright in that photo, and a DMCA copyright notice goes to the platform's copyright desk, not its abuse queue. That difference is real. In a University of Michigan audit, researchers posted 50 AI-generated nudes to X. All 25 reported as copyright infringement came down within 25 hours. None of the 25 reported under X's nonconsensual nudity policy came down in three weeks. Two cautions. If a photographer took your headshot, the photographer owns that copyright, not you. And a DMCA notice requires your name and contact information, which a platform may pass along to the person who posted the image, so consider having a lawyer send it for you.
The TAKE IT DOWN Act: what it does and what it does not
The TAKE IT DOWN Act was signed into law on May 19, 2025. It makes knowingly publishing a nonconsensual intimate image a federal crime, and it covers AI fakes, which the law calls digital forgeries. If the image is realistic enough that a reasonable person would believe it shows you, it counts. Publishing one carries up to two years in prison when the victim is an adult and up to three years when the victim is a minor. Threatening to publish a fake is its own crime, up to 18 months for an adult victim and 30 months for a minor, even if the person never follows through.
The platform half took effect May 19, 2026. A covered platform must give victims a way to request removal and must take the image down within 48 hours of a valid request. A valid request identifies the image, states in good faith that it was shared without your consent, and includes your contact information and signature. The platform must also make reasonable efforts to remove identical copies. The Federal Trade Commission enforces this part, with civil penalties of up to $53,088 per violation, and if a platform ignores your request, you can report it to the FTC at TakeItDown.ftc.gov.
Here is what the Act does not do. It does not give you a private right of action. You cannot sue the platform under it, and you cannot sue the person who posted the image under it. The federal government prosecutes the crime and the FTC polices the platforms. Your claim for money has to come from somewhere else.
Suing the person who posted it depends on where you live
There is a federal civil claim at 15 U.S.C. section 6851, from the Violence Against Women Act Reauthorization of 2022, with up to $150,000 in liquidated damages plus attorney's fees. But it was written for real intimate images, and whether it reaches a fake is an open question. That gap is exactly what the DEFIANCE Act would close. It would expressly add AI forgeries to section 6851, with liquidated damages of $150,000, or $250,000 when the fake is tied to sexual assault, stalking, or harassment. The Senate passed it unanimously on January 13, 2026. The House has not. It is a bill, not a law, and anyone telling you that you can sue under it today is wrong.
So for now, the right to sue over a fake lives in state law, and the states are not the same.
Pennsylvania amended its intimate image statute, 18 Pa.C.S. section 3131, through Act 125 of 2024. The original statute only reached images of a current or former sexual or intimate partner. The amendment added a separate offense for disseminating an artificially generated sexual depiction of any individual, with intent to harass, annoy, or alarm. No relationship is required. It is a second-degree misdemeanor when the victim is an adult and a first-degree misdemeanor when the victim is a minor. Pennsylvania also gives victims a civil claim at 42 Pa.C.S. section 8316.1, tied to the same statute: actual damages or $500, whichever is greater, up to three times actual damages, plus attorney's fees and costs. Because the civil claim borrows the criminal definition, on its text it now reaches AI fakes too. Separately, Act 35 of 2025 created the crime of digital forgery at 18 Pa.C.S. section 4101.1 for fakes made with intent to defraud or injure, but that one is criminal only. It gives you no claim of your own.
New Jersey enacted P.L.2025, c.40 on April 2, 2025. Making or sharing a deceptive deepfake to further a crime, like harassment or extortion, is a third-degree crime carrying three to five years and a fine of up to $30,000, and the law gives victims a civil claim for damages.
New York's Penal Law section 245.15 expressly covers intimate images created or altered by digitization, a Class A misdemeanor. New York also gives victims a private right of action for digitized sexually explicit depictions under Civil Rights Law section 52-c, alongside the intimate image claim in section 52-b.
Outside those three, check your own state carefully. As of August 2026, every state except Ohio and New Mexico had a law addressing sexually explicit deepfakes, but a criminal statute is not a civil claim. Some states will prosecute the person who posted your image and still give you no right to sue them.
Whatever state you are in, report it to your local police and to the FBI's Internet Crime Complaint Center at ic3.gov. A police report creates a paper trail that matters later, when the poster claims it was a joke or that someone else did it.
Suing the company whose tool made it
This is the newest front, and it is moving fast. The person who posted the image is not the only one who profited from it. The company that built and sold the undressing tool did too.
Governments went first. In August 2024, the San Francisco City Attorney sued the operators of 16 nudify websites, and eleven have since shut down. Victims followed. After Grok, the AI tool built by xAI, was used in early 2026 to generate sexualized images of real women and girls on X, multiple lawsuits were filed against xAI, including a class action in federal court in California on behalf of minors whose real photos were turned into abuse images. Those suits allege negligence in releasing a tool with no basic safeguards against sexualizing real people. Legislatures are moving too. Minnesota passed a first-in-the-nation ban on nudification tools in May 2026. xAI challenged it on First Amendment grounds, and in October 2026 the Eighth Circuit paused enforcement while that appeal proceeds.
Be clear-eyed about where this stands. These cases are early. The companies will argue that Section 230 and the First Amendment protect them, and I have not seen a court rule on the merits. The answer to that argument is that an AI company whose tool creates the image is not merely hosting something a user posted. It made the image. Whether courts accept that is the question these cases will decide. If an AI tool made the fake of you, preserve everything that identifies the tool, because that claim may be worth bringing.
Your face is yours
There is one more claim, and it is about your name, image, and likeness. The right of publicity protects against commercial use of your identity, and it is state law, so it changes at every state line. Pennsylvania's version is 42 Pa.C.S. section 8316, which covers unauthorized commercial use of a name or likeness that has commercial value. California's Civil Code section 3344 and New York's Civil Rights Law sections 50 and 51 do similar work. Tennessee's ELVIS Act, effective July 1, 2024, updated that state's publicity law to reach AI imitations of a person's voice. A federal version, the NO FAKES Act, is still a bill, not a law.
The publicity claim is strongest where your face is being used to make money: a site driving traffic with your image, an account selling access, an ad built on your likeness. A fake posted only to humiliate you is better attacked through the intimate image laws above. But where someone is profiting off your face, that is a separate claim, and it is yours to press.
Finding the person behind it
A lawyer's job after takedown is finding who did this. Platforms keep logs: IP addresses, email accounts, upload records, and payment records for the app that made the fake. Those records get preserved with a letter and pulled with a subpoena, often in a lawsuit filed against an unnamed defendant for exactly that purpose. The poster who hid behind a fake account is usually not as hidden as they think.
What people get wrong
Paying someone to take the image down does not end it. If someone is demanding money, that is sextortion, a separate crime, and paying marks you as someone who pays. Do not pay. Report it to the FBI. Do not argue with the poster in the comments. Do not send the image to more people while asking for help, and do not forward it to your employer or family to explain what happened. Describe it. Send the screenshots of where it appears, not the image itself. If it reaches your job, that is a second fight, and it is one I have handled for clients before. Keep the two fights separate.
You do not have to do this alone. The Cyber Civil Rights Initiative runs a free Image Abuse Helpline, 24 hours a day, at 844-878-2274.
The bottom line
The image is fake. The harm is real. For takedown and prosecution, the law now treats those as the same thing. For your right to be paid for what was done to you, it depends on your state, and Congress has not finished the job. The order matters. Proof first. Takedown second. Then the crime, the person, and the company whose tool made it possible. The person who made it is the one with something to answer for, not you.
Gabriel Vincent Tese is an attorney with Spector Gadon Rosen Vinci P.C. in Philadelphia focused on cyber litigation and technology law. Contact gtese@sgrvlaw.com.
This post is general information, not legal advice.
Learn more: AI Deepfake Nudes