Digital Coercion and Deepfakes: Organizational Readiness Without Surveillance
Until recently, an allegation of image-based abuse at work usually involved a real photo or video that someone shared without permission. Synthetic media changes the problem. A realistic fake intimate image or video can now be made from ordinary photos, and the person depicted may never have been photographed in any such situation. For an employer, the questions are the same ones it has always faced, with new difficulties: who owns the response, how fast it moves, how evidence is kept and how the person affected is protected, including from the organization.
This article, written with Fresno, Ca as a working context for a large mix of employers, universities and health systems, looks at organizational readiness for digital coercion and synthetic media. It stays on process and controls. It does not recommend surveillance of employees, and it makes no claim about how common these incidents are in any workplace, because no reliable workplace prevalence figure is cited here. It is educational and is not legal advice.
What changed in the law
In May 2025 Congress enacted the TAKE IT DOWN Act. A Library of Congress Congressional Research Service legal sidebar, The TAKE IT DOWN Act: A Federal Law Prohibiting the Nonconsensual Publication of Intimate Images, describes two main changes. First, the Act adds federal criminal prohibitions on knowingly publishing, through an interactive computer service, an intimate visual depiction or a "digital forgery" of an identifiable individual, a term covering intimate depictions created or altered using artificial intelligence or other technological means. It also prohibits certain threats to publish. Second, it requires covered platforms to set up a notice-and-removal process, under which a platform must remove a reported depiction as soon as possible and no later than 48 hours after receiving a valid notice. The CRS notes the platform requirement was due to be in place by May 19, 2026, and that the Federal Trade Commission enforces it.
Three cautions apply. The criminal provisions have elements, exceptions and burdens of proof that only a lawyer can apply to a specific case. State laws on nonconsensual intimate images and deepfakes vary and may offer other remedies. And a federal criminal law does not tell an employer what its own response process should be. An employer still needs to decide who acts, what it preserves and how it supports the affected person.
Why this is an organizational risk and not only a legal one
When a synthetic image of an employee circulates, the harm usually lands before anyone can prove it is fake. Colleagues may see it. The person depicted may fear they will not be believed. A manager who is unsure what to do may do nothing, or may do the wrong thing, such as asking the affected person to show the content to several people. Delay and improvisation are the organizational failures, and they are the ones a plan can fix.
The EEOC's chart of risk factors for harassment notes that coarsened social discourse and heated online conversation outside the workplace can make harassment inside it more likely or seem more acceptable, and recommends reminding the workforce which conduct is unacceptable. The same logic applies to digital conduct: expectations must be stated for the channels people actually use.
Where conventional approaches fall short
The harassment policy describes in-person and email conduct but is silent on synthetic media, private messaging and off-hours platforms.
No one knows who receives a report about a fake image, who preserves it and who contacts the platform.
Managers are told to "document everything," which in practice means forwarding the image around the organization.
The response focuses on finding the creator and neglects support for the affected person.
Monitoring tools are bought in the name of safety and used in ways that erode employee trust.
Five readiness controls that do not rely on surveillance
Name the owner and the path. Decide in advance who receives a report of synthetic or coerced imagery, who can authorize urgent steps, and who is the single point of contact for the affected person.
Limit the circle. Instruct managers not to forward, collect or open the content beyond what is necessary. Preserve evidence through the designated owner only.
Know the takedown routes. Keep current instructions for reporting content to the platforms involved, and for the notice-and-removal process the TAKE IT DOWN Act requires of covered platforms, and prepare the notice details a platform asks for.
Support first. Offer the affected person options immediately, such as temporary schedule or reporting-line changes if they want them, access to counseling or employee assistance, and plain information about their legal options, without pressuring them toward any one route.
Update the written expectations. State that creating, sharing or threatening to share intimate or synthetic images of a colleague is prohibited conduct under company policy regardless of how it was made, and that retaliation is also prohibited.
Employers that already use monitoring software should review its purpose and limits with counsel. Reading employees' private messages to look for problems is a different act from preserving a reported item through a defined process, and the first can create its own legal and trust problems.
Early-warning indicators that stay organizational
Reports of unwanted image sharing, group-chat misconduct or impersonation that never reach a central owner.
Gaps in policy language for private and off-hours digital channels.
Managers who say they would not know what to do with a report of a fake image.
Complaints that the same tool, channel or team appears repeatedly.
Longer delays between a report and first action on digital matters than on others.
None of these proves misconduct. They show whether the organization could respond if a report arrived.
How to measure readiness
A named owner and backup, confirmed in a quarterly test.
Time from a test report to first documented action and to contact with the affected person.
Share of managers who can correctly describe the first three steps in a scenario drill.
Whether policy language covers synthetic media and private channels, reviewed annually.
Whether takedown and evidence-handling instructions were reviewed in the last six months.
Where RMA fits
The Risk Mitigation Authority approaches misconduct as a human behavior problem, an organizational culture issue and a security issue at once. A Crisis Response Advisory Retainer gives an organization trained advisory support when an incident such as a deepfake allegation is reported, so the first hours are handled with a plan instead of improvisation. Learn more about RMA. No program can promise to eliminate misconduct or liability. A well-built one makes harm harder to commit, easier to surface and faster to correct.
Related reading
Continue with these related RMA articles:
References
Killion, Victoria L. The TAKE IT DOWN Act: A Federal Law Prohibiting the Nonconsensual Publication of Intimate Images. Congressional Research Service Legal Sidebar LSB11314, May 20, 2025.
U.S. Equal Employment Opportunity Commission. Chart of Risk Factors for Harassment and Responsive Strategies. Select Task Force on the Study of Harassment in the Workplace, 2016.
