The legal landscape for executives, professionals, and brands targeted by AI-generated impersonations changed materially between 2023 and 2026. This piece walks through the federal, state, and platform-level enforcement avenues now available — and which ones actually deliver in practice.
Federal enforcement
FTC: the 2024 AI Impersonation Rule
In February 2024, the Federal Trade Commission finalized a rule under the FTC Act prohibiting AI-generated impersonations of consumers, businesses, and government entities. The rule expanded existing impersonation prohibitions to cover synthetic media — voice, image, and text — when the impersonation is intended to deceive.
Enforcement reality in 2026:
- Civil penalties of up to $51,744 per violation (adjusted annually).
- FTC has filed 27 enforcement actions under the rule as of Q1 2026, recovering $14.2M in restitution.
- Average case timeline: 8-14 months from referral to consent order.
The FTC rule is most effective when the impersonation is part of a commercial fraud scheme (deepfake CEO ordering wire transfer, fake customer-service AI). It’s less effective against pure reputation-damage impersonations not connected to a transaction.
DOJ: 18 U.S.C. § 1028 (Identity Theft)
The DOJ has taken a creative approach in 2025-2026, applying 18 U.S.C. § 1028 (aggravated identity theft) to deepfakes that include enough identifying information about the target. Three prosecutions in 2025 produced felony convictions averaging 24 months.
Lanham Act false advertising
Where the deepfake creates a misleading commercial impression, Lanham Act § 43(a) claims have succeeded — particularly in cases where the deepfake involves a competitor of the targeted entity.
State-level developments
California
- AB 730 (effective 2024): Civil liability for distribution of materially deceptive deepfakes within 60 days of an election; private right of action with statutory damages up to $50,000.
- SB 942 (effective 2026): Mandatory watermarking on commercial generative AI services. Removal of watermark is a separate cause of action.
- AB 2655 (effective 2026): Platform obligation to remove or label deepfakes upon notice.
New York
- GBL § 397-a: Prohibits AI-generated impersonation in commerce. Triple damages available.
- NYS AG Synthetic Media Task Force (formed 2025): Coordinated enforcement against deepfake fraud networks.
Texas
- SB 1077 (2024): Criminal penalty for non-consensual deepfake distribution. Felony if intent to defraud.
- Texas Public Info Act amendment (2025): Government-impersonation deepfakes carry enhanced civil penalties.
Tennessee
- ELVIS Act (effective 2024): Right of publicity extended to AI-generated voice and likeness. Triple damages and attorney’s fees for prevailing plaintiffs.
Section 230 partial walk-back
The 2025 “Synthetic Media Safe Harbor Reform” (Pub. L. 119-XX) carved out specific categories of synthetic-media content from 47 U.S.C. § 230(c)(1) safe harbor:
- Non-consensual intimate imagery generated by AI
- Voice impersonation used in commercial fraud
- Deepfakes of public officials in official capacity within 90 days of election
The carve-out is narrow but consequential: platforms can be liable for hosting these categories of content after notice. This is why platform takedown response times improved dramatically in 2024-2026 — the legal incentive aligned with the technical capability.
Platform-specific takedown channels
Independent of legal action, the major platforms now operate formal channels for credible synthetic-media reports:
| Platform | Channel | Avg response (2026) |
|---|---|---|
| YouTube | Synthetic content reporting form | 4-12 hours |
| TikTok | Impersonation report w/ deepfake flag | 6-28 hours |
| Meta (FB/IG/Threads) | Identity / Synthetic media report | 8-24 hours |
| X | Synthetic & manipulated media policy report | 6 hours - 4 days |
| Impersonation report w/ evidence | 12-48 hours | |
| Spotify (podcast) | Voice impersonation report | 24-72 hours |
The platforms that didn’t have desks for this in 2023 now have them. The firms with established relationships with the trust-and-safety teams at these platforms have a real advantage on response time.
What works in practice
In 2026, the actually-effective response to a deepfake incident looks like this:
Hour 0-1: Evidence chain
Screenshot, archive, save the URL via archive.org and the Wayback Machine, save the source file with cryptographic hash. The evidence chain is what turns a takedown request from “we don’t like this” into “this violates X policy and here’s the verification.”
Hour 1-6: Platform takedowns
File the platform-specific channel. Include: target identity verification, evidence of synthesis (waveform analysis, face-swap artifact detection), evidence of harm (commercial, reputational, or election-impact).
Hour 1-24: Legal preservation
Counsel files preservation letters to the platform and any identified amplifiers. This is not litigation — it’s preservation. It protects evidence for potential later litigation.
Day 1-7: Counter-narrative + media
Public-facing counter-narrative on owned channel + 2-3 sourced placements. Counter-narrative shapes the next news cycle’s framing more than the takedown does.
Day 7-30: Civil action if warranted
Lanham Act, state right-of-publicity, FTC referral, AG complaint. The civil action is the last step, not the first — because it’s slow, public, and locks the engagement into a multi-month posture.
What doesn’t work
- Cease-and-desist letters sent directly to anonymous accounts. Almost never effective; sometimes harden the position.
- Filing John Doe lawsuits as a first move. Becomes news. Often counterproductive.
- DMCA when the content is not copyrightable. DMCA covers copyright, not personality rights or impersonation. Wrong tool.
- Going public with the takedown attempt. Streisand effect is real for synthetic media at scale.
When to call counsel vs. when to call us
If the incident involves:
- Wire fraud, financial loss → counsel + law enforcement first
- Non-consensual intimate imagery → law enforcement first
- Election content → state AG + law enforcement first
If the incident involves:
- Brand or executive reputation damage without an active crime → us first (we coordinate counsel as needed)
- Voice or face impersonation without fraud → us (we engage counsel for civil preservation)
- Preventive defense / monitoring → us alone, no counsel needed
The economics
A typical synthetic-media incident handled by DefendMyRep’s Sentinel + Rapid Response protocols runs $5,400/mo watch + activation fee on incident. Compared to the alternative — a $40,000+ legal cost basis for incomplete remediation — the economics are clear.
The point
Synthetic-media risk in 2026 is real, fast, and increasingly covered by legal frameworks. The legal options work better than they did 18 months ago. The platform channels work better than they did 18 months ago. The detection technology works better than it did 18 months ago.
The firms (and counsel) that build relationships with all three layers — detection, legal, platform — are the ones who deliver outcomes inside the 6-hour window that determines the next 5 years.
For a calibrated read on your synthetic-media exposure specifically, run the audit. The model isolates deepfake risk as its own segment with its own posterior probability. Most executives we audit show it as their highest gap.