A synthetic intimate image is not a rumour and it is not a bad review. It is a file that depicts a person in an intimate way and was built or altered with software, then posted, messaged or threatened as if that settled the facts. Australians still write to platforms as if the word “deepfake” were a magic category. It is not. The live questions are narrower: is the depiction intimate, was it shared or threatened without consent, and which statute or product will move the host.
If you remember one distinction from this guide, make it this one: a label is not a removal. Meta, TikTok, YouTube and X have all shipped “AI generated” stickers. Those stickers are a transparency product. They are not the image-based abuse product, and they are not an eSafety notice. The person depicted usually wants the file gone, not captioned.
What the law will actually treat as the same harm
For most of the last decade, Australian image-based abuse law was written around a real photograph or recording that was later shared without consent. That is still the common case, and the non-consensual intimate images guide is the one to open if the file began as a captured image. The synthetic case is now treated as the same family of harm, not as a science-fiction add-on.
The Online Safety Act. The image-based abuse scheme administered by the eSafety Commissioner covers intimate images, including images that have been digitally created or altered. eSafety can give a removal notice to a service or, in some cases, to an end-user. That is an administrative clock, not a jury. Read what eSafety can actually order before you assume you need a Federal Court writ to start.
The Criminal Code. Commonwealth carriage-service offences now reach sexual material that depicts an adult and has been created or altered using technology, where the person depicted did not consent to the transmission. Threatening to transmit that material is its own problem. You can report a crime without waiting for a civil injunction.
State and territory IBSA offences. Several jurisdictions already had offences for distributing intimate images without consent, and several of those statutes catch digitally altered depictions. The charging decision is for police. Your job in the first week is to preserve the URL and stop the spread, not to pick the indictment.
What the law will not do: treat every unflattering synthetic portrait as intimate; criminalise a political satire that is not intimate material; or force a newsroom to unpublish a report about a deepfake scandal merely because the subject would rather the story died.
What platforms will actually do
Platforms run three drawers that people keep mixing up.
Integrity labels. “Made with AI”, “synthetic media”, a Community Note. Useful for a recruiter who might otherwise believe the frame. Useless as a takedown. Do not close the case because a sticker appeared.
Intimate-image and non-consensual-sexual-imagery policies. These are the queues that can delete the post, disable the account, and in some products feed a hash so near-duplicates are caught. They require you to use the victim or authorised-reporter flow, not a public reply asking the company to “do better”.
Legal removals. A court order, an eSafety notice, or a police request arrives in a different inbox and is not scored like a trust-and-safety ticket. If you already have one of those documents, attach it. If you do not, do not invent one.
X will sometimes leave a labelled commentary account standing. That is a speech product, not a finding that the depiction is lawful in Australia. Meta still handles the most Australian intimate-image reports; the form is slow and the appeals are worse, but it is the form that actually deletes files.
A platform decision that the post “doesn’t violate” is not a legal opinion. It is a queue outcome. You then move to eSafety, to a solicitor, or to Google’s image-removal products so the corpse stops ranking.
Prepare the file before you open anything
Most failed reports are incomplete, not unconvincing. Build a short dossier. Do not put the intimate file in it.
- The exact URL, copied from the address bar or the share sheet that still contains the post ID. A screenshot of a feed is not a URL.
- A screenshot of the public post as it appears in Australia, with the date visible, cropped so you are not reproducing the intimate region. Capture the account name, the timestamp and the engagement counts. That is enough to prove publication.
- Every mirror you can find in twenty minutes — the same file on Telegram, a forum, a “leak” blog, a Google Images thumbnail. Each host is a separate job.
- The legal or policy hook in one sentence. “This URL shows a synthetic intimate image of me published without consent.” If you cannot write that sentence, you do not yet have an IBSA job. You may have a defamation job, a copyright job, or a mess.
- Proof you are the person depicted, held ready for the platform or eSafety identity step. A redacted licence is usually enough. Do not upload a passport to a “reputation agency” you found on a search ad.
Keep the dossier off the cloud account that is already compromised. Do not forward the image to friends so they can “keep an eye out”. Every forward is a new copy. If a child is in the frame, stop and open when a child is in the footage instead of this guide.
eSafety, then the host, then Search
Use the image-based abuse report on eSafety’s site. Name the service, the URL, and the fact that the image is synthetic if you know that. You do not need a technical report from a university lab. “I did not make this and I did not consent to it being posted” is the operative sentence.
eSafety can be slower than a well-aimed platform button and faster than a statement of claim. It is also the only Australian administrative body that can require a service to remove IBSA material, rather than asking nicely. Services that ignore a notice start accumulating a regulatory problem. That is why you file there even when Instagram has already taken the first post down: the next scrape is the one that matters.
In parallel, use the platform’s intimate-image or non-consensual-sexual-imagery flow. If the company offers a hash-submission or StopNCII-style tool, use that too; the method is in the NCII tools piece. Then file Google’s sensitive-image and personal-information products for every URL that is ranking against your name. Google will not unpublish the host. It will, in defined cases, stop printing the card.
When the form will fail, and what to do instead
The form fails when the depiction is not intimate — a crude face-swap on a meme, a satirical portrait in clothes, a political video that is fake and vicious but not an intimate image. Those cases move to defamation, to the adult cyber-abuse scheme if the serious-harm test is met, or to the publisher’s own corrections desk. They do not become IBSA because you use the word “deepfake” often enough.
The form also fails when you cannot show you are the person, when the only copy lives on a host with no office and no email, or when the file has been re-encoded and re-uploaded faster than any hash list. That last problem is a programme, not a Saturday. Diary a weekly search for thirty days. Brokers and scrapers come back.
Agencies that promise to “wipe a deepfake in 24 hours” are selling a product nobody owns. Some of them file the same eSafety form you can file, then invoice you for the receipt. There is no shame in paying for tedious paperwork. There is shame in believing the paperwork is a spell.
A working sequence we recommend
- Capture the public URLs and non-intimate screenshots. Do not circulate the file.
- Report to the host on the intimate-image or IBSA policy, from the account of the person depicted if that account is still safe to use.
- File the eSafety image-based abuse report the same day.
- Submit hashes or use the platform’s repeat-detection tools where they exist.
- File Google image and personal-information removals for every ranking URL.
- If there is extortion, a threat to send the file to an employer, or a child in the frame, treat that as a police matter as well as an eSafety matter.
- Recheck Search, the host, and the obvious mirrors in a fortnight. Then again in ninety days.
If you want the desk to look at a general question about the process, use contact. Do not send the image, the prompt, or a zip of the scrapes. We publish method. We do not run your case.