AI Deepfake Response Plans for School Districts
Schools need coordinated policies and procedures that protect victims, preserve evidence, involve families, and stop harmful content from spreading.
A deepfake response plan helps schools protect victims, preserve evidence, meet Title IX and state-law duties, and communicate without spreading harm.
An AI deepfake response plan should be established before a fabricated image, video, or recording reaches a school community. Once synthetic content begins circulating, administrators will not have days to decide who should investigate, how evidence should be handled, or when families and law enforcement should become involved. Those decisions may need to be made within minutes.
A student may arrive in the office after discovering that classmates are sharing an AI-generated explicit image bearing her face. A teacher may learn that a fabricated audio recording is spreading through social media. A superintendent may be told that a false video announcing a school emergency has appeared on an anonymous account.
In each situation, the school must respond quickly without amplifying the content, damaging evidence, compromising an investigation, or causing additional harm to the person depicted.
That requires more than an acceptable-use policy written before generative AI became widely available. Districts need a coordinated plan involving administrators, technology leaders, counselors, communications professionals, Title IX coordinators, legal counsel, school safety personnel, and families.
How common are deepfakes in schools?
The best national figures come from surveys rather than counts of reported incidents, and they are large enough for districts to plan around. In a Center for Democracy & Technology survey published in September 2024, based on nationally representative samples of public high school students and of middle and high school teachers and parents, 39 percent of students said they had heard of nonconsensual intimate imagery depicting someone associated with their school during the 2023–24 school year, and 15 percent knew of AI-generated deepfake imagery of that kind. Among students who had heard of such deepfakes, 51 percent said girls were more likely to be depicted, compared with 14 percent who said boys were.
A Thorn study released in March 2025, based on an online survey of 1,200 young people aged 13 to 20 conducted in the fall of 2024, found that 1 in 17 said someone had created deepfake nudes of them, and 13 percent personally knew someone who had been targeted while under 18. Its findings on seeking help bear directly on a school’s plan: 48 percent of teen victims told a parent or guardian, compared with 72 percent of teens who expected they would, and victims were much less likely than other young people expected to report to the police or to the platform. The National Center for Missing & Exploited Children (NCMEC) reports that its Take It Down service received more than 130,000 submissions in 2025 seeking help to remove more than 273,000 explicit images and videos of people who were under 18 when they were made.
The same CDT survey suggests that many schools have concentrated on punishment rather than recovery. Seventy-one percent of teachers said students caught sharing deepfake intimate images had been referred to law enforcement, expelled, or suspended for more than three days, while only 5 percent said their school had given victims resources to have the images removed from social media or other platforms. A written response plan is where a district can correct that imbalance before it faces its first case.
Policies Must Specifically Address Deepfakes
Many districts already prohibit bullying, harassment, impersonation, threats, and inappropriate technology use. Those provisions may apply to deepfakes, but relying entirely on older language can create uncertainty.
Students and employees should not have to interpret whether “technology misuse” includes cloning someone’s voice, fabricating a video, or placing a classmate’s face into an explicit image.
District policies should specifically address synthetic media, digital replicas, AI-generated impersonation, and manipulated images, videos, and audio. They should prohibit creating, requesting, distributing, or threatening to distribute content that falsely depicts an identifiable person when the purpose or effect is to deceive, exploit, intimidate, harass, humiliate, or cause harm.
Policies should also address the use of AI to create sexually explicit content, impersonate school employees, obtain confidential information, fabricate evidence, or spread false safety announcements.
At the same time, districts should distinguish harmful impersonation from legitimate educational uses such as satire, art, historical simulations, and media literacy projects. Legal counsel should review the final language for alignment with state law, Title IX, student due process, school disciplinary authority, and First Amendment protections.
State Laws and Guidance on Deepfakes of Students
Federal law now sets a baseline. The TAKE IT DOWN Act, which became law on May 19, 2025, prohibits publishing nonconsensual intimate depictions of a person, whether real or computer-generated, including depictions of minors, and it gave covered platforms one year to set up a removal process. The removal section below explains how that process works for families.
States are adding obligations that fall directly on schools. In Illinois, Public Act 104-0338, signed in August 2025, amends the School Code so that, beginning with the 2026–27 school year, cyber-bullying includes posting or distributing an unauthorized digital replica of a person by electronic means when doing so creates any of the effects listed in the state’s definition of bullying. The law defines an unauthorized digital replica as one used without the consent of the person depicted. In Massachusetts, the Department of Elementary and Secondary Education issued statewide guidance in April 2026 reminding schools that creating an AI-generated nude image of a minor is a crime under a 2024 state law and must be promptly investigated. School and district leaders are expected to investigate reports consistent with state anti-bullying and anti-discrimination laws and federal Title IX requirements, and the guidance includes resources on mandated reporting in cases involving abuse or exploitation.
Because these laws differ from state to state and continue to change, districts should ask counsel to set out, in the plan itself, which state statutes apply to synthetic images of minors, whether the state’s anti-bullying law reaches digital replicas, and what reporting duties staff members carry. Agreements with local police deserve the same review. After New Jersey enacted its own deepfake law in 2025, the New Jersey Principals and Supervisors Association advised school leaders to revisit their memorandum of agreement with law enforcement and to add a step to investigations that considers whether audio, video, or images offered as evidence may themselves be fabricated.
Who Leads a Deepfake Response Plan?
A deepfake incident can affect nearly every part of district operations. Leaving the response entirely to the technology department or building principal can create delays and missed responsibilities.
Technology staff may need to preserve account information, inspect school-issued devices, secure compromised accounts, and contact platform providers. Administrators may investigate student conduct. Counselors may support the person targeted. A Title IX coordinator may need to evaluate whether digital sexual harassment procedures apply.
Communications staff may have to correct misinformation, while law enforcement may become involved when content includes threats, exploitation, stalking, extortion, or possible criminal conduct.
Before an incident occurs, districts should identify who will lead the response and who will serve as the backup. The plan should specify who contacts families, preserves evidence, coordinates with law enforcement, evaluates Title IX implications, and communicates with the school community.
The plan should also name a substitute for any case in which the usual lead is the person depicted, because deepfakes target teachers and administrators as well as students. One Australian girls’ school, St Dominic’s Priory College, wrote its plan so that the deputy principal leads when the principal is targeted, keeping the principal one step removed, according to EducationHQ’s June 2025 account of the plan.
Australia’s eSafety Commissioner sets out the same structure in its Guide to responding to image-based abuse involving AI deepfakes, part of the Toolkit for Schools it updated in March 2026. The guide asks schools to have a designated member of the leadership team manage each incident, to share information only on a need-to-know basis, and to keep the wellbeing of the students or staff targeted at the center of the response rather than the school’s reputation. For evidence, it advises collecting what police will need while avoiding unnecessary exposure to and storage of explicit material, by making a written description of the content and noting where it is located. Its reporting steps follow Australian law, so a U.S. district should map them onto its own state requirements and law enforcement agreements. (eSafety Commissioner, licensed under CC BY 4.0.)
During the first hour, the district’s priorities should be to protect the person targeted, limit additional exposure, preserve essential evidence, notify the appropriate leaders, and determine which legal, safety, or cybersecurity procedures must be activated.
Speed matters, but speed should not become panic. Schools should avoid making public accusations, promising that every copy will be removed, or announcing conclusions before the facts have been evaluated.
Center the Needs of the Victim
The first adult response can determine whether a targeted student continues seeking help or withdraws in fear and embarrassment.
A student reporting a humiliating or explicit deepfake should be taken to a private setting and connected with a trusted administrator, counselor, or trained employee. The adult should remain calm, listen without judgment, and reassure the student that reporting the incident was the right decision.
The first questions should focus on safety. Is the student being threatened or blackmailed? Has the image been distributed to classmates, family members, teammates, or others? Is the student afraid to attend school? Is there an immediate mental health concern?
Adults should avoid blaming questions about why the student posted a particular photograph or used a certain app. A yearbook portrait, athletic photograph, or ordinary social media image can be manipulated without the student doing anything wrong.
The National Center for Missing & Exploited Children recommends focusing on the harm the child is experiencing rather than beginning with an investigation into how the image was created.
Support may need to continue through counseling, schedule adjustments, assignment extensions, contact restrictions, or assistance managing rumors. If the incident could constitute digital sexual harassment, the Title IX coordinator should be involved promptly.
The U.S. Department of Education’s Office for Civil Rights identifies the nonconsensual sharing of intimate images—whether real, altered, or created with AI—as conduct that may constitute online or digital sexual harassment, depending on the circumstances.
Preserve Evidence Without Spreading the Content
Digital evidence can disappear quickly. Posts are deleted, temporary stories expire, usernames change, and students remove messages once they realize administrators are investigating.
Schools should document available URLs, usernames, account names, dates, timestamps, captions, threats, and the names of people who may have received the content. However, employees should consult legal counsel and law enforcement before downloading or copying explicit material involving minors.
Students should not be asked to forward an explicit image to a school email account or send it to another device for an administrator to examine. Every unnecessary transfer can further distribute the content and create additional legal and privacy concerns.
The NCMEC Take It Down service specifically warns people not to download or have someone send them a nude, partially nude, or sexually explicit image of a minor solely to submit it to the service. If the content is not already on the original device, families and schools should seek help through the NCMEC CyberTipline or law enforcement.
District procedures should explain how employees can document an incident without placing harmful files into ordinary email, cloud-storage, student information, or discipline systems. Access to preserved evidence should be limited to people with an official role in the investigation.
Know When an Incident Must Be Escalated
A harmless classroom parody and an AI-generated sexual image of a student are fundamentally different situations. Districts should establish escalation criteria based on the nature of the content, the ages of the people depicted, evidence of threats or extortion, the extent of distribution, and the possibility of criminal conduct.
Immediate escalation may be necessary when an incident involves explicit depictions of a minor, sextortion, demands for money, threats of violence, stalking, compromised accounts, stolen credentials, or impersonation used to obtain records or confidential information.
Employees should not be expected to make complex legal decisions independently. District leaders should establish reporting expectations with legal counsel, child-protection personnel, and local law enforcement before an incident.
The NCMEC CyberTipline accepts reports involving suspected online child sexual exploitation. When a child is in immediate danger, schools and families should contact emergency services or local law enforcement.
Involving law enforcement does not end the school’s responsibility. The district must continue supporting the student and addressing the educational and emotional impact while any external investigation proceeds.
Act Quickly to Remove Harmful Content
Removing a deepfake does not guarantee that every copy will disappear, but rapid reporting can reduce its reach. The platform’s reporting process should be used to report impersonation, harassment, child exploitation, or nonconsensual intimate imagery. Families and districts should preserve confirmation numbers, emails, dates, and screenshots documenting the removal request.
Under the federal TAKE IT DOWN Act, covered platforms have been required since May 19, 2026, to offer a process for requesting the removal of nonconsensual intimate images, including AI-generated deepfakes. After receiving a valid request, a platform must remove the image as soon as possible and no later than 48 hours, and must make reasonable efforts to identify and remove known identical copies.
If a covered platform does not remove the content, does not offer a reporting process, or has a process that does not work, the victim or an authorized person can report the platform through the Federal Trade Commission’s TakeItDown.ftc.gov process.
This is different from NCMEC’s Take It Down service, which is intended for nude, partially nude, or sexually explicit images involving someone who was under 18 when the content was created. The service generates a digital fingerprint, or hash, on the person’s device. Participating platforms can use the hash to identify matching files without the image itself being uploaded to NCMEC.
Neither process guarantees that every copy will disappear. Schools should be honest about those limitations while helping families document reports and pursue available removal options.
Respond to the Students Who Created or Shared It
Many deepfakes of students are made by other students, and the plan should say how the school will handle them. Discipline should follow the district’s code of conduct and ordinary due-process procedures, with legal counsel involved when the conduct may be a crime. Serious consequences may be warranted, but they do not by themselves meet the school’s obligations to the student who was harmed. In releasing its survey, CDT noted that imposing consequences on the perpetrator does not relieve a school of its responsibility to address sexual harassment under Title IX.
The response should also distinguish among the student who created an image, students who forwarded it, and students who received it and did nothing further. Australia’s eSafety Commissioner, in a June 2025 advisory on deepfakes in schools, advises the parents of a young person who created or shared a deepfake to stay calm, explain the emotional and legal consequences, and encourage accountability, such as deleting the content and reporting it so platforms can remove copies. The same approach suits a school’s conversation with that student and family. Where contact restrictions or schedule changes are needed, they should be arranged so that the burden falls on the student responsible rather than on the student who was targeted.
Communicate Without Amplifying the Deepfake
A deepfake involving one student may require limited, confidential communication. A fabricated emergency message or false video involving a district leader may demand a broader response.
Public communication should be accurate, restrained, and focused on safety. The district should not repost harmful content to demonstrate that it is false, describe explicit material unnecessarily, identify a targeted student, or speculate publicly about who created it.
The district may need to confirm that fabricated content is circulating, explain that it is not an authentic school communication, and direct the community to verified district channels.
Communication with the targeted family should be direct and personal. Families should know what the school has confirmed, what steps have been taken, what support is available, who will serve as their primary contact, and when they can expect another update.
Much of this can be prepared in advance. In the St Dominic’s plan described by EducationHQ, the principal checks a letter to the school community before any incident occurs, and the school aims to send a first message within two hours of identifying a crisis, confirming that the content is synthetic and asking people not to share it. Ongoing situations receive daily updates; a single incident receives one initial advisory followed by a summary of findings and actions. A district does not need to copy those intervals, but deciding them beforehand removes one set of decisions from the first, most pressured hours.
Prepare Employees, Students, and Families
Employee training should focus on action rather than unreliable visual clues. Staff members need to know whom to contact, what information to preserve, what not to download or forward, and when immediate escalation is necessary.
Students must understand that creating a deepfake of another person without permission is not harmless experimentation. Instruction should address consent, privacy, dignity, legal consequences, and the inability to control content after it is shared.
Schools should also teach “upstander” behavior. Students who receive harmful content can refuse to share it and report the situation to an adult. Forwarding, saving, or commenting on the image may deepen the victimization even if the recipient did not create it.
Families also need clear guidance about how deepfakes are created, where harmful content can be reported, and whom to contact within the district. Conversations at home should reassure children that they can ask for help without automatically facing blame or punishment.
Schools and families should review privacy settings and consider how student photographs are shared publicly. District websites, social media accounts, athletic pages, and promotional materials should use clear photo-consent practices and honor families that decline permission.
A plan should also be tested before it is needed. A short exercise in which the response team walks through a realistic case will show gaps in contact lists, evidence procedures, and reporting duties more reliably than a policy review. The Future of Privacy Forum’s deepfake infographic and readiness checklist for schools, published in March 2025, offers a starting structure, covering education and training, how existing technology, policies, and procedures apply, and when to involve legal counsel and law enforcement. After each real incident, the team should review what worked and revise the plan.
Preparedness Demonstrates Care
An effective AI deepfake response plan does more than describe prohibited conduct. It gives employees confidence, provides families with a clear point of contact, protects evidence, supports victims, coordinates investigations, and helps the district communicate without increasing the harm.
Most importantly, it tells students what will happen when they ask for help: their concern will be taken seriously. They will not be blamed for someone else’s decision to manipulate their identity. They will not be left alone to negotiate with an offender or chase harmful content across the internet.
Deepfakes may be powered by rapidly changing technology, but an effective school response rests on familiar foundations: preparation, communication, trusted relationships, sound policy, and a commitment to protecting every person’s dignity.
Part Two of a Two-Part Series. Part One is AI Deepfakes: The New School Safety Threat.
Related reading
Subscribe to edCircuit to stay up to date on all of our shows, podcasts, news, and thought leadership articles.
More on Artificial Intelligence
