My Voice or Image Was Imitated with Artificial Intelligence: Remedies and Means of Protection
Last updated: 19.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer
Short answer: If your voice or image has been imitated with artificial intelligence (deepfake) and circulated, first record the content together with its address, date and the account that shared it, then pursue the removal routes simultaneously. You may file a notice with the platform, apply for an access ban under Article 9/A of Law No. 5651 on the Regulation of Internet Publications where the content concerns your private life, lodge a complaint with the Chief Public Prosecutor's Office (Articles 134, 135 and 136 of the Turkish Penal Code (TPC)) and seek an interim measure from a civil court under Articles 24–25 of the Turkish Civil Code (TCC). If an application processes your voice, an application under Articles 13–14 of the Personal Data Protection Law (KVKK) is also available.
Voice cloning and face-swapping tools can now, with a recording of just a few minutes, show a person saying words they never said or present them in a setting where they have never been. This article explains how a victim of voice or image impersonation with artificial intelligence (deepfake) can have the content removed, how to preserve the evidence and which authorities they can apply to. Blackmail offences in general and artificial intelligence law as a whole fall outside the scope of this guide.
What rights do I have when my voice or image is imitated with artificial intelligence?
Synthetic content imitating your identity is, as a rule, an unlawful infringement of your personality rights and opens criminal, civil and personal data protection remedies alike. The Turkish Penal Code contains no separate offence specific to artificial intelligence content; it is therefore necessary to examine which existing offence the specific content falls under.
A voice and a facial image are personal data, since they are information that makes a person identifiable. Where an application or a company processes such data to train a model or to produce an imitation, the Personal Data Protection Law (KVKK, Law No. 6698) also comes into play. Facial and voice data subjected to technical processing that enables identification may qualify as biometric data; Article 6 KVKK lists biometric data as special categories of personal data and prohibits their processing save for the exceptions set out in that Article.
In practice, four routes are considered together: removal of the content or blocking of access to it, a complaint seeking punishment of the perpetrator, cessation of the infringement and compensation before a civil court, and finally a KVKK application against the organisation processing the data. These routes are not mutually exclusive; the order is determined by the nature of the content and the speed at which it spreads.
Which offences can deepfake content constitute?
If the imitation content carries an image or sound relating to private life, Article 134 TPC applies; where personal data are disseminated without consent, Article 136 TPC applies; and where data have been unlawfully recorded, Article 135 TPC applies. The same act may also produce other consequences; in that case, which of the offences is to be applied is assessed according to the particulars of the case file.
Violation of the privacy of private life (Article 134 TPC)
Anyone may be the perpetrator of this offence. The first paragraph provides for imprisonment of one to three years for a person who violates the privacy of the private life of others; where the violation is committed by recording images or sounds, the penalty is doubled. Under the second paragraph, a person who unlawfully discloses images or sounds relating to the private life of others is punished with imprisonment of two to five years; the same penalty applies where such data are published through the press and broadcasting. Under Article 139 TPC, the investigation of this offence is subject to a complaint.
Recording and disseminating personal data (Articles 135–136 TPC)
Article 135 TPC provides for imprisonment of one to three years for a person who unlawfully records personal data; where the data relate to areas such as sexual life, health or belief, the penalty is increased by one half. Article 136 TPC, in turn, punishes a person who unlawfully gives, disseminates or acquires personal data with imprisonment of two to four years. These two offences are not subject to a complaint; the investigation continues even if the complaint is withdrawn. For a detailed analysis, see our guide to Articles 135–136 TPC.
Turkish Penal Code (TPC, Law No. 5237) – Article 136
(1) Any person who unlawfully gives, disseminates or acquires personal data shall be sentenced to imprisonment for a term of two to four years.
(2) Where the subject matter of the offence consists of statements and images recorded pursuant to the fifth and sixth paragraphs of Article 236 of the Code of Criminal Procedure, the penalty to be imposed shall be doubled.
The Court of Cassation regards the use, without consent, of photographs that a person had previously shared on their own account on a fake account as the unlawful dissemination of personal data, even where the image does not relate to private life. This approach also provides guidance for imitation content generated from publicly available photographs. For the current text of the Article, see the Article 136 TPC page.
"without taking into account that, in the absence of any grounds of justification, the defendant's act of publishing, from another fake Facebook account, photographs which he had unlawfully obtained without the consent of the intervening party constitutes the offence of unlawfully giving or acquiring data as regulated in the first paragraph of Article 136 of the Turkish Penal Code No. 5237"
Court of Cassation, 12th Criminal Chamber, E. 2020/1675, K. 2024/1466, 26.03.2024
In another decision, the same Chamber addressed a post made in a manner designed to create a misleading impression within the same framework. This is very often precisely the aim of imitation content: to create, in the viewer's mind, a perception of a relationship, statement or conduct that is not real.
"no error has been found, having regard to the content of the case file, in the finding of the 14th Criminal Chamber of the İzmir Regional Court of Appeal that the defendant's act of republishing photographs belonging to the intervening party, constituting personal data, in a manner giving rise to the perception that their relationship was continuing and contrary to the consent of the intervening party, constitutes the offence of unlawfully giving or acquiring data under Article 136(1) of the Turkish Penal Code"
Court of Cassation, 12th Criminal Chamber, E. 2020/751, K. 2022/3900, 18.05.2022
If money has been requested from your relatives using a cloned voice, the incident may additionally be the subject of an investigation for aggravated (qualified) fraud. Article 158(1)(f) TPC penalises fraud committed through the use of information systems as an instrument with imprisonment of three to ten years and a judicial fine; under this sub-paragraph, the minimum term of imprisonment is four years and the judicial fine may not be less than twice the benefit derived from the offence. This subject is also addressed separately in the guide to fraud through information systems.
How is deepfake content removed from the internet? A step-by-step process
The fastest route to removal is to launch the platform notice and the official application on the same day, after securing the evidence. The sequence below aims to limit the spread of the content while preventing the loss of evidence.
- Secure the evidence: Record the full address (URL) of the content, the username of the sharing account, the date and time, and the number of views and shares. In addition to screenshots, also make a screen recording.
- Warn the people around you: If there is a call or message requesting money or information in your voice, tell your family and business contacts to verify any request coming from you through another channel.
- Report it to the platform: File a notice using the impersonation, synthetic content or privacy violation option, and keep the reference number.
- Apply for an access ban: If the content concerns your private life, apply to the Cyber Security Directorate (Siber Güvenlik Başkanlığı) under Article 9/A of Law No. 5651 and submit the request to the criminal judgeship of peace for a decision within 24 hours.
- File a complaint: Lodge a written complaint with the Chief Public Prosecutor's Office together with the evidence; request that the platform records be obtained to identify the perpetrator.
- Consider the civil route: If the infringement is continuing, request an interim injunction (ihtiyati tedbir) from the civil court of first instance (asliye hukuk mahkemesi); if a company is processing the data, initiate a KVKK application.
How does an access ban under Article 9/A of Law No. 5651 work?
This route is available only for content that violates the privacy of private life. The application must include the URL, an explanation of the respect in which the violation occurred and information proving identity; an incomplete application will not be processed. Access providers implement the measure within four hours at the latest. The applicant submits the request to the criminal judgeship of peace within 24 hours; the judge announces the decision within 48 hours at the latest, failing which the measure is lifted automatically.
By Law No. 7590 dated 24.07.2026, the definition of "Directorate" (Başkanlık) in Law No. 5651 was amended to refer to the Cyber Security Directorate; the competent authority for the application must be determined accordingly. The current text of the Article is available on the Article 9/A of Law No. 5651 page.
Law No. 5651 on the Regulation of Internet Publications – Article 9/A (paragraphs 1 and 5)
(1) Persons who claim that the privacy of their private life has been violated by the content of a publication made on the internet may apply directly to the Directorate and request the implementation of the measure of blocking access to the content.
(5) Persons requesting the blocking of access shall submit their request for the blocking of access, on the ground that the privacy of private life has been violated by the content of a publication made on the internet, to the decision of the criminal judge of peace within twenty-four hours from the time of the request. The judge shall, having assessed whether the privacy of private life has been violated by the content of the publication made on the internet, announce the decision within forty-eight hours at the latest and send it directly to the Directorate; otherwise, the measure of blocking access shall be lifted automatically.
Which route remains for imitations that do not concern private life?
A video putting into your mouth a statement that is not yours may target your reputation rather than your private life. Article 9 of Law No. 5651, which governed applications to the criminal judgeship of peace in cases of infringement of personality rights, was annulled by the Constitutional Court's decision dated 11.10.2023, E. 2020/76, K. 2023/172 (Official Gazette 10.01.2024); the current text on mevzuat.gov.tr also shows the Article as annulled. For such content, therefore, the platform notice, a criminal complaint and an interim measure from a civil court come to the fore.
Social network providers with more than one million daily accesses from Türkiye are obliged, under Additional Article 4(3), to give a positive or a reasoned negative response to individuals' applications within 48 hours at the latest. Under Additional Article 4(14), if content whose unlawfulness has been established by a decision of a judge or court is not removed within 24 hours despite notification, the social network provider becomes liable for the resulting damage.
Which route, which authority and within what time limit?
Each route has a different authority and time limit; the table below brings together the time limits set out in the legislation.
| Route | Authority | Time limit | Outcome |
|---|---|---|---|
| Platform application | Social network provider | Response within 48 hours (Additional Article 4(3) of Law No. 5651) | Removal of the content or reasoned refusal |
| Access ban (private life) | Cyber Security Directorate, followed by the criminal judgeship of peace | Implementation within 4 hours; submission to the judge within 24 hours; decision within 48 hours (Article 9/A of Law No. 5651) | URL-based blocking of access |
| Criminal complaint | Chief Public Prosecutor's Office | For Article 134 TPC, 6 months from learning of the act and the perpetrator (Article 73 TPC); Articles 135–136 are not subject to a complaint | Identification of the perpetrator and public prosecution |
| Personality rights action | Civil court of first instance (place of residence of the claimant or the defendant) | An interim injunction may also be requested before the action is filed (Article 389 of the Code of Civil Procedure (HMK)) | Cessation of the infringement, declaratory relief, compensation |
| KVKK application | Data controller, followed by the Personal Data Protection Board | Data controller 30 days; to the Board 30 days, and in any event 60 days from the application | Erasure, cessation of processing, administrative review |
How is deepfake evidence preserved and which documents are needed?
Evidence must be collected before the content is removed and together with its source; proving content that has been removed is much harder afterwards. Since the real dispute in synthetic content cases is often the question "is this really my voice?", it is also important to keep your genuine voice and image recordings as samples.
- ✓The full URL of the content, the date and time of sharing, the username and profile address of the sharing account
- ✓Screenshots showing the date and time, and a screen recording playing the content from beginning to end
- ✓If possible, the original file of the content; the file should not have been edited
- ✓If a call or message was made in your voice, the call log, the number, the message screen and statements of those who forwarded it to you
- ✓The platform notice reference number, automated replies and correspondence with the platform
- ✓Your own genuine voice and image recordings for comparison (speech, video, voice messages)
- ✓Documents showing the damage caused by the content: loss of work, medical report, messages received from people around you
- ✓If an application or advertisement produced the imitation, the name of the application, its store page and the advertisement images
Where there is a risk of evidence being lost, preservation of evidence (delil tespiti) may be requested from the court even before an action is filed. Article 400 of the Code of Civil Procedure (HMK) makes it possible to request an on-site inspection, an expert examination or the hearing of witnesses in order to establish a fact to be asserted in a future action; where the evidence would be lost, or asserting it would become considerably more difficult, unless it is established immediately, a legal interest is deemed to exist. Demonstrating that the content was generated with artificial intelligence usually requires a digital forensic examination.
What can be requested before a civil court and under the KVKK?
A civil court may be asked to prevent the infringement, to bring an ongoing infringement to an end, to declare its unlawfulness and to award pecuniary and non-pecuniary compensation. Under Article 24 TCC, every infringement of personality rights is unlawful unless justified by consent, an overriding private or public interest, or the authority conferred by law. Article 25 TCC, in turn, provides that such actions may also be brought before the court of the claimant's own place of residence.
Turkish Civil Code (TCC, Law No. 4721) – Article 25 (paragraphs 1 and 2)
The claimant may request the judge to prevent the threat of an infringement, to bring an ongoing infringement to an end, and to declare the unlawfulness of an infringement whose effects persist even though it has ceased.
Together with these, the claimant may also request that the correction or the judgment be notified to third parties or published.
In a recent case involving a claim of voice cloning with artificial intelligence, it was alleged that a well-known person's voice had been processed through an application, offering users the possibility of making that voice say any sentences they wished. The defendant argued that the voice used was a voice altered by a computer program. The regional court of appeal concluded that this action, based on personality rights and personal data, should be heard not by the intellectual and industrial property rights court but under the general provisions.
"that there is no error in the rendering of a decision of lack of jurisdiction on the ground that, in the present action based on the allegation that the claimant's personal data were used without permission, there is no matter requiring the application of the Law on Intellectual and Artistic Works (FSEK)"
Ankara Regional Court of Appeal, 20th Civil Chamber, E. 2026/1078, K. 2026/1119, 22.05.2026
This decision shows that correctly determining the competent court from the outset in voice imitation cases prevents loss of time; in the case file, as two different courts issued decisions of lack of jurisdiction, only the question of jurisdiction was debated right up to the appeal (istinaf) stage.
If a company or an application is producing the imitation, a written application is first made to the data controller under Article 13 KVKK; the data controller concludes the request within thirty days at the latest. If the application is rejected, the response is found insufficient or no response is given in time, a complaint may be lodged with the Board under Article 14 KVKK within thirty days from the date the response is learned and, in any event, within sixty days from the date of the application. The same Article reserves the right of those whose personality rights have been infringed to claim compensation under the general provisions.
What are the common mistakes and exceptions in deepfake applications?
The most common mistake is to focus on getting the content removed and to argue with, or block, the sharing account before recording the evidence. This may lead to the content being deleted and the trail of the perpetrator being lost.
- Investigating the perpetrator on your own: Accessing the account of the person you suspect or collecting their data may give rise to a separate criminal accusation against you. If your account has also been taken over, see the guide to social media account takeover.
- Missing the complaint deadline: For acts falling under Article 134 TPC, the six-month complaint period begins upon learning of the act and the perpetrator; waiting may result in the loss of rights.
- Choosing the wrong route: An application under Article 9/A is available only for content relating to private life; for reputation-focused imitations, there is a risk of rejection.
- Relying on screenshots alone: A screenshot on its own is open to challenge; the URL, screen recording and original file should be kept together.
- Redistributing the content: Sharing the content in order to react to it increases its visibility and aggravates the damage.
There are also exceptions. An imitation clearly presented as humour that misleads no one may be assessed within the scope of freedom of expression; the boundary between criticism contributing to public debate and fake content that demeans a person is weighed separately in each case. Furthermore, removal of the content does not mean that its traces in search results will be deleted automatically; the guide to the right to be forgotten provides further information on this.
The Application Process with an Istanbul AI Law Lawyer
In deepfake cases, the outcome is often determined by three points: recording the content together with its source before it is removed, distinguishing between a privacy violation and a reputational infringement in order to choose the correct route of application, and making the complaint and interim measure requests in time. Av. Coşkun Genç Law Office provides legal support in Istanbul to persons subjected to voice or image impersonation with artificial intelligence in securing evidence, preparing access ban and complaint applications, interim measure and compensation claims before civil courts, and KVKK applications. In our work as an Istanbul AI law lawyer, each application is planned individually according to the nature of the content and the platform on which it has spread.
Victims wishing to obtain the support of an Istanbul cybercrime lawyer may request a preliminary assessment through our contact page, together with the URL of the content, screen recordings, platform correspondence and, where available, records of calls made in their voice. General information on our area of practice is available on the cybercrimes page.
Sources
- Turkish Penal Code (TPC, Law No. 5237), Articles 73, 134, 135, 136, 139, 158 – mevzuat.gov.tr
- Law No. 5651 on the Regulation of Internet Publications and Combating Crimes Committed by Means of Such Publications, Articles 2, 9, 9/A, Additional Article 4 – mevzuat.gov.tr
- Turkish Civil Code (TCC, Law No. 4721), Articles 24, 25 – mevzuat.gov.tr
- Personal Data Protection Law (KVKK, Law No. 6698), Articles 6, 13, 14 – mevzuat.gov.tr
- Code of Civil Procedure (HMK, Law No. 6100), Articles 389, 400 – mevzuat.gov.tr
- Constitutional Court, E. 2020/76, K. 2023/172, 11.10.2023 (Official Gazette 10.01.2024, No. 32425) – Constitutional Court Norm Review Decisions Database
- Court of Cassation, 12th Criminal Chamber, E. 2020/1675, K. 2024/1466, 26.03.2024
- Court of Cassation, 12th Criminal Chamber, E. 2020/751, K. 2022/3900, 18.05.2022
- Ankara Regional Court of Appeal, 20th Civil Chamber, E. 2026/1078, K. 2026/1119, 22.05.2026
Important: This article is for general information purposes only and does not constitute legal advice. The route of application and time limits vary according to the nature of the content, the platform on which it has spread and the date of the act; your specific case should be assessed separately on the basis of the current version of the legislation.