Deepfakes are reshaping workplace sexual harassment.

For most of its history, workplace sexual harassment was bounded by physical proximity and authentic conduct — a comment, a touch, a message that actually came from the person who sent it. Synthetic media removes both boundaries. A harasser no longer needs access to a victim, only to a few public photographs, and the result can be fabricated, convincing, and impossible to fully recall once it spreads. The overwhelming majority of malicious deepfakes are sexually explicit and nonconsensual, and they fall disproportionately on women.^[1]

This is a sensitive subject, and it deserves to be handled as one. The point here is not the imagery; it is the harm done to a real person and the duty an employer owes them. What follows is a practical map of where that duty comes from and what a prepared organization does about it.

Why this lands on the employer at all

The instinctive objection is that a fabricated image made on someone's home computer, at night, has nothing to do with work. Title VII of the Civil Rights Act of 1964 does not draw the line there. Harassment becomes the employer's problem when it is severe or pervasive enough to alter the conditions of employment and create a hostile work environment — and conduct that originates off-premises can still permeate the workplace once coworkers see it, talk about it, or use it to intimidate. A synthetic image of an employee circulating on a team channel is not a private matter that happens to involve staff; it is a workplace event.

The standard for what counts as actionable has also moved in the employee's favor. In Muldrow v. City of St. Louis (2024), the Supreme Court rejected the heightened “significant harm” bar that many lower courts had imposed on Title VII claims, holding that an employee need only show some harm to a term or condition of employment.^[2] That recalibration makes it easier, not harder, for a targeted worker to get past early dismissal — and it raises the cost of an employer that treats a synthetic-harassment complaint as someone else's problem.

The federal guidance moved, then moved again

For a brief window the federal enforcement posture was unusually explicit. The EEOC's 2024 Enforcement Guidance on Harassment in the Workplace — its first comprehensive harassment guidance since 1999 — listed the sharing of “sexually demeaning depictions of people, including AI-generated and deepfake images and videos” among its examples of harassing conduct.^[3] For the first time, the agency had named synthetic intimate imagery directly.

That guidance is no longer in force. In January 2026 the Commission voted to rescind the 2024 document.^[4] It is worth being precise about what that does and does not change. Rescinding a guidance document does not repeal Title VII, narrow the definition of a hostile work environment, or make deepfake harassment lawful. The statute and the case law — including Muldrow — remain exactly where they were. What changed is the loss of an agency-blessed example employers could point to. The underlying exposure did not move; the roadmap did. Employers should plan around the durable law, not the document of the moment.

The takedown side of the ledger

Liability is only half the story. A targeted employee usually wants one thing first: the image gone. The federal TAKE IT DOWN Act, enacted in May 2025, criminalizes the nonconsensual publication of intimate visual depictions — including AI-generated “digital forgeries” — and requires covered platforms to remove reported content within 48 hours of a valid request.^[5] State law fills in around it: a clear majority of states now have statutes reaching nonconsensual intimate imagery or sexually explicit deepfakes, with wide variation in criminal penalties and civil remedies.^[6] An employer cannot file these requests for an employee, but it can know they exist, point the person to them quickly, and avoid the trap of telling a victim to simply wait it out.

The investigation reflex that now backfires

For decades, HR and legal teams operated on a quiet assumption: a photo, a recording, or a video of misconduct was real, and the burden sat with whoever denied it. Synthetic media inverts that reflex. The same skepticism applies in both directions — an image purporting to show an employee behaving badly may be fabricated, and an image purporting to be an employee may be fabricated too. Treating either as self-authenticating is now a way to reach the wrong conclusion and absorb liability for it. Where authenticity is genuinely in dispute, a forensic, provenance-aware review — not a gut call — is what protects everyone, including the accused.

An escalation path, before you need one

The figure below is the shape most defensible responses take. The worst outcomes in this area rarely come from the incident itself; they come from improvisation — a delayed response that reads as indifference, a public statement that gets ahead of the facts, an insurance policy with an AI exclusion nobody read until the claim.

What to do before an incident, not during one

Three changes carry most of the weight, and none of them require a standing crisis team:

1. Name synthetic media in the policy. Most handbooks define harassment in terms that assume the conduct is real. Add language that the creation or circulation of fabricated or manipulated intimate content about a colleague is serious misconduct, regardless of where or when it was made.
2. Write the response plan in calm weather. Decide in advance who triages a report, how content is preserved, when authenticity gets a forensic look, and who speaks publicly. A plan on paper is the difference between a measured response and a damaging improvisation.
3. Read the insurance before the claim. Employment-practices and cyber policies written before generative AI may carry exclusions or ambiguities around synthetic and third-party content. Find out now whether you are covered.

None of this makes the underlying harm smaller. What it does is put the employer on the right side of the only question a court — and the affected employee — will ultimately ask: when you knew, what did you do? For the verification side of that answer, see /safety-suite.