Entrance

Thanks to artificial intelligence technologies, a person's face can be superimposed onto another image, their voice can be imitated, their writing style can be copied, and social media accounts that give the impression of belonging to the real person can be created. The ability to produce fake images, audio recordings, video calls, identity documents, bank statements, or private correspondence using these methods has significantly expanded the boundaries of the classic concept of "identity theft.".

Identity impersonation using artificial intelligence doesn't just mean using someone else's name. It also includes creating a digital copy of a person by combining their face, voice, signature, speaking style, photograph, professional title, social circle, and personal information.

The Turkish Penal Code does not contain a separate and general crime type under the name "identity impersonation with artificial intelligence." However, depending on the purpose of the act and the nature of the data used, it may constitute crimes such as unlawful use of personal data, violation of privacy, fraud, defamation, blackmail, slander, forgery of documents, or misuse of another person's identity information. Criminal liability is determined not by the name of the technology used, but by the specific act committed by the perpetrator.

What is AI-Powered Identity Impersonation?

Identity impersonation using artificial intelligence can be carried out in various ways:

• Asking for money from relatives or employees by imitating someone's voice,
• Placing a real person's face onto fake videos or obscene images,
• Creating a fake social media account using a person's name, photo, and professional information,
• Sending messages by mimicking a person's way of speaking using artificial intelligence,
• Deceiving a bank or company employee through a fake video call,
• Creating forged contracts, power of attorney documents, identity cards, or payment receipts in a person's name,
• Creating false audio and visual evidence to show that a person has committed a crime.

The common feature of these actions is the unauthorized use of identifying elements belonging to a real person, creating a false impression among third parties that the content was created by that person.

Uploading a person's photograph, voice, identification information, or private correspondence to generative artificial intelligence systems can also constitute personal data processing. The Personal Data Protection Authority states that the principles of personal data protection, privacy, purpose limitation, proportionality, and auditability must be observed during the development and use of generative artificial intelligence systems.

Is there a separate "Identity Impersonation Crime" in Turkish Law?

Article 268 of the Turkish Penal Code criminalizes "using another person's identity or identity information." However, this article does not cover all forms of identity imitation used in everyday language.

For Article 268 of the Turkish Penal Code to be applicable, the perpetrator must:

1. Having committed a crime previously,
2. His desire to prevent investigation or prosecution against himself for this crime,
3. Using an identity or identity information belonging to another real person

These conditions must be met. If these conditions are fulfilled, the perpetrator will be punished according to the provisions relating to the crime of defamation.

For example, if a person arrested for a crime provides law enforcement officers with the identity information of their sibling or another natural person, and this leads to the investigation being conducted against that person, this could be evaluated under Article 268 of the Turkish Penal Code.

Conversely, creating a fake social media account using a person's photograph, imitating their voice with artificial intelligence, or sending messages to third parties in their name are not directly covered under Article 268 of the Turkish Penal Code. In these cases, different types of crimes must be evaluated depending on the purpose of the act.

The conditions of Article 268 of the Turkish Penal Code may not be met if the perpetrator uses a completely fictitious name instead of a real person, or if they use someone else's identity for a purpose other than diverting the investigation away from themselves. In cases of making false statements about identity before an official authority, the crime of making false statements in the preparation of an official document, as defined in Article 206 of the Turkish Penal Code, may arise depending on the specific circumstances of the case. In the practice of the Supreme Court, it is accepted that Article 268 of the Turkish Penal Code can only be applied in cases where the perpetrator aims to divert the investigation and prosecution of their own crime to another real person.

Which Personal Rights Are Violated by Identity Impersonation?

A person's name, image, voice, honor and reputation, private life, professional identity, and social persona are all protected under the right to personality. Artificial intelligence-based impersonation can eliminate the victim's right to control their identity in society and may lead third parties to establish a link between the real person and the fabricated content.

According to Article 24 of the Turkish Civil Code, a person whose personal rights have been unlawfully violated may request protection. Within the scope of Article 25 of the Turkish Civil Code, the victim is:

• Preventing the threat of attack,
• We demand an end to the ongoing attack
• Determining the illegality of the ongoing attack,
• Notifying or publishing the correction or decision to third parties,
• Material and moral compensation,
• He wants the profits obtained from the attack to be given to him

They can make such a request. Article 58 of the Turkish Code of Obligations also allows a person whose personal rights have been violated to claim moral damages and to have a decision condemning the attack published.

Therefore, the fact that the act does not constitute all the elements of a specific crime under criminal law does not prevent the victim from filing a civil lawsuit based on their right to privacy. Identity impersonation, which does not constitute a crime under criminal law, may be considered an unlawful attack on the right to privacy under private law.

Unlawful Use of Personal Data

Personal data may include a person's name, surname, photograph, telephone number, identification information, signature, address, occupation information, and voice recording. Facial or voice data may also become biometric data when subjected to special technical processing for the purpose of uniquely identifying or verifying a person's identity.

According to Article 135 of the Turkish Penal Code (TCK), a person who unlawfully records personal data is sentenced to imprisonment for one to three years. If the data relates to sensitive areas specified in the law, such as health, sexual life, political views, religious or philosophical beliefs, the sentence is increased by half. Article 136 of the TCK stipulates imprisonment for two to four years for the unlawful disclosure, dissemination, or acquisition of personal data. If the crime is committed by taking advantage of the ease provided by a public office or a particular profession, the sentence may be increased according to Article 137 of the TCK.

For example, the use of a victim's photographs, audio recordings, and identity information obtained from a data breach or a compromised account in an artificial intelligence system, followed by their dissemination through fake accounts, videos, or audio recordings, can be examined under Articles 135 and 136 of the Turkish Penal Code, depending on the nature of the act.

However, the mere fact that a photograph is publicly available on the internet does not mean that it can be used for any purpose. The public availability of data and the creation of a false identity using artificial intelligence, fraud, or the defamation of a victim are different legal situations. The purpose of use, scope, consent, proportionality, and the manner in which the data is combined with other data must be evaluated separately. In the application of the Personal Data Protection Law (KVKK), it is accepted that data used to verify identity through techniques such as facial recognition may constitute special categories of biometric data.

Violation of the Right to Privacy

Article 134 of the Turkish Penal Code punishes acts that violate the privacy of individuals. The penalty is increased if the violation is committed through video or audio recording; the unlawful disclosure of images or sounds relating to private life is also subject to separate sanctions.

In cases of identity theft using artificial intelligence, Article 134 of the Turkish Penal Code may come into play in the following situations:

• Real private images of the victim were replaced with artificial intelligence
• Using an audio sample of a private conversation to create fake content,
• The publication of real private life images in a different context,
• The processing of images or sounds belonging to the victim's private sphere for the purpose of imitation.

However, the application of Article 134 of the Turkish Penal Code may be debatable in cases where the content is entirely artificially created and does not contain any images or sounds related to the victim's real private life. For example, whether a fabricated obscene image created from scratch using only the victim's face should be considered a "real image related to the victim's private life" must be evaluated separately in the specific case.

Even if it is concluded that this type of content does not fall within the scope of Article 134 of the Turkish Penal Code, the provisions regarding the unlawful use of personal data, defamation, blackmail, or attacks on personal rights may still apply. The perpetrator's legal responsibility is not eliminated solely on the grounds that the deepfake image is not real.

The Constitutional Court recognizes that the right to protection of personal data is linked to human dignity and the free development of personality; and that the state has positive obligations to prevent unauthorized access, use, and disclosure of personal data. Failure to conduct effective and diligent investigations into serious allegations of personal data breaches may also constitute a violation of Article 20 of the Constitution.

The confidentiality of communication can also be violated

If a victim's private messages, emails, or voice calls are accessed for the purpose of identity impersonation, the crime of violating the confidentiality of communication under Article 132 of the Turkish Penal Code may be invoked.

Secretly listening to or recording a victim's private conversations falls under Article 133 of the Turkish Penal Code; the unlawful disclosure of the obtained conversations may also be considered within the scope of the relevant provisions of the same article. If a victim's private conversations are recorded for the purpose of creating a voice imitation using artificial intelligence, the manner in which the original recording was obtained may constitute a separate crime, regardless of the fabricated content produced.

What Happens When Identity Impersonation Is Used for Fraud?

One of the most common uses of artificial intelligence for identity impersonation is fraud. The perpetrator can impersonate the voice and image of a victim's relative, company executive, lawyer, bank employee, or public official, and request money to be sent.

For the crime of fraud to occur, there must be deceptive conduct, the victim must be deceived, the victim must dispose of their property, damage must be incurred, and a benefit must be obtained for the perpetrator or a third party.

When information systems, banks, public institutions, or specific professional titles are used as tools, the provisions of Article 158 of the Turkish Penal Code regarding aggravated fraud may come into play. The use of artificial intelligence alone is not an independent aggravating circumstance; however, the fact that the crime is committed through an information system and that a fake identity becomes the primary means of deception can strengthen the assessment of aggravated fraud.

For example, if a perpetrator impersonates the company owner's voice and instructs an accounting employee to make an urgent payment, the fake voice constitutes a tool of fraudulent conduct. Furthermore, the perpetrator may be held liable for data protection offenses if they have illegally obtained or disseminated the manager's voice and identity data.

Blackmail, Threats, and Insults

If a fake image or sound recording created with artificial intelligence is used to extort money or other benefits from the victim, the crime of blackmail may occur. The perpetrator's behavior, such as saying, "If you don't send the money, I will send this video to your family or employer," falls under Article 107 of the Turkish Penal Code.

Threatening to harm the victim or their relatives with false content constitutes a threat; while falsely attributing insulting words to the victim that they did not say, with the aim of humiliating them in the eyes of the public, constitutes the crime of defamation.

However, if the AI ​​content shows that the victim made statements that damage their own honor and dignity, careful consideration must be given to both the perpetrator and the victim of the defamation crime. It must be determined whether the creator of the content directly insulted the victim or whether they created a false narrative with the intention of humiliating the victim in the eyes of third parties. In such cases, violations of personal rights and personal data crimes are often more apparent.

Making Accusations with Artificial Intelligence: Defamation

Creating and submitting to the prosecutor's office, law enforcement, or authorized administrative authority false audio, video, message, or document that shows a person has committed a crime may constitute the crime of defamation as defined in Article 267 of the Turkish Penal Code.

The penalty is increased if the perpetrator fabricates material evidence and false accusations. Generating false records using artificial intelligence alleging that a person accepted bribes, sold drugs, made threats, or committed another crime falls under the category of "fabricating material evidence and false accusations.".

The difference between Article 268 and Article 267 of the Turkish Penal Code is important here:

• If the perpetrator uses the identity of another natural person to escape punishment for the crime he committed, Article 268 of the Turkish Penal Code applies
• If someone produces false content with the intention of initiating an investigation against a victim, even though they know the victim has not committed a crime, this falls under Article 267 of the Turkish Penal Code

It comes up on the agenda.

Fake Identity and Document Forgery

If forged identity cards, passports, diplomas, licenses, court decisions, or public institution documents are prepared using artificial intelligence, the crime of forgery of official documents, as defined in Article 204 of the Turkish Penal Code, may be committed.

Article 207 of the Turkish Penal Code (TCK) is applicable to forged contracts, private company letters, order forms, or other private documents. If the document is used for fraudulent purposes, it is possible to impose separate penalties for both forgery and fraud under Article 212 of the TCK.

If the document uses a person's photograph, signature, or identification number, the crime of unlawful use of personal data can also be discussed separately. However, whether the crimes uphold the same legal value and whether the acts are separable from each other should be evaluated within the framework of the provisions on concurrence of offenses.

How should an investigation be conducted under the Code of Criminal Procedure?

In cases of alleged identity impersonation using artificial intelligence, conducting an investigation solely based on screenshots of the fake account or image is insufficient.

According to Article 160 of the Code of Criminal Procedure, when the public prosecutor learns of a situation that gives the impression that a crime has been committed, he/she must begin investigating the material truth; he/she must collect and preserve evidence both in favor of and against the suspect.

The following evidence should be collected in particular during the investigation:

• The fake account's link and username,
• Account creation, login, and IP logs,
• The linked phone number and email address,
• The commands given to the artificial intelligence platform,
• Photos, audio files, and documents uploaded to the system,
• The initial and final versions of the content produced,
• The metadata and hash values ​​of the files,
• Application logs on the suspect's computer and phone,
• Cloud storage and backup data,
• The recipients of the content and messaging records,
• Payment and bank account transactions,
• Domain name and fake website registrations.

The goal is not simply to determine if the image is artificial. It is also necessary to identify who produced the content, from which device it was uploaded, from which account it was disseminated, and the perpetrator's motives.

Computer and Phone Review

Article 134 of the Code of Criminal Procedure allows for searching, copying, and decrypting the records of a suspect's computer, computer programs, and computer files, provided there are strong grounds for suspicion based on concrete evidence and if evidence cannot be obtained otherwise. In cases where delay would be detrimental, the prosecutor's decision is submitted to the judge for approval.

During the digital examination:

• A digital forensics image of the device should be created
• No direct changes should be made to the original data
• Hash values ​​must be calculated
• It should be recorded who received the evidence and when
• Deleted commands and files should be investigated
• The scope of the review should not exceed the limits of the decision.

In its decision dated February 12, 2026, numbered E.2023/128, the Constitutional Court examined certain parts of Article 134 of the Code of Criminal Procedure regarding the protection of private life and personal data, annulled them, and postponed the entry into force of the annulment for nine months from the date of its publication in the Official Gazette. Therefore, the current status of the decision and the transition period must also be taken into consideration in computer search and seizure procedures.

Communication Records and Platform Data

If identity impersonation is carried out via telephone, messaging application, or social media, communication and traffic records are important. The measures of interception, listening, and recording of communications stipulated in Article 135 of the Code of Criminal Procedure are subject to strong suspicion based on concrete evidence, the inability to obtain evidence by other means, and other conditions stipulated in the law. Whether the crime falls within the scope of the catalog of offenses subject to listening and recording measures should also be examined separately.

When data is requested from social media or AI companies located abroad, the data retention period of the service provider, the legislation of the relevant country, and international judicial assistance procedures become important. Therefore, in order to prevent the deletion of account records, requests for protection and preservation should be sent in the initial stages of the investigation.

How should an expert examination be conducted?

Analyzing AI-generated content may require more comprehensive expertise than a traditional IT report. Depending on the nature of the case, reports should be obtained from experts in digital forensics, image analysis, audio analysis, phonetics, facial comparison, and digital media.

At least the expert report should state:

1. Whether the examined file is original or not,
2. Hash and metadata information,
3. Re-encoding traces,
4. Whether there are cuts, additions, or merges,
5. The synchronization of time and motion between sound and image,
6. The harmony between lip movements and voice,
7. Consistency of facial features, light, shadow, and reflection
8. Technical findings pointing to artificial production,
9. The programs and methods used,
10. Margin of error and limitations of the review

It should be explained.

An automated result from another AI program stating "This content is 95% fake" should not be considered sufficient on its own. The reliability of the system used, its methodology, error rate, and how it is applied to the specific case should be verifiable.

Legality of the Evidence

According to Article 217 of the Code of Criminal Procedure, the alleged crime can only be proven with evidence obtained lawfully. The judge must base his decision on the evidence presented at the hearing and discussed in the presence of the parties.

It is generally considered different when a victim of identity theft gains access to a fake account on their own, takes a screenshot of publicly available content, or saves a message sent to them, compared to when the suspect gains unauthorized access to the account and obtains private correspondence.

If a victim illegally accesses another person's account to gather evidence, this can render the legality of the evidence used in the investigation questionable and may also lead to allegations of cybercrime against the victim.

Therefore, screenshots and screen recordings should be taken before content is deleted; however, unauthorized access to the suspect's account, device, or cloud system should be avoided. Obtaining technical data should only be done through prosecutor's and court orders.

Complaint Period and Investigation Conditions

In the section of the Turkish Penal Code regulating crimes against private life and the confidentiality of life, the investigation of crimes other than those involving the recording of personal data, the unlawful disclosure or acquisition of personal data, and the failure to destroy data is, as a rule, dependent on a complaint. Therefore, the complaint period should not be overlooked in crimes such as the violation of the privacy of private life.

In contrast, personal data crimes under Articles 135 and 136 of the Turkish Penal Code are not subject to complaint and can be investigated ex officio by the prosecutor's office.

If fraud, defamation, forgery of official documents, or personal data crimes are also committed during the identity impersonation, the investigation conditions must be evaluated separately for each crime. The victim's withdrawal of a complaint regarding one crime does not terminate the case with respect to other crimes investigated ex officio.

What claims can the victim make?

A person whose identity has been impersonated by artificial intelligence can pursue legal action in addition to filing a criminal complaint. Depending on the specifics of the case, the following claims may be made:

• Removal of the fake account and content,
• Preventing the re-publication of the content,
• Issuance of a precautionary measure order,
• Determining the illegality of the attack,
• Publication of the correction or court decision,
• Compensation for material damages,
• Moral compensation,
• The return of any profits the perpetrator obtained as a result of the attack,
• Deletion or destruction of personal data,
• Identifying the individuals to whom the data has been transferred.

Especially in cases where the fabricated image continues to spread, simply waiting for the outcome of the investigation may not be sufficient. Requesting temporary legal protection to prevent the dissemination of the content, along with a personal rights lawsuit, can prevent the victim from suffering further harm. Articles 24-25 of the Turkish Civil Code and Article 58 of the Turkish Code of Obligations form the basis for such protection and compensation claims.

Conclusion

Identity impersonation using artificial intelligence is not regulated as a separate and independent crime in the Turkish Penal Code. Article 268 of the Turkish Penal Code, titled "Use of another person's identity or identity information," applies only when the perpetrator uses the identity of another natural person to prevent investigation or prosecution against themselves for the crime they committed.

In other cases of identity impersonation, the nature of the specific act depends on the circumstances;

• Unlawful recording or dissemination of personal data,
• Violation of the right to privacy,
• Violation of the confidentiality of communication,
• Fraud,
• Blackmail or threats,
• Insult,
• Slander,
• Forgery of official or private documents,
• Cybercrimes

It may come up on the agenda.

From a criminal procedural standpoint, focusing solely on the forged image or account is insufficient. The commands given to the artificial intelligence, the uploaded files, device and IP records, account history, metadata, hash values, messages, and financial transactions must all be examined together.

The fact that identity impersonation does not constitute a specific crime under criminal law does not render the act lawful. A person's name, face, voice, honor, reputation, and private life are part of their right to personality. The reproduction of these elements through artificial intelligence and their use without the person's consent may constitute grounds for prevention, cessation, detection, deletion, and compensation claims.

In the age of artificial intelligence, protecting the right to privacy no longer simply means keeping a person's real images private. The legal system must now attributing statements to a person they never made, falsely portraying them as having committed acts they never committed, and recreating their digital identity against their will .