Getting Help for Non-Consensual Deepfake Images Under Singapore Law

Take a screenshot. Do it now. The moment you see a non-consensual deepfake image of yourself online, the instinct is to stare at the screen, refresh the page, and hope it disappears. It will not. The single most important move is to act within the first hour. First, capture the image or video showing the URL, the date and time stamp, and the uploader's username. That is your digital evidence trail. Second, report the material to the service where you found it, using its built-in reporting function for non-consensual explicit imagery. Third, if the image is sexually explicit or abusive, make a police report at the Singapore Police Force e-services portal or the Police@SG mobile app. You do both, not one or the other. Reporting to the service triggers removal under its terms of service, a faster but weaker remedy. A police report under the Protection from Harassment Act (POHA) starts a legal process with evidentiary requirements: preserve the screenshot, provide the service's response, and give a statement. If the image was created using personal data that was breached, say a stolen photo from a cloud account, the Personal Data Protection Commission (PDPC) has jurisdiction to investigate the data breach itself, separate from the abuse.

The common error is believing that clicking 'Report' on Instagram or TikTok is the end of the story. It is not. Reporting to a service is content moderation under a private company's terms of service; it is not a legal process.

How To Report On Each Service

On Meta-owned apps, use the 'Report > Nudity or sexual activity > Non-consensual intimate imagery' path, and include the URL. Google has a separate removal request form for non-consensual explicit imagery, which de-indexes the material from search results. TikTok's flow is under 'Report > Nudity and sexual activities > Non-consensual intimate imagery'. X (formerly Twitter) uses 'Report > It's abusive or harmful > Includes private information or media'. Telegram is different: you email [email protected] with the chat link and a description. These services are inconsistent. Meta removes within 24 hours; Telegram can take days.

When The Automated System Says No

The failure case: the automated system rejects your report because the image is AI-generated and not a 'real' photo of you. You escalate. Use StopNCII.org, a global tool that hashes the image so participating services can block re-uploads; it works with Meta, TikTok, Bumble, and OnlyFans. The report to the service is your first line of defence, but it is not the law. For a legal remedy, you must go to the police. Do not rely on the service's judgment about whether the material violates its rules; you are after removal first and justice second. The service may ask you to verify your identity, which feels invasive but is standard.

When There Is No Report Button

If the image is on a site with no reporting function, a random forum or a messaging app, your only route is a police report and a lawyer's letter. The IMDA can order a social media service to block access to egregious material under the Broadcasting Act section 45K, but that requires you to report the URL to IMDA directly. Write down every report you make: the report ID number, the date, and the response. This log is what you hand to the police.

Here is what the Protection from Harassment Act does and does not cover. POHA 2014, amended in 2019 to include doxxing and intimate image abuse, criminalises harassment, alarm, or distress. Section 3 prohibits behaviour that causes harassment. The penalty is a fine up to S$5,000 and imprisonment up to 6 months for a first offence; if the harassment includes a threat to publish an explicit image, the maximum rises to 12 months. The 2019 amendment added section 377BB and 377BF to the Penal Code, which specifically criminalises the distribution of non-consensual explicit images, AI-generated or not, with penalties of up to 5 years' imprisonment, a fine, caning, or any combination. The key point: the deepfake itself is not a separate crime. The distribution and the intent to cause distress are.

What You Need To Prove

To use POHA, you must show that the act was done with intent to cause harassment, alarm, or distress, or that a reasonable person would likely be so affected. The Singapore Police Force has an X-Secure form for submitting electronic evidence; you upload the screenshots, the URL, and a timeline. The evidentiary requirements are strict: you need the original file metadata if possible, which shows when and where the image was created. The Protection from Harassment Court can issue a Protection Order that compels the harasser to stop publication and take down the material; a breach of that order is an arrestable offence.

When The Harasser Is Anonymous

The failure case is when the harasser is anonymous and using a spoofed account. The police can apply to the court to compel the service to disclose the IP address and registration details, but this takes weeks. Meanwhile, you can ask the court for an interim order to take down the material while the investigation proceeds. OCHA (Online Criminal Harms Act) 2023, in force from February 2024, adds another layer: it targets online criminal activity and gives authorities the power to direct services to disable accounts or block material, with fines up to S$1,000,000 for corporations that fail to comply. You do not have to choose which law to use; you report under all of them. The police will decide which statute fits the facts. But do not wait for the police to act before you do the service report and the evidence preservation.

Removal is not the same as reporting. Reporting flags material; removal gets it off the internet. The fastest removal route in Singapore is the IMDA direction under the Broadcasting Act section 45K. IMDA received 147 reports of non-consensual explicit imagery in 2024, including AI-generated material. That figure is revised annually. IMDA can direct a social media service to disable access to egregious material for Singapore users within 24 hours. To trigger this, you submit a report to IMDA with the URL and a description of why it is non-consensual explicit imagery. You do not need a lawyer. The service must comply or face sanctions.

The Other Two Routes

The second route is the Protection from Harassment Court order under sections 12-13, which orders the harasser to stop publication and take down the material. The third route is the PDPC, but only if the image was created using personal data obtained through a breach. The PDPC can order the organisation to cease processing and delete the data under the Personal Data Protection Act.

When The Server Is Overseas

The failure case: the image is hosted on a server outside Singapore, and the service ignores IMDA's direction because it has no legal presence in the jurisdiction. Then you use StopNCII.org to hash the image, which prevents re-upload on participating services. For search engine removal, Google's form for non-consensual explicit imagery will de-index the URL from search results within days. Do not post the image yourself to 'explain' the situation; that multiplies the copies. The rule is: report, screenshot, then never share. The digital footprint of the image is permanent. It may be archived by the Wayback Machine or reposted on a site that does not cooperate with takedown requests. Your goal is to suppress the spread, not to fully delete it, because full deletion is rarely possible. Keep a record of every URL where the image appears; submit them all to IMDA. The service's internal reporting tool is for the service's benefit, not yours; it is not a legal instrument. The IMDA direction is a legal instrument.

You are not alone, and the support services in Singapore are specific, not generic. AWARE's Sexual Assault Care Centre runs the helpline 6779-0282; it handles image-based sexual abuse, including AI-generated material. PAVE Integrated Services at 6555-0390 provides counselling for individual and family safety, including online harms. SG Her Empowerment (SHE) launched in 2023 to provide online harms casework, including StopNCII support; they will walk you through the hashing process and liaise with services on your behalf. The Media Literacy Council (MLC) runs the 'Better Internet' campaign, which has resources on how to talk about deepfakes, but it is not a crisis line. If you are under 18, the Singapore Police Force has a dedicated online safety team.

What To Expect When You Call

The failure case: you call AWARE at midnight and get an answering machine. The helpline operates during business hours. If you are in immediate crisis, call the police emergency line. For the rest, the practical move is to use the police's X-Secure form, which is monitored around the clock. The support services will not report the crime for you; they will support you while you do it. Do not pay anyone to 'remove' the image; that is a scam. The Singapore Police Force does not charge for a police report. The victim support organisations are free.

Use The Waiting Time

What they do cost is time. The counselling waitlist can be two weeks, and the police investigation can take months. Use the gap to strengthen your digital security: change passwords, enable two-factor authentication, and audit which apps have access to your camera roll. The digital shadow of the image may follow you, but the support services can help you manage the social and emotional fallout. When you speak to a counsellor, be precise about the facts: the dates, the services, the usernames. That lets them give you targeted advice. Avoid the trap of believing that because the image is out there, nothing you do matters; that is the single-source settlement error applied to your own life.

What is the first thing I should do if I find a deepfake of me? Screenshot everything, including the URL and uploader name. Then report to the service and make a police report if the image is sexually explicit or abusive. Do not share or forward the material. Preserve the metadata if you can.

Is a police report different from reporting to the service? Yes. Reporting to a service enforces terms of service; a police report enforces Singapore law under POHA or the Penal Code. Do both. The service can take days; the police can issue directions to disable access within 24 hours via IMDA.

Can I sue the person who made the deepfake? Yes, under POHA you can seek a Protection Order and damages. The Protection from Harassment Court can order takedown. For criminal penalties, the Penal Code section 377BC provides up to 5 years' imprisonment. Legal aid is available through the Legal Aid Bureau if you qualify.

Does Singapore have a specific deepfake law? No standalone deepfake law exists as of 2026. Deepfakes are prosecuted under POHA, the Penal Code, OCHA, and the Broadcasting Act. This is changing, and the law is applied flexibly. Check the SPF website for the latest guidance.

Non-consensual deepfake image help in Singapore is not a single phone number. It is a sequence of actions that involve the service, the police, IMDA, and the PDPC. Singapore's legal framework is robust: POHA covers abuse, the Penal Code criminalises explicit image distribution, OCHA gives authorities the power to disrupt online criminal activity, and the Broadcasting Act lets IMDA order takedowns. But enforcement is uneven. IMDA's 147 reports in 2024 is a low number given the scale of the problem, and it is an annual figure that IMDA revises; check their website for the current data. The practical reality is that your success depends on the service's cooperation and the harasser's jurisdiction. If the deepfake originated overseas and the service is non-compliant, your legal remedies hit a wall. The law is enforceable, but the appeal and enforcement mechanisms are slow. A police report filed on a Tuesday may not result in a court order until months later. This is why the evidence preservation step is not bureaucratic; it is the difference between a case that proceeds and one that dies for lack of proof. The one thing the law cannot do is rewind your digital footprint. Once an image is online, it is copied, archived, and indexed. The law can punish the creator and the distributor, and it can compel removal, but it cannot guarantee that no copy survives. If you are a victim, your first responsibility is to yourself: preserve the evidence, report to the service, make the police report, and contact a support service. Do not wait for the perfect legal moment; act now. The law is on your side, but it only works if you use it.