Protect Your Identity from Deepfakes: Limit, Notice, Act

Additional resource for the lesson “Deepfakes and Identity Theft” — Online Anonymity course

To protect your identity from deepfakes, you do not need to disappear from the internet. It helps to know three things: how much of your face and voice is public, how you would notice if someone used them, and where you would go if it happened. This resource walks you through all three, calmly and in proportion to your life.

A. Why this matters

In this course, privacy means deciding what others know about you, and anonymity means acting without what you do being linked to who you are. A deepfake turns that second idea upside down. Instead of hiding a link, it invents one: a video, an image or a voice clip that ties your name and face to words or actions that were never yours.

This is identity theft in a new form. A fake profile with your photos, a short clip in which “you” recommend a product, a voice note in your name: each borrows the trust that people place in you. You are not responsible for someone else’s misuse. You can, however, make the misuse harder, notice it sooner and respond with a plan rather than in a panic.

Scams that use cloned voices, and the habits that defeat them, are covered in the Online Privacy course (see the boxes after section D). Here the focus is your own identity: the material that makes you copyable, and what to do if a copy appears.

What the sources say

Research has been heading this way for years. A 2019 paper presented at the International Conference on Computer Vision (ICCV), a peer-reviewed conference, showed that animated “talking head” models of a person could be learned from a few images, “potentially even a single image.”

Regulators have taken note. In February 2026, 61 data protection authorities, including the UK’s Information Commissioner’s Office (ICO), the European Data Protection Board, the European Data Protection Supervisor, France’s CNIL and Italy’s Garante, issued a joint statement on AI systems that “generate realistic images and videos depicting identifiable individuals without their knowledge and consent”. Among the harms it names are “non-consensual intimate imagery, defamatory depictions, and other harmful content featuring real individuals”. It asks organisations to “provide effective and accessible mechanisms for individuals to request the removal of harmful content”.

The European Commission, explaining EU data protection rules, defines personal data as “any information that relates to an identified or identifiable living individual”, and gives “posting a photo of a person on a website” as an example of processing it. A recognisable image of you is data about you, and the right to erasure is one of the rights the Commission lists.

Rules on deepfakes, and on what counts as an offence, vary by country, and they have been changing quickly. As of November 2026, useful starting points are the platform’s own reporting routes and, where those fail, the competent national services described below.

B. Key concepts: how to protect your identity from deepfakes

Five ideas, grouped around the three verbs of the title: limit, notice, act.

Raw material: what makes you copyable

A deepfake needs a sample of the person it imitates: clear photos or video of the face, recordings of the voice. The more public, sharp and varied the material, the easier it is to work with. Profile pictures, public videos in which you talk to camera and tagged photos taken by others all count.

Why it matters to you: You do not control the tools, but you do decide much of what they have to work with. Raw material is the part of the problem that sits in your hands.

Limit in proportion, not to zero

Limiting does not mean deleting your life online. It means asking, for each public item, whether it needs to be public. A business page may need your face; a family video rarely needs to be open to the whole world. Keeping your professional or creative presence public while moving personal photos and videos to friends only is a reasonable middle way.

Why it matters to you: The goal is less material for strangers, not less life for you. Proportion keeps the choice sustainable.

Your audience is part of your exposure

Material set to “friends only” can still be seen by the people on your friends list. An account you accepted without knowing who was behind it can see, save and reuse everything you share with friends.

Why it matters to you: The smaller and more familiar your audience, the shorter the list of people who can copy your face or voice without searching for it.

Notice early: an alert, not a vigil

You cannot watch the whole internet, and you do not need to. Google Alerts can send you an email “when new results for a topic show up in Google Search”, so an alert on your name, in quotation marks, works as a quiet early warning. Google’s Results about you tool, rolling out to adults in some countries, checks whether your home address, phone number or email appear in Google Search and can notify you when new results are found; Google is clear that removing a result from Search “doesn’t mean that the info is gone from the internet.”

Why it matters to you: Without an alert, you may only hear about a fake when someone else happens to see it. An alert makes that a little less like chance, and it costs a few minutes once.

Act: report as the person depicted

Platforms often need the person who is impersonated to report it themselves. Instagram’s impersonation form, which also covers Threads, states that it can “only act on reports from the person who’s being impersonated” or their representative, and asks for a photo of your ID, which it says is deleted within 30 days. YouTube’s privacy guidelines treat “altered” or “synthetic” content as content “that looks or sounds like you”, where it has been “significantly edited or generated by AI”; you can file a privacy complaint, and it helps to give the video link and the timestamps where you appear.

Why it matters to you: The person depicted has the strongest claim, and often the only one a platform will accept. Knowing the route before you need it turns a shock into a set of steps.

C. A practical example: Lucia and the video she never made

Lucia is 48, a parent who uses online services every day. She volunteers at her neighbourhood library and, each month, introduces its events in a short video on the library’s public page. Her own profile shows a clear, smiling photo. One evening a friend sends her a message: “Is this you?” The link opens a new account with Lucia’s name and profile photo. Its only video shows her face and her voice, promoting a paid online course, with a link to sign up.

Lucia never made the video. Someone had stitched it together from the library clips. Her first reaction is a jolt of embarrassment, then a question: what do I actually do now?

What changed when Lucia followed a plan

• She took screenshots of the account and the video, and noted the account name, the link and the date, before reporting anything.
• She used the platform’s impersonation form, as the person depicted, and attached her ID as it asked.
• She posted a short note to her friends: an account using her name was not hers, and they should not buy anything through it.
• She set an alert on her name in quotation marks.

A few days later the account had gone. Lucia kept presenting the library’s events in public videos, because that work matters to her and she had chosen the trade knowingly. She moved her personal photos and her friends list to a smaller audience, and removed a few connections she could not place. What changed most was not her settings but her confidence: next time, she knows the way.

D. Try it yourself: build your deepfake response kit (15 minutes)

Four steps. You will finish with a short note you can keep, and nothing you find means you did something wrong.

Step 1 — Note what an impersonator would copy first (4 minutes)

• Write down the accounts where your name appears together with a clear photo of you: these are what a fake account copies first.
• Add the two or three public videos or voice clips in which you are easiest to recognise. If you have done the voice-and-face exercise in the Online Privacy course, take them from that list.
• Next to each, note whether you want it public or simply never changed it.

Step 2 — Set an early warning (3 minutes)

Pick at least one of these two tools, offered here as examples:

• Google Alerts: enter your name in quotation marks and create the alert. Use “Show options” to choose how often you are told.
• Results about you in your Google Account, where it is available to you: add the contact details you want monitored and turn on notifications for new results.

Step 3 — Find your reporting routes before you need them (4 minutes)

• For the two platforms you use most, search their help centre for “impersonation” and save the link to the reporting form.
• Note what each form asks for. Some ask for a photo of your ID; others, such as YouTube’s privacy complaint, work best with the video link and the timestamps where you appear.
• Save both links in one place, such as a note on your phone.

Step 4 — Write your one-page response note (4 minutes)

Write four short lines you can follow on a bad day:

1. Record: screenshot, account name, link, date. Do this first, before you report.
2. Report: as the person depicted, through the saved form.
3. Tell: one message to your contacts saying the account or video is not you.
4. Escalate: where to go if the platform does not help (see section H), and when to involve the police, for example if there are threats or money is asked for in your name.

Keep it with your saved links. You will probably never need it, and that is fine.

Already covered in the Online Privacy course

Voice Cloning Scams: How Deepfakes Use What You Post
It explains how cloned voices are used in scams and how to check what your public voice reveals; this resource focuses on deepfakes that impersonate you and how to report them.

Family Safe Word and Call-Back: Your Defence Against AI Scams
It sets up two habits for checking a call before you trust it; this resource covers the other side, when someone uses your face or voice to deceive others.

E. Videos, articles and further resources

Research and regulators first, then where to get help, then platform documentation.

Research and regulators

ICCV 2019 (Zakharov, Shysheya, Burkov, Lempitsky) — Few-Shot Adversarial Learning of Realistic Neural Talking Head Models
A peer-reviewed paper showing how a talking head of a person can be learned from a few images, potentially a single one.
https://openaccess.thecvf.com/content_ICCV_2019/html/Zakharov_Few-Shot_Adversarial_Learning_of_Realistic_Neural_Talking_Head_Models_ICCV_2019_paper.html

Information Commissioner’s Office (UK) — International data protection authorities issue joint statement on privacy risks of AI-generated imagery
The February 2026 statement of 61 authorities, including European ones, on realistic images and videos of people made without their consent.
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/international-data-protection-authorities-issue-joint-statement-on-privacy-risks-of-ai-generated-imagery

European Commission — Data protection explained
What counts as personal data under EU rules, and the rights you have over it, including erasure.
https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en

Where to get help (UK)

SWGfL — Report Harmful Content
A national reporting centre, provided by the UK Safer Internet Centre, that helps with harmful content including impersonation.
https://swgfl.org.uk/services/report-harmful-content/

Platform documentation

Instagram Help Centre — Report an Impersonation Account on Instagram or Threads
The form for reporting an account pretending to be you, and what it asks for.
https://help.instagram.com/contact/636276399721841

YouTube Help — YouTube Privacy Guidelines
How to file a privacy complaint, including for altered or synthetic content that looks or sounds like you.
https://support.google.com/youtube/answer/7671399?hl=en

Google Search Help — Create an alert
How to receive an email when new results for your name appear in Search.
https://support.google.com/websearch/answer/4815696?hl=en

Google Search Help — Find and remove personal info in Google Search results
How Results about you checks for your contact details and notifies you of new results.
https://support.google.com/websearch/answer/12719076?hl=en

Links checked in November 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: understanding how your public face and voice can be turned into a false link to your identity, and what you can do about it.

Skills

• Finding the public items in which your face is clear or your voice can be heard.
• Setting up an alert on your name.
• Locating a platform’s impersonation or privacy reporting form.

Awareness

• Understanding that a deepfake attaches your identity to words or actions that were never yours.
• Knowing that platforms often need the report to come from the person depicted.
• Recognising that limiting material is a matter of proportion, not of disappearing.

Secure Behaviour

• Choosing the audience of each photo or video in which you can be recognised.
• Recording what you see before you report it.
• Telling your contacts promptly when an account or a video using your name is not you.

G. Questions to sit with

• Which of your public photos or videos would you keep public even now, knowing they could be copied, and why?
• If a friend messaged you tonight asking “Is this you?”, what would your first three steps be?
• Who in your friends list could you not name or place, and what can they see?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Limit the raw material

• MS6 — Make your social media accounts private where you can, so that your photos and videos reach the people you chose rather than anyone who searches for you.
• MS7 — Limit access to your account, photos and posts by changing privacy settings, starting with the items in which your face is clear or your voice can be heard.
• R23 — Connect only with people you know: the people on your friends list can see, and save, what you share with friends.

Minimum commitment: today, choose one public photo or video in which you can be recognised and either narrow its audience or decide, knowingly, to keep it public.

2. Be ready to act

• R29 — Messages sent in your name: when something appears in your name that you did not send or make, tell your contacts quickly so that they do not act on it.
• Keep your saved reporting links and your one-page response note somewhere you can find them.

• In the UK, if a platform does not act on your report, SWGfL’s Report Harmful Content service offers further guidance to people over 13. In the EU, national data protection authorities, several of which signed the 2026 statement, oversee how personal data, including recognisable images, is used.
• If a fake is sexual or intimate, go straight to specialist help, such as the UK Revenge Porn Helpline and its StopNCII.org tool for adults.

Minimum commitment: this week, set one alert on your name and save the impersonation form of the platform you use most.

In short

• A deepfake is a false link between your identity and something you never did; you can make it harder to create and quicker to remove.
• To protect your identity from deepfakes, limit public material in proportion: keep what matters to you, narrow the rest.
• An alert on your name and saved reporting links turn a shock into a plan.
• If it happens: record, report as the person depicted, tell your contacts, escalate if needed.

Related resources in this course

• Reverse Image Search Yourself: Who Can Find You from a Photo
• Stylometry: How Your Writing Style Can Identify You
• How to Use AI Chatbots Anonymously, and Where It Stops

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.