Unauthorized Sharing of Private Photos and Videos on Social Media

Entrance

Social media is one of the fastest platforms for the dissemination of images related to people's private lives. On platforms like Instagram, X, TikTok, Facebook, YouTube, WhatsApp, Telegram, and others, sharing a photo, video, screenshot, or private message can reach a wide audience within seconds. Therefore, the unauthorized sharing of private photos and videos is not only a "violation of privacy" but also a serious legal issue that must be considered from the perspectives of criminal law, personal data protection law, private law, compensation law, and information technology law.

Private photographs or videos may relate to a person's privacy, personal life, body, family life, sexual life, health status, domestic life, or personal space intended to be shared only with a limited number of people. Unauthorized sharing of such content on social media can directly affect the victim's honor, dignity, psychological integrity, family relationships, professional reputation, and social circle.

In practice, these kinds of incidents manifest in different ways. An ex-lover or ex-spouse might share private photos sent to them during the relationship. The perpetrator might blackmail the victim into sending money or continuing the relationship. Photos of the victim might be used from a fake account. Private images might be disseminated in WhatsApp or Telegram groups. Secretly filmed videos might be shared on social media. Sometimes, a person might have sent a photo only to a specific person, but that image is then shared with third parties.

The basic rule in these cases is clear: the fact that a photo or video has been previously sent to someone does not mean that consent has been given for that content to be shared on social media or with third parties. Consent is limited to a specific purpose and scope. A person may have sent a private image to someone; however, if that image has not been published on Instagram, a Telegram channel, a WhatsApp group, a TikTok video, or any other platform, the sharing may be unlawful.

What are private photos and videos?

Private photos and videos are visual or auditory content relating to a person's private life. This content does not necessarily have to contain nudity or sexual content. Images of a person at home, hospital images, videos related to family life, images of a private relationship, screenshots of intimate messages, photographs showing their health status, secretly recorded audio and video recordings, private messaging recordings, or personal photographs shared with a limited circle may be considered within the scope of private life depending on the specific circumstances.

The determining factors here are where the image was taken, the purpose for which it was created, with whom it is intended to be shared, the degree of privacy of the content, the victim's consent, the scope of the sharing, and its impact on the victim. For example, a simple profile picture published on a public social media account is not subject to the same legal evaluation as a private photo sent only via private message. However, even a publicly visible photo can constitute a personal data breach and an attack on the right to privacy if used by another person on a fake account in a derogatory context or with sexually suggestive captions.

The private photo or video doesn't necessarily have to have been taken by the victim. The perpetrator may have secretly recorded it. The image could have been obtained through a security camera, phone camera, car camera, video call recording, screen recording, or hidden camera. If there is a secret recording or unauthorized filming, even if it is not shared, the violation of privacy and personal data crime can be discussed. If it has been shared, the liability becomes even more severe.

Is Unauthorized Sharing a Crime?

Sharing private photos and videos without permission on social media can often constitute a crime. The most basic type of crime the violation of privacy . According to Article 134, a person who violates the privacy of another person is punishable by imprisonment for one to three years; if the violation is committed by recording images or sounds, the penalty is increased by one-fold. The second paragraph of the same article stipulates that a person who unlawfully discloses images or sounds relating to the private life of another person shall be punished by imprisonment for two to five years.

Therefore, sharing a photograph or video related to private life on Instagram, X, TikTok, Facebook, YouTube, WhatsApp, Telegram, or any other digital platform may be considered "disclosure" under Article 134/2 of the Turkish Penal Code. For disclosure, the image does not necessarily have to reach millions of people. Sending a private image to a person, sharing it in a closed group, posting it in a Telegram channel, spreading it in a WhatsApp group, or sharing it in a social media story may also constitute disclosure, depending on the specific circumstances.

Even if the shared photo or video is not of a nature that falls under the scope of private life, the photograph may still be considered personal data, and Article 136 of the Turkish Penal Code may come into play. According to Article 136 of the Turkish Penal Code, a person who unlawfully gives, disseminates, or obtains personal data of another person shall be punished with imprisonment from two to four years. Therefore, even a photograph taken in everyday clothing, if used without the victim's consent on a fake account, in a post containing insulting content, or in a sexually suggestive context, may constitute a personal data crime and a violation of the right to privacy.

Violation of the Right to Privacy under Article 134 of the Turkish Penal Code

Article 134 of the Turkish Penal Code is the most important penal norm in cases involving the sharing of private images on social media. This article regulates two fundamental situations. Firstly, the violation of the right to privacy. Secondly, the unlawful disclosure of images or sounds relating to private life.

For example, secretly filming someone in their home, screen-recording a video call, recording private intimate moments, obtaining intimate photographs, or unauthorized recording of hospital/treatment images may initially constitute a violation of privacy. If these images are disseminated through social media platforms, messaging groups, or by sending them to third parties, the crime of disclosure will be considered separately.

The concept of "private life" is broad here. Images related to a person's sexual life are one of the most obvious examples; however, private life is not limited to sexual content. Family life, health status, images from home, private relationships, psychological state, private correspondence, and images that a person wishes to share only with a small circle can also be considered within the scope of private life.

Sharing such content, particularly by ex-spouses or ex-partners, is common in practice. Sharing an image that was consented to be sent during a relationship, after the relationship has ended, for the purpose of revenge, pressure, threat, humiliation, or blackmail, clearly creates legal liability. Consent is limited to the person to whom the image is sent and the purpose; disseminating the image to third parties also requires consent.

Unlawful Dissemination of Personal Data within the Scope of Article 136 of the Turkish Penal Code

Not every photograph or video may be considered a private image within the meaning of Article 134 of the Turkish Penal Code. However, this does not mean that sharing them is lawful. Photographs and videos may constitute personal data that identifies the individual. A person's face, body, voice, social media account, location, vehicle license plate, workplace, family members, or other distinguishing features may be considered personal data.

Article 136 of the Turkish Penal Code punishes the unlawful disclosure, dissemination, or acquisition of personal data. The basic penalty for this crime is imprisonment for two to four years. Therefore, using a person's photograph in a fake account, making fun of their photograph, sharing it along with their address or phone number, and disseminating non-private but targeting images of the individual can be examined under Article 136 of the Turkish Penal Code.

For example, if a victim's everyday photograph is shared with captions such as "talk to this person," "this person is immoral," or "find this person," it can constitute a breach of personal data, defamation, threat, or targeting. The fact that the photograph was previously shared on the victim's own account does not always guarantee legality. Sharing a photograph on one's own account does not give someone else the right to take that photograph and distribute it for different purposes.

Blackmail, Threats, and Stalking Aspects

In cases of unauthorized sharing of private photos and videos, the perpetrator often goes beyond simply sharing; they also use the images as a threat to pressure the victim. Statements such as, "I'll share them if you don't send money," "I'll send them to your family if you don't meet with me," "I'll spread the video if you complain," or "I'll create an account and send it to everyone," can constitute blackmail and threats.

According to Article 106 of the Turkish Penal Code, a person who threatens another person with an attack on their life, bodily integrity, or sexual inviolability, or that of a close relative, shall be punished; in cases of threats of significant financial loss or other harm, sanctions are applied only upon complaint. Threats to disseminate private photographs or videos can be considered as threats or blackmail, depending on the specific circumstances of the case, as they place significant pressure on the victim's social, family, and professional life.

In blackmail cases, negotiating with the perpetrator, sending money, or sending new images usually doesn't solve the problem. The perpetrator often exploits the victim's fear to demand more payment, more images, or more compliance. Therefore, a blackmail victim should quickly report the incident to the prosecutor's office, preserving all evidence; they must fully document messages, usernames, phone numbers, IBAN or cryptocurrency wallet addresses, payment requests, and threatening content.

Sharing a Photograph That Was Sent with Consent

One of the most common defenses in practice is: "He/She sent me the photo." This defense alone does not make unauthorized sharing legally permissible. Because a photo or video sent privately to a specific person is shared only with that person and within that specific communication context. Sending this content to third parties, uploading it to social media, or spreading it in closed groups is a separate offense.

Consent is not general and unlimited. A person may send an image to their significant other; this does not mean that image can be sent to their significant other's friends, family members, social media followers, or Telegram group. A person may participate in a video call; this does not mean they consent to the call being screen-recorded and shared. A person may share a photo with a limited number of followers; this does not mean they allow that photo to be used on a fake account.

Therefore, in cases involving the unauthorized sharing of private images, a distinction must be made between "initial transmission was consented" and "subsequent dissemination was consented." What is crucial for criminal and civil liability is whether or not there was consent to the disclosure or dissemination.

Secretly Taken Photos and Videos

Secretly taken photos and videos can create legal problems even if they are not shared. Recording someone secretly in their home, hotel room, changing room, during a private meeting, video call, while receiving healthcare, or in a private area can constitute a violation of the right to privacy. Article 134 of the Turkish Penal Code explicitly stipulates that the penalty will be increased if the violation of privacy is committed by recording images or sounds.

The severity of the crime increases if the secretly recorded footage is subsequently shared. For example, publishing hidden camera footage on social media, posting a video call recording to a WhatsApp group, or sharing a private audio/video recording on a Telegram channel should be evaluated in terms of both the act of recording and the act of disclosing the footage.

In cases of covert recording, evidence gathering must be conducted carefully. The victim should record their screen when they see a shared or recorded video, save the links, document the account that shared the video, and record all clues that identify the perpetrator. Even if the video is deleted, an investigation can proceed if it can be proven that the recording existed previously.

Sharing on WhatsApp and Telegram Groups

Private photos or videos don't have to be shared only on public social media. Sharing them in WhatsApp or Telegram groups can also lead to legal liability. In fact, private images often spread first in closed groups before being transferred to other platforms.

Sharing an image in a closed group does not make the sharing legal. Disclosure doesn't only mean sharing something publicly with millions of people. Sending a private image to third parties without the victim's consent can also be considered disclosure. Telegram channels, closed groups, WhatsApp friend groups, Discord servers, or private message chains are all important examples in this context.

In such cases, the group name, group link, number of participants, message date, the person who shared the content, who received the image, and screenshots are important. If the victim cannot directly access the group, a screenshot or testimony can be obtained from the person who sent the content. However, illegal methods should not be used when gathering evidence; unauthorized access to someone else's phone or account should be avoided.

Sharing Private Images Through a Fake Account

In some cases, the perpetrator creates a fake account instead of using their own. The account is created using the victim's name, photo, username, or personal information, and private images are shared on this account. In such a situation, violations of privacy, unlawful dissemination of personal data, defamation, slander, blackmail, and sometimes fraud may all come into play.

In fake account cases, the most important issue is identifying the perpetrator. The victim must document the account's URL, username, profile picture, biography, posts, stories, follower/following list, and messages. A request should be sent to the prosecutor's office to obtain the account creation date, login IP log records, associated email and phone information, device/session logs, and user activity data.

The perpetrator may have used a VPN or fake email. However, this does not mean that the investigation is impossible. The perpetrator can be identified by considering the phone number associated with the account, the language used, previous conflicts with the victim, individuals who may have access to private images, monetary demands, IBAN or cryptocurrency wallet addresses, examination of the suspect's device, and witness statements.

What should a victim do immediately?

When a person's private photos or videos are shared without their permission, their first reaction is usually to panic and try to have the content removed immediately. Removing the content is certainly important; however, removing it without gathering evidence can create problems of proof in criminal investigations and compensation lawsuits. Therefore, the first step is to gather evidence.

The victim should first take a screenshot of the post and, if possible, a screen recording. The screenshot should show the username, profile link, posting date and time, URL, comments, likes, image content, and the platform on which the post was made. Screen recording is especially important for content that can be quickly deleted, such as Instagram stories, TikTok videos, or Telegram messages.

Secondly, the profile of the account that made the post should be saved. The username, profile picture, biography, follower/following information, phone number (if any), linked accounts, and previous posts should be documented. Thirdly, if the perpetrator has made threats or blackmail, all messages should be saved. If money is requested, the IBAN, cryptocurrency wallet address, payment link, and receipts should be preserved.

Fourthly, a request to remove content from the platform can be made. However, this request should be made after evidence has been collected, if possible. Fifthly, a criminal complaint should be filed with the Public Prosecutor's Office; the specific crimes should be stated according to the concrete circumstances, such as violation of privacy, personal data crime, threat, blackmail, defamation, or other offenses.

Content Removal and Application under Article 9/A of Law No. 5651

In cases of unauthorized sharing of private photos and videos, the most immediate legal avenue is the removal of the content or the blocking of access to it. Regarding content that violates the privacy of private life, Article 9/A of Law No. 5651 is important. According to this article, individuals claiming that their privacy has been violated can directly apply to the Authority to request the implementation of a measure to block access to the content. The application must include the full URL of the publication causing the violation, a description of how the violation occurred, and information to prove the applicant's identity.

The most important aspect of the application under Article 9/A of Law No. 5651 is the swift response. Upon this application, access providers are obliged to comply with the request for an interim measure immediately and within a maximum of four hours. However, the applicant must submit the request to block access to a magistrate within twenty-four hours of making the request; if the magistrate does not make a decision within forty-eight hours, the measure is automatically lifted.

Therefore, time is of the essence in cases of private image disclosure. If the content is being disseminated to different accounts, each URL must be identified individually, and platform applications and the process under Article 9/A of Law No. 5651 must be carried out simultaneously. However, it should be remembered that access restrictions only limit access from Türkiye; for the content to be completely removed from the platform, a platform application and, if necessary, foreign platform legal procedures must also be used.

How should a criminal complaint be filed with the prosecutor's office?

In cases of unauthorized sharing of private photos and videos, the criminal complaint should be prepared in detail. The complaint should clearly state the date of the incident, how the image was obtained, where it was shared, the account that shared it, whether the victim consented to the image, whether the perpetrator made threats or blackmail, and the damage suffered by the victim.

The petition should include screenshots, screen recordings, URL links, usernames, profile information, messages, payment requests, witness information, and any previous threats. If the perpetrator is unknown, the petition should request IP log records, account creation information, associated email and phone number, device information, and session logs from the relevant platform.

If the content was shared in a WhatsApp or Telegram group, the group name, the person who shared it, the date of the message, and participant information should be included in the complaint. If the perpetrator used the images to solicit money, an investigation of bank and payment records, blocking of the recipient's account, and identification of suspicious accounts should be requested.

A criminal complaint should not simply cite Article 134 of the Turkish Penal Code. Depending on the specific circumstances, Article 136 of the Turkish Penal Code, concerning threats, blackmail, defamation, unauthorized access to information systems, account hijacking, fraud, or personal data offenses, should also be considered. Correct legal classification is crucial for the effective conduct of the investigation.

How should evidence be collected?

Gathering evidence is crucial in these types of cases because social media content can be deleted very quickly. The perpetrator might close their account, change their username, remove a story, or transfer images to other accounts. Therefore, the victim must gather all legally permissible evidence technically possible as soon as they see the content.

When taking a screenshot, not only the content but also the context should be visible. The username, URL, date, time, post text, comments, and platform information should all be displayed. Going to the content from the profile page while taking the screenshot better shows the link to the account and the post. If the content is on a website, the full URL of the page should be saved.

Notarized verification can increase the evidentiary value in some cases. However, since content can be quickly deleted, the victim should first record their own screen to avoid loss of evidence while waiting for the notarized verification. A forensic IT expert's report becomes particularly important in cases involving allegations of manipulation, defenses against forged screenshots, account ownership, or device examination.

Illegal methods should not be used when gathering evidence. Accessing the perpetrator's account, cracking passwords, secretly checking their phone, using spyware, or stealing data from a private account may create an additional risk of criminal activity for the victim. The victim should only document content accessible to them and messages sent to them.

Can a claim for moral damages be filed?

Unauthorized sharing of private photos and videos can constitute a serious violation of personal rights. Therefore, the victim can file a criminal complaint as well as a claim for moral damages. According to Article 24 of the Turkish Civil Code, a person whose personal rights have been unlawfully violated may request protection from the court; Article 25 regulates the prevention and cessation of the violation, the determination of the unlawfulness, correction, publication of the decision, and claims for material and moral damages.

Sharing private images can cause severe psychological harm to the victim, social humiliation, deterioration of family relationships, damage to career, loss of professional reputation, and safety concerns. Therefore, a claim for moral damages becomes a strong possibility. If the sharing results in job loss, customer loss, medical expenses, relocation, security measures, economic damage, or other tangible material loss, material damages can also be claimed.

When determining the amount of compensation, factors such as the nature of the image, the scope of the sharing, the perpetrator's intent, how long the image remained online, the number of people it reached, the emotional distress suffered by the victim, whether the perpetrator apologized or made a correction, whether the images continued to be disseminated, and the victim's social/professional status are considered. The disclosure of private images often causes more severe emotional distress than a simple defamatory post.

Does deleting a post eliminate responsibility?

The fact that the perpetrator later deletes the shared content does not automatically erase the previously committed crime or violation of personal rights. Once a private image is shared, the victim's privacy may have been violated. The shared content may have been seen, saved, reshared, or moved to different platforms by others. Therefore, deletion does not completely eliminate responsibility; however, it may be taken into account in terms of mitigating harm, showing remorse, or determining the amount of compensation.

Therefore, the victim must obtain evidence before the post is deleted. The perpetrator's statement, "I already deleted it," does not mean the incident never happened. The existence of the post can be proven through screenshots, screen recordings, witness testimonies, platform records, log records, and a prosecutor's investigation.

Images of Minors

The situation is much more serious when private photos and videos belong to minors. Sharing, storing, disseminating, or requesting intimate images of children can have serious criminal consequences. In such cases, not only the right to privacy but also child sexual abuse, obscenity, personal data crimes, and protective measures may come into play.

When child victims are involved, swift action is necessary. The content must be immediately documented, an urgent removal request must be submitted to the platform, a criminal complaint must be filed with the prosecutor's office, and if necessary, the Ministry of Family and Social Services and law enforcement agencies must be involved. Continued sharing of such content can cause very serious and lasting harm to the victimized child.

Data Breach and GDPR Aspects

If private photos and videos are shared illegally by a company, school, hospital, clinic, employer, photographer, event organizer, or digital platform, the issue of GDPR violations may arise. Photos and videos are considered personal data; however, if the images in question relate to health, sexual life, biometrics, or privacy, the issue of special categories of data may also be raised.

The institution acting as the data controller is obligated to take the necessary technical and administrative measures to prevent the unlawful processing and access of personal data. If personal data has been obtained by others through unlawful means, the data controller must notify the data subject and the Board as soon as possible; according to the Board's decision no. 2019/10, "as soon as possible" for notification to the Board is interpreted as 72 hours.

For example, a clinic sharing a patient's before-and-after photos without permission, a school publishing a student's images without consent, an employer sharing an employee's private images within a group, or a photographer using private photos in advertising without permission can all lead to liability under criminal law, the Turkish Personal Data Protection Law, and civil liability.

How to Evaluate the Offender's Defenses?

In these cases, the perpetrator often offers defenses such as "she consented," "she sent it to me herself," "my account was hacked," "I didn't share it," "I was joking," "everyone saw it anyway," "I only sent it to one person," or "I deleted it immediately." These defenses are evaluated along with concrete evidence.

The defense that "they sent it to me themselves" does not legally justify the act of disseminating it to third parties or sharing it on social media. The defense that "I only sent it to one person" is also not always valid; even sending a private image to one person without the victim's consent can constitute disclosure. The defense that "my account was hacked" must be investigated using platform security records, IP log records, device analysis, password change notifications, and other evidence.

In criminal proceedings, conclusive and convincing evidence is required for conviction. Therefore, the victim must gather strong evidence, and the suspect must support their defense with technical data. Especially in cases involving fake accounts and anonymously shared files, IP log records, device analysis, message language, previous conflicts, access to images, and monetary demands should all be considered together.

Conclusion

Sharing private photos and videos without permission on social media is a serious violation under Turkish law, carrying significant criminal and legal consequences. In most cases, such actions may constitute a violation of the right to privacy and the disclosure of private images under Article 134 of the Turkish Penal Code. Even if the image itself is not considered a violation of privacy, the photograph or video may still be considered personal data, and therefore the crime of unlawful dissemination of personal data under Article 136 of the Turkish Penal Code may arise.

The most important step for the victim is to preserve evidence without panicking. Screenshots, screen recordings, URLs, usernames, profile links, messages, threatening and blackmailing content, payment requests, and witness information should be saved. Then, a request should be made to the platform to remove the content, and if there is a violation of privacy, the rapid access blocking mechanism under Article 9/A of Law 5651 should be considered, and a detailed criminal complaint should be filed with the Public Prosecutor's Office. Article 9/A of Law 5651 provides a direct application to the Authority and a rapid access blocking mechanism for publications that violate the privacy of private life.

In addition, the victim may claim material and moral damages for the violation of their personal rights. Articles 24 and 25 of the Turkish Civil Code allow for the prevention or cessation of the attack, the determination of the illegality, correction, publication of the decision, and claims for compensation in cases of attacks on personal rights.

In conclusion, the unauthorized sharing of private photos or videos should not be viewed as a simple "social media quarrel" or "personal dispute." This action can directly affect the victim's privacy, psychological integrity, social environment, family relationships, and professional reputation. Therefore, the process should be conducted swiftly, based on evidence, and professionally; content removal, access restrictions, criminal complaints, identification of the perpetrator, and compensation claims should all be considered together.