From Images to Liability: Deepfake Policy Lessons Employers Need Now

Takeaways

• AI-generated deepfake sexual images are an emerging workplace risk for organizations, with scrutiny of alleged activity and the response to it both on the rise.
• Deepfakes can create significant legal liabilities and employee-relations issues.
• Employers should respond quickly and thoroughly upon receiving an employee complaint about misuse of AI and deepfake technology.

Article

Artificial intelligence (AI) has made it easier than ever to produce convincing, nonconsensual sexually explicit deepfake images from publicly available photographs. Employers should recognize that misuse of AI to generate fake, sexually explicit, or harassing content can introduce workplace issues and that organizational inaction can create significant legal risk for employers.

A recently filed lawsuit against Lancaster Country Day School in Pennsylvania illustrates the potential liability institutions face not only for the alleged misconduct, but also for how they respond after learning of it. According to the complaint, two students allegedly used AI tools to generate hundreds of sexually explicit “deepfake” images of female classmates and shared the images online. The lawsuit further alleges school officials received reports of the conduct months before law enforcement became involved, yet the school failed to take appropriate investigative or corrective steps.

Although the case involves alleged misconduct in an educational setting, the underlying issue increasingly extends beyond schools. Employers must consider how to respond when they receive reports that an employee may be creating, possessing, or distributing AI-generated sexual images of coworkers or other inappropriate materials.

Do Deepfakes Create Challenges in the Workplace?

Workplace deepfake incidents can arise in numerous ways:

• An employee uses publicly available photographs or recordings from LinkedIn, company websites, or social media to create and distribute sexually explicit deepfake images or voiceprints depicting a coworker.
   
• A supervisor uses AI tools to create sexualized images, manipulated recordings, or fabricated statements of a subordinate.
   
• Employees share AI-generated intimate images, manipulated content, or fabricated statements through workplace messaging platforms, email systems, or private group chats.
   
• An employee uses deepfakes to harass, intimidate, retaliate against, or stalk a coworker.
   
• Employees use company-issued devices, networks, or collaboration tools to create, store, or distribute deepfakes content.

The absence of actual nudity or underlying misconduct does not diminish the potential harm caused by deepfakes. Targets of such content frequently experience humiliation, anxiety, and concerns regarding professional and personal reputational damage over persistent dissemination of the material.

In the workplace, the creation or distribution of deepfakes may implicate harassment and discrimination laws, privacy tort theories, workplace violence and conduct policies, computer use policies, and potentially criminal laws.

Are Employers Obligated to Investigate?

Doe v. XYC Corp., 382 N.J. Super. 122 (App. Div. 2005), provides important guidance for employers’ response to reports of AI-generated sexual imagery in the workplace.

In XYC, the court considered allegations that an employer allegedly became aware that an employee used workplace technology to access and transmit child pornography involving his stepdaughter. The New Jersey appellate court held that an employer, under certain circumstances, may have a duty to take reasonable steps when it has actual knowledge of an employee’s misuse of company systems and the foreseeable risk of harm to identifiable victims. The court also noted the employer’s information technology policy authorized monitoring of communications conducted through company networks.

Although XYC arose in the context of child pornography rather than AI-generated deepfakes, its core lesson remains applicable — organizational liability may depend in part on what the employer knew and whether it acted reasonably in response.

Once an employer receives credible information that its systems are being used to victimize others, a passive response may become difficult to defend. Increasingly, plaintiffs contend that an employer that fails to investigate or intervene after receiving notice may have contributed to the continuation of the harm. The Lancaster Country Day School lawsuit reflects this premise. The complaint emphasizes not only the alleged creation of deepfake images, but also what the institution allegedly failed to do after learning of the conduct.

What Can an Employer Expect?

Depending on the jurisdiction and facts involved, employers could face potential exposure under a variety of legal theories:

Workplace harassment and discrimination

If deepfake sexual images target employees because of sex, gender, sexual orientation, or another protected characteristic, the conduct may support hostile work environment claims under Title VII of the Civil Rights Act and analogous state laws.

The images themselves may constitute severe misconduct even if they are created off-duty or on personal devices, particularly when they affect workplace conditions or relationships.

Workplace violence issues

Because many jurisdictions define workplace violence broadly, deepfake imagery may implicate an employer’s duty to prevent and investigate workplace violence. For example, California includes within its definition of workplace violence threats that cause “psychological trauma or stress.” Deepfake images can be used not only for sexual exploitation but also to threaten or harass against a coworker or someone else using the employer’s systems. If such content met the definition of workplace violence, employers may have a duty to investigate the incident and take appropriate remedial measures. Failure to respond adequately could result in a potential civil lawsuit or regulatory consequences, including citations from workplace safety agencies such as the Occupational Safety and Health Administration.

Retaliation claims

Deepfakes may be used in retaliation after an employee reports discrimination, misconduct, safety concerns, or wage-and-hour concerns.

Privacy and publicity claims

Victims may assert claims involving:

• False light
• Invasion of privacy
• Misappropriation of likeness
• Intentional infliction of emotional distress
• Defamation, depending on the circumstances
• State nonconsensual intimate imagery laws (because state laws vary widely, employers should consult local counsel)

Cyberstalking and stalking laws

Where the conduct involves repeated targeting, monitoring, intimidation, threats, or dissemination of sexualized images intended to inflict emotional distress, state stalking laws may also come into play. Many states have broadened their stalking statutes to encompass electronic conduct, including online harassment campaigns and image-based abuse.

Importantly, employers should be cautious about treating these matters as personnel issues. Depending on the circumstances, the conduct may also have criminal implications.

What Lessons can Employers Learn from Similar Deepfake Uses?

Organizations should treat deepfake-related complaints with the same level of seriousness as allegations of sexual harassment, threats, or workplace violence. The initial step is to contain the situation and mitigate any ongoing harm to the extent possible, whether intended or not. This may include taking steps to limit the further dissemination of the content. For example, if an employee is receiving offensive or harassing emails, the employer could work with its IT department to block, reroute, or otherwise manage those communications while maintaining potentially relevant records.

Equally important is conducting a prompt, thorough, and impartial investigation. A well-documented investigation of the complaint can help the organization make informed critical decisions, including whether corrective action, disciplinary measures, or referral to law enforcement may be appropriate.

What Are the Key Elements of an Investigation?

The particular investigative steps and timing of those steps will vary depending on the circumstances. However, the following measures would likely be components of a thorough investigation:

1. Preserve evidence immediately

Potential evidence may include:

• Emails
• Text messages
• Collaboration platform communications
• Social media posts
• Shared drives
• Company-issued devices
• Security logs
• Mobile device records (where accessible)

Routine deletion processes should be suspended where appropriate.

2. Verify the images

The investigation should focus on:

• Source of the images
• Metadata
• Distribution channels
• Creation tools used
• Individuals involved
• Whether company systems were utilized

In some cases, forensic specialists may be needed to determine whether AI generation occurred. Because these matters frequently require a prompt response, employers should have an investigation plan in place that identifies pre-vetted vendors capable of providing forensic and other specialized services.

3. Conduct a prompt and impartial investigation

Investigators should identify:

• Who created the images
• Who possessed or distributed them
• Whether management personnel were involved
• Whether others knew of the conduct and failed to report it
• Whether company systems were used

The scope of the investigation should extend beyond the alleged creator to recipients, participants, and others who facilitated dissemination of the content, as they too may have engaged in misconduct.

4. Assess whether law enforcement notification is appropriate

Employers should evaluate whether the conduct potentially violates:

• State criminal laws
• Cyberstalking statutes
• Harassment laws
• Nonconsensual intimate imagery statutes
• Child exploitation laws (if minors were involved)

While organizations should work with counsel before making law-enforcement referrals, they should not overlook the potential criminal implications of the conduct.

5. Protect the targeted employee

Employers should consider interim measures such as:

• Reporting structure changes
• Remote work arrangements
• Leave accommodations
• Employee assistance resources
• Anti-retaliation protections

The immediate goal is to stop ongoing harm and preserve a safe environment while the investigation is being conducted.

6. Analyze existing policies

Employers should review their policies to assess how they address:

• Creating nonconsensual images of coworkers
• Using employee photographs for AI image generation without authorization
• Using company systems to create or distribute sexually explicit content
• Harassing or retaliatory uses of AI tools

Practical Takeaways

The Lancaster Country Day School lawsuit highlights the growing reality that AI-generated deepfake sexual imagery is no longer a theoretical risk. Institutions may face scrutiny not only for the underlying misconduct but also for the adequacy of their response once allegations come to light.

For employers, the lesson is clear. When credible information suggests that an employee may be the target of AI-generated sexual imagery, organizations should respond promptly and thoughtfully. That response may include:

• Preserving relevant evidence;
• Conducting a timely and appropriately scoped investigation;
• Assessing whether criminal conduct may be implicated;
• Protecting affected employees; and 
• Implementing corrective measures to prevent further harm.

As Doe v. XYC Corp. illustrates, organizations’ legal exposure may turn not only on the actions of the alleged wrongdoer but also on what the organization knew and how it responded. In the age of generative AI, that principle may take on increasing importance as courts, regulators, and litigants evaluate employer responses to workplace deepfake incidents.

Jackson Lewis attorneys are available to assist employers with this and other workplace issues.