Section: Justice & law Author: V Reading time: ~27 min Sources and further reading: 22 items Topics: personality rights, likeness, identity, DSA, GDPR, criminal law, platforms SEO / working title: What to do when someone misuses your photograph or identity?
What to do when someone misuses your photograph or identity? The question sounds simple only until we notice that we are not comparing one form. A notice to a platform is not a court order. A criminal complaint is not an interim injunction. A complaint to ÚOOÚ is not an action for the protection of personality. And ČTÚ, as the digital-services coordinator, is not a takedown service. This article therefore does not look for a delete button. It asks which regime can carry which harm, when it makes sense to run them in parallel, and which promise of a takedown by morning is only a dangerous shortcut.
1. A fake profile with your photo is not one form
A woman finds a fake profile with her photograph. It is not a caricature, nor an old shared party picture. The profile speaks in her name, adds someone else’s sentences and sends messages to people who know her. A friend says: report it to the platform. A lawyer says: secure the evidence, send a demand for removal and, if needed, a claim under the Civil Code. A police officer says: come and file a report if there are signs of a criminal offence. Someone from compliance asks whether this is processing of personal data by a controller. On the ČTÚ page it says that the digital-services coordinator has no power to order content removed [12].
At first glance this is one deletion. In fact each person is describing a different problem. The friend is talking about a notice of illegal content under the platform’s rules and the DSA. The lawyer is talking about likeness, privacy, an order to cease the interference, removal of the consequence and satisfaction. The police are talking about the elements of an offence. ÚOOÚ is talking about a controller, processing and rights under the GDPR. ČTÚ is talking about the procedural duties of digital-service providers.
They can therefore all be partly right and a shared plan can still fail. The bad plan sounds like this: fill in one form, delete the evidence, wait for an authority and promise the family that it will be over by morning. A better plan starts more dully. URL, date, screenshot, account identification, the exact electronic location. Without that, a notice can be weak at the very moment when it needs to be specific [14].
A platform notice, a criminal complaint and a lawsuit are three different regimes. None of them is an instant-delete button.
— Jiný Kontext
2. A likeness has at least six layers
When we say “they misused my photo”, it sounds like one act. Law and platforms, however, see several layers. Each of them changes the question, the evidence and the result one can expect.
- Object: likeness, voice, name, a fake profile, intimate material or manipulated material.
- Channel: social network, advertising, a website, a messenger, e-mail or storage.
- Civil regime: consent, withdrawal of consent, an order to cease the interference, removal of the consequence, satisfaction and compensation.
- Criminal regime: depending on the features of the case it may be § 191a, § 181, § 184, § 175, § 209 or another offence.
- Platform regime: notice, statement of reasons, internal appeal and out-of-court dispute settlement under the DSA.
- Supervisory regime: ÚOOÚ for the processing of personal data, ČTÚ for the procedural duties of providers in the Czech Republic, the European Commission for very large online platforms.
This layering is not official pedantry. It decides what you can ask for and from whom. A court can hear a personality-rights claim under the Civil Code. The police can investigate a criminal offence. A platform must have a mechanism for notices of illegal content, but its decision is not a judgment. ČTÚ can address a provider’s duties; it does not replace a court in assessing every photograph.
“Identity abuse” therefore hides the difference between three situations. Someone published another person’s photo without consent. Someone set up an account that impersonates a particular person. Someone created intimate manipulated material. In ordinary speech that is one blow. In law it is several paths that sometimes meet and sometimes miss one another.
3. The best channel is the one whose failure does not promise a takedown by morning
With a misused photograph a person naturally wants speed. The fastest sentence, however, is usually the worst legal advice: “You report it somewhere and they delete it.” Sometimes a platform acts quickly. Sometimes it does not. Sometimes it removes one account and a copy lives on. Sometimes an interim injunction is needed. Sometimes a criminal file. And sometimes it turns out that the supposed takedown authority has no such power at all.
| Type of failure | What it looks like | How to test it | What limits the harm |
|---|---|---|---|
| Wrong channel | A complaint to ÚOOÚ about casual sharing among people | Is there a controller, or a personal and occasional operation? | A civil claim and a court; ÚOOÚ only where there is processing |
| A 24-hour promise | Waiting for ČTÚ or the platform to delete everything by morning | ČTÚ does not order takedown; DSA Art. 20 is not a deletion deadline | Traces, parallel tracks, an interim injunction |
| Swap of offences | Every deepfake as § 191a, or every profile as mere defamation | The elements of the particular offence, not a headline in an e-mail | A report to the Police of the Czech Republic with a description, not a confident qualification |
| A notice without a URL | The platform cannot find the content | Does the notice give the exact electronic location? | URL, screenshot, date before sending |
| Takedown of one copy | One page disappears, the material remains in messages | Is mirroring and re-upload being looked for? | Expect repeated steps, not one form |
A well-chosen channel is not the one that promises the most. It is the channel whose failure is understood in advance. When the platform does not reply, you have a trace for the next step. When criminal law does not cover the particular situation, a civil interference with likeness or privacy may still exist. When ÚOOÚ says there is no controller, that does not mean the interference did not happen. It means you were in a different regime.
4. Personality rights are not the GDPR
The Civil Code protects a person’s personality, likeness, privacy and manifestations of a personal nature. For likeness and an image recording it starts from the rule of consent. Capturing a person’s likeness so that their identity can be determined from the depiction is, as a rule, possible only with consent. Consent is likewise required for disseminating the likeness [1].
It does not follow that every photograph on the internet is unlawful. The Civil Code knows statutory licences. A likeness may, under certain conditions, be used to exercise or protect other rights, for an official purpose, reasonably for a scientific or artistic purpose, and for reporting. These exceptions are not a blank cheque. § 90 recalls proportionality: a statutory ground must not be used disproportionately in conflict with the person’s legitimate interests [1].
The GDPR addresses something else. It addresses the processing of personal data by a controller or a processor. A photograph can be personal data. That does not mean that every conflict about a photograph is automatically a complaint to ÚOOÚ. Casual sharing among people, a purely personal operation or a one-off dispute about a likeness need not fit the same procedural frame as a customer database, a company profile, a camera system or systematic publication.
The practical difference is simple. Civil law asks whether personality has been interfered with and what the other party is to do or make good. The GDPR asks who the controller is, what legal basis they have, how they fulfil the data subject’s rights and who supervises. That is not the same thing. It is the neighbouring floor.
5. A complaint to ÚOOÚ is not an action for the protection of personality
ÚOOÚ is the supervisory authority for the protection of personal data. It can be approached with a complaint against a controller or a processor if a person believes that the processing of their data has breached the GDPR [8]. That is an important path. It is not, however, a court action for the protection of personality, and the authority does not order an apology or damages for pain and suffering.
ÚOOÚ’s annual report for 2025 records 3,854 submissions, of which 2,514 were complaints and 1,340 were suggestions. The report states a year-on-year rise of 68%. The same document records 392 notifications of personal-data breaches [10]. These figures do not say how many people in the Czech Republic found a fake profile with their photograph. They measure the broad agenda of a supervisory authority, which includes among other things consents, camera systems, healthcare, breaches at controllers and further areas.
The GDPR gives the data subject a right to lodge a complaint, and Article 78 speaks of a right to a judicial remedy if the supervisory authority does not handle the complaint or does not inform the data subject within three months of progress or of the outcome [7]. Three months here is not a deadline within which a platform must delete someone else’s profile. It is a procedural rule for communication by the supervisory authority.
Before a complaint to ÚOOÚ
The first test is: who is the controller? Is this a company page, a database, an advertising system or systematic publication? Or is it a casual personal interference that belongs rather in civil law and on the platform? The second test is: can you describe the processing, the controller and the right that was breached? The third: are you asking ÚOOÚ for something that only a court can order?
6. A criminal complaint is not a private-law ban on dissemination
A criminal complaint has a different purpose from a lawsuit. The police and the public prosecutor’s office deal with whether the elements of a criminal offence are present. A civil court may deal with whether someone is to cease an interference, remove the consequence, apologise or make good the harm. These paths can complement each other. They do not replace each other.
That matters in practice for things that are on fire. A criminal complaint by itself need not stop dissemination quickly. A civil application for an interim injunction can aim at a ban or a removal, but it needs a different argument and a different process. A platform notice can remove the availability of content on a particular service, but it is not a judgment on the offender’s liability.
It is not the injured person’s task to write a perfect legal qualification in the heading of a filing. Their task is to describe what happened, when, where, who is affected, what content was published, what was said and what harm is threatened or has arisen. Legal qualification then belongs to the authorities conducting the criminal proceedings. An over-confident heading can do harm if it covers other features of the case.
In the misuse of a photograph, provisions on defamation, extortion, fraud or the newer offences linked to an inauthentic work and pornographic material may appear in different situations [3][4][5]. It does not follow that every copied photograph is a criminal offence. It follows that criminal law is a path for certain serious cases, not a universal button.
7. § 191a is not § 181(2)
From 1 January 2026 the Czech Criminal Code expressly provides for new situations around identity, likeness and inauthentic works. Act No. 270/2025 Coll. inserted, among other things, § 191a and an amendment of § 181(2) [6]. It is tempting to say: a deepfake is the new crime. That is too coarse.
§ 191a is aimed at the misuse of identity to produce pornography and to disseminate it without the consent of the person depicted. The basic range is up to two years’ imprisonment, besides alternatives, and qualified cases have a higher range of one to five years [5]. What matters is that it is a pornographic work and the consent of the person depicted. In the basic offence, proof of serious harm is not required as a separate element.
§ 181(2) is different. It works with an inauthentic work that uses a person’s likeness or another manifestation of a personal nature, but it requires intent to cause serious harm. The basic range under § 181 is up to two years [3]. Precisely the intent to cause serious harm can be the difference between a criminal and a non-criminal case, even if a civil interference with personality may remain.
As of September 2026 no annual statistic of prosecutions under these new provisions can be drawn from that. No such public annual series exists in the dossier. The precise sentence is therefore not that “X cases are rising”. It is that the legal framework has distinguished several types of inauthentic material and each has its own elements.
8. § 180 is not every copied selfie
The Criminal Code also knows unauthorised handling of personal data under § 180 [2]. People often ask about it in a misused-photograph case because a photograph can be personal data. § 180 is not, however, a general crime for every copying of a selfie. The provision is aimed at specific situations, for example data collected in connection with the exercise of public authority or a breach of a duty of confidentiality.
That does not mean a copied photograph is without protection. It means the protection may lie elsewhere. In interference with likeness and privacy in the Civil Code. In defamation, if someone spreads a false statement capable of seriously endangering a person’s standing. In extortion, if image material is used for pressure. In fraud, if the misuse of identity serves to obtain money or access [4].
This is precisely where it is dangerous to write oneself a legal diagnosis from the internet. One case can have several layers. A fake profile can be an interference with personality, a breach of platform rules, sometimes part of a fraudulent course of conduct and sometimes a criminal matter of another kind. But without the concrete content, communication, intent, harm and context, the mere sentence “they took my photo” cannot be turned into a finished offence.
A good filing therefore does not play legal bingo. It describes the facts, attaches the traces that are available and separates what is certain from what is supposed. That is not weakness. It is precision.
9. A DSA notice is not a court order. ČTÚ will not order a takedown
The DSA, the Digital Services Act, requires hosting services to have a mechanism that makes it possible to notify illegal content. Article 16 describes notices and action, Article 17 statements of reasons, Article 20 the internal complaint-handling system and Article 21 out-of-court dispute settlement [11].
That is important infrastructure. It does not mean that the user has been given a European “delete” button. A notice must be specific. In its materials ČTÚ stresses the requirements of a notice, including the exact electronic location of the content [14]. If the platform decides, a statement of reasons is to follow for some services. If the user disagrees, they may use the internal complaint. The DSA also provides for out-of-court bodies.
The most common swap concerns ČTÚ. On its page about the digital-services coordinator, the Czech Telecommunication Office states that it has no power to order content removed or to assess the unlawfulness of particular content [12]. A complaint to ČTÚ is therefore not a request that the office delete a photograph. It may aim at a procedural failure of the provider, for example that the mechanism does not work or that a required statement of reasons is missing.
Article 20 moreover sets a period of at least six months for lodging an internal complaint against a platform decision [11][13]. That is not a deadline within which the notified content is to be removed. Anyone who turns it into a promise of takedown is swapping a procedural right for a result.
ČTÚ as digital-services coordinator does not order content taken down. A complaint about process is not a request to delete a photo.
— Jiný Kontext
10. A host has no general duty to monitor
Act No. 480/2004 Coll. on certain information-society services works with the liability of information-society service providers. For the storage of information at a user’s request, the host’s liability is linked among other things to knowledge of the unlawful nature of the content or to circumstances from which the unlawfulness is obvious. § 6 also says that providers have no general duty to monitor the content they transmit or store [15].
That does not mean a hosting service is to do nothing. It means that the law has long refused a general watch over all content in advance. The DSA continues that with procedural rules for notices, statements of reasons, complaints and transparency. It is neither a simple “the platform is always liable for everything” nor “the platform is never liable for anything”.
In its information on the DSA, the Ministry of Industry and Trade gives the sharing of private photographs without consent as an example of illegal content [20]. That helps to understand why a notice makes sense. It does not add a public guarantee that particular content will disappear in a given number of hours, nor does it deal with copies outside that service.
The practical question for the injured person is therefore twofold. Can I notify the platform of the content so that it can find it and assess it? And do I have, beside that, a path toward the person or entity that caused the interference? The platform regime may be the fastest way to limit availability. It need not be the most complete path to liability.
11. Directive 2024/1385 is not an already finished Czech crime
Directive (EU) 2024/1385 of the European Parliament and of the Council deals with combating violence against women and domestic violence. Article 5 requires the criminalisation of certain forms of non-consensual sharing of intimate or manipulated material, including material created or altered by means of technologies. Recital 19 also speaks of deepfake material [16][17].
It is an important European framework. It is not, however, a sentence that can be copied into a Czech criminal complaint as a finished offence. The directive has a transposition deadline of 14 June 2027 [16]. The Czech Criminal Code has already adjusted some parts by an amendment effective from 1 January 2026. But the Union minimum and the Czech sections must not be equated without the text.
The difference is practical. The European text says what Member States are to ensure. The Czech Criminal Code says by what the authorities conducting criminal proceedings assess a particular act in the Czech Republic. If these sentences are mixed, an appearance of certainty arises that does not help a filing.
The directive is therefore a support for a broader trend and for reading a political commitment. It is not a substitute for an analysis of § 191a, § 181(2) or other provisions in a particular case.
12. A takedown on one platform is not a takedown everywhere
Even if a platform removes the content, the problem need not end. A photograph may be downloaded, forwarded, uploaded again, stored in archives, spread in messages or placed on another website. A re-upload is not proof that the first step had no point. It is the expected scenario for material that has once left control.
That is why it is dangerous to speak of “erasing the internet”. In practice we often deal with limiting availability, removing particular copies, an order to cease further dissemination, identifying the originator and compensation. Each aim needs a different tool. A platform notice can resolve one link. Civil proceedings can aim at a person or an entity. Criminal proceedings can address serious conduct. ÚOOÚ can address a controller and processing.
The same is true of evidence. If a person deletes everything they see so that they do not have to look at it, they may weaken their own ability to prove what was published. A copy for evidence is not a guide to dissemination. It is caution toward a future dispute. What is needed is what serves to substantiate the claim: the address, the time, a screen capture, identification of the account, communication with the platform and confirmation of the filing.
No public series in the dossier says by what median time Meta, Google or another platform in the Czech Republic deletes a misused likeness. Precise advice therefore cannot promise a number of hours. It can say how not to lose traces and how not to confuse channels.
One more difference matters. Removal of content and a ban on further conduct are not the same aims. The first looks at a particular copy: this link, this profile, this file. The second looks at the behaviour of a person or an entity: do not continue, do not upload again, do not approach those around the person, do not impersonate the injured party. A platform can solve the first aim inside its service without itself solving the second. A court path can aim at the second goal, but it need not immediately remove every existing copy beyond the defendant’s reach.
That is why a good record does not merely note “deleted”. It notes where the content was, when it was reported, how the platform replied, whether a new copy appeared and whether the same conduct is repeating. Repetition is then not only a further unpleasantness. It can be evidence that this is not a chance mistake, but a continuing interference that needs a stronger procedural response.
It is likewise useful to separate the result visible to those around from the legal result. Those around see that the profile has disappeared. The file, however, needs to know whether it disappeared after a notice, after a demand, after an intervention by a controller, or simply because the author moved it elsewhere. For the person, the first difference is psychologically smaller. For the next step it is decisive.
13. An intimate deepfake is a legal heading, not a detection contest
With intimate manipulated material the debate often turns to whether one can tell that the material is synthetic. That can be relevant to proof. It is not, however, the core of this legal question. This is not a contest of image detectors, nor voice forensics. It is likeness, consent, dissemination, harm and a legal heading.
The new § 191a is expressly aimed at the misuse of identity to produce pornography and to disseminate it without the consent of the person depicted [5]. § 181(2) works with an inauthentic work that uses a likeness or a manifestation of a personal nature, if there is intent to cause serious harm [3]. Directive 2024/1385 in turn shows the European frame for non-consensual intimate and manipulated material [16].
It does not follow that every manipulated image is the same act. It follows that the word deepfake is not enough by itself. What decides is what the material depicts, whether it is pornographic or intimate, whether it was disseminated, to whom, with what consent, with what intent and what interference arose.
The AI Act and the labelling of synthetic content do not settle this question as the deletion of someone else’s photograph. A label can matter for transparency. It does not by itself answer whether particular material is to be removed, whether harm has arisen or whether someone has committed a criminal offence. Those are other regimes.
14. 21,137 acts in cyberspace are not the number of misused photographs
The Police of the Czech Republic reported for 2025 a total of 21,137 registered acts in cyberspace [18]. The Ministry of the Interior, in the report on public order and internal security for 2025, records morals crime of 3,695 acts and a rise of 8.8%. It also notes a change of offences from 1 January 2025 [19].
These figures are useful as context. They are not counts of misused photographs of adults, nor counts of deepfake pornography in the Czech Republic. Cyberspace covers many types of conduct. Morals crime covers various acts, including rape, child pornography or sexual abuse. The unit is not “a fake profile with a photo”.
Precisely on sensitive topics the temptation arises to fill a missing figure with an estimate. That would be a mistake. The dossier expressly contains no verified statistic of victims of deepfake pornography in the Czech Republic. It also contains no public annual series of cases under the new § 191a and § 181(2) for 2026. That is why no such figure is used in the article.
Three tests of the regime
The civil test: is this likeness, privacy and dissemination without consent, or is there a statutory licence within proportionate bounds? The criminal test: are there elements of § 191a, § 181(2), defamation, extortion, fraud or another offence? The platform test: can you mark illegal content with an exact location, or are you only writing that you dislike the account?
15. Parallel channels are not an order of magic
In a sound procedure there is no single royal step. There is a parallel. First the traces: URL, date, screenshot, account identification, the text of messages, confirmation of the notice. Then the platform: a notice of illegal content with a concrete location and a reason why the content is illegal. Then the civil plane: a demand to cease the interference and remove the consequence, and if needed an application for an interim injunction or a claim under § 81 to 90 of the Civil Code [1].
A criminal complaint makes sense if the situation carries the elements of a criminal offence. With intimate pornographic material without consent that may be § 191a. With an inauthentic work using a likeness and intent to cause serious harm, § 181(2). With pressure, false statements or pecuniary harm, other provisions may come into play [3][4][5].
ÚOOÚ belongs in the plan when this is processing of personal data by a controller or a processor. ČTÚ belongs in the plan when we are addressing a provider’s procedural duties under the DSA, especially for services established in the Czech Republic. The European Commission has a role for very large online platforms. None of these sentences, however, means that the authority itself deletes someone else’s profile.
What needs to be tested
Do you have the exact location of the content? Do you know whether the other side is a controller, a platform, a private person or an unknown account? Do you want removal of particular content, a ban on further dissemination, compensation for harm, a criminal response, or a procedural check of the platform? The answer decides the channel. Not the other way around.
16. A documentable parallel says more than one form
One form can help. One form, however, rarely carries the whole harm. A documentable parallel means that each step leaves a trace and each aim has a matching path. A platform confirmation shows what was notified. A demand shows what the injured person asked for. A criminal complaint shows how the facts were described. An application to a court shows what ban or removal is sought.
This is not a guide to waging war on an account. The aim is not to silence criticism or to misuse a notice against inconvenient content. The aim is to protect likeness, identity and privacy where a person’s rights are in fact being interfered with. Equally, the aim is not to explain how to produce manipulated material or how to circumvent a platform’s rules. The article describes defensive channels and their limits.
A documentable procedure has one more advantage: it blocks exaggerated promises. If the platform does not reply, we know what is missing. If an authority is not competent, we know why. If a court path needs more evidence, we know which evidence had to exist before the content vanished from the screen.
The best practical advice is therefore not “click here”. It is the sentence: do not lose the traces, do not confuse the regime, and do not expect from one actor a power they do not have.
Such a procedure also protects the other side from an overshot claim. Not every unpleasant comment is identity abuse. Not every use of a photograph is without a licence. Not every breach of platform rules is a criminal offence. A precise distinction is therefore not a concession to an offender. It is a condition for the interference to be handled where it has a chance of standing. If this is a news photograph in a proportionate context, the dispute will be different from a fake profile. If this is a company profile that uses an employee’s portrait after consent has been withdrawn, the dispute will be different from an unknown account that spreads intimate manipulated material.
This is where the value of a short internal map shows. Column one: what the content is. Column two: where it is placed. Column three: which regime is triggered. Column four: what result we expect from it. When a row stays empty, that is not a detail. It is the place where time will later be lost.
17. The question is not how to delete it. It is which regime can carry which harm
A misused photograph creates a legitimate need for a quick end. Internet content, however, has no single switch, and the law has no single form. Personality rights address an interference with a person. Criminal law addresses an act that society treats as so serious that it answers with punishment. The platform regime addresses the availability of content at a provider and the procedures under the DSA. Supervisory authorities address their own stretches, not everything at once.
It does not follow that the injured person is to give up. It follows that they are to refuse a false simplicity. Anyone who promises an instant takedown often skips the evidence, the court claim and the procedural limits. Anyone who sends everything to one office can lose time. Anyone who names everything a crime can miss the civil path, which is more important for removing the consequence.
The right question is therefore not: how do we force the internet to delete the photo? It is: which of the three regimes are you triggering now, what can a court order, what can the police investigate, what is a platform to assess, and why the DSA coordinator in the Czech Republic is not a delete button. Identity is not defended by the single word “report”. It is defended by not letting three different regimes melt into one promise.
Related texts in this series
- Deepfake: How to recognise a fake video… — detection of a file vs. a legal takedown channel.
- Is a photograph evidence?
- How to find out whether your password has leaked… — another kind of identity abuse.