Deepfaked Teachers. When The Law Can't Help, Schools Must.

What schools, parents and educators need to understand about deepfakes, digital abuse, and the gap where real harm lives.

Before you start reading this please know the information in this post is provided as general guidance only and does not constitute legal advice. Every situation is different, and the legal frameworks governing work health and safety obligations vary across Australian jurisdictions. If you are a school leader, diocesan officer, or department representative navigating a specific incident or seeking to understand your organisation's compliance obligations, please seek advice from a qualified workplace health and safety lawyer or your relevant regulatory authority.

Seven emails in two months. Six schools across Australia, and one Police command, landing in my inbox because they had exhausted every official channel available to them reported, waited, followed up, waited again and the content was still there. Still circulating. Still doing its damage.

The situations vary in their details but share the same shape. A teacher discovers that a video of them, manipulated beyond recognition, is circulating in a group chat before they have even arrived at school. A student has posted something that is not quite defamatory enough to trigger legal action, but is specific enough, and sustained enough, and visible enough to the exact community the teacher works in every day, that walking through the front gate the next morning requires a particular kind of courage that nobody trained for the job expecting to need.

A school leader finds themselves with a staff member in crisis, a parent community in uproar, no clear pathway forward no policy or procedure to follow that fits.

After the description of what has happened, the description of how they were told it is not considered "serious and harmful" the comments are always the same. Surely the law covers this. Surely something can be done.

It can. Sometimes. And understanding precisely when, and what to do when the answer is not the one you needed, is the difference between a school that protects its people and one that leaves them to find out alone what the system cannot do.

Australia's Online Safety Act 2021 is genuinely important legislation, and the eSafety Commissioner's office does serious, meaningful work. The Act gives the Commissioner real powers to pursue the most harmful forms of online abuse, and those powers have been used. But the law is built around a specific threshold, and that threshold matters enormously when you are the teacher sitting in your car in the school car park, unable to go inside.

For the Commissioner to intervene in an adult cyber-abuse matter, the content must be menacing, harassing or offensive, and it must be intended to cause serious harm. Serious harm means severe psychological distress, significant reputational damage, real impacts on safety or employment or wellbeing. The bar is set deliberately high, because regulatory powers concentrated in a single national office cannot and should not be deployed for every act of online unkindness in the country. The system is designed to catch the worst. It is not designed to catch everything.

Which means there is a category of harm that is real, that is documented, that is devastating to the individual experiencing it, and that currently falls through the floor.

This is not a fault of the eSafety Commissioner's office, and it is important that is clearly understood.

The team at eSafety are working at the intersection of rapidly evolving technology, complex legal frameworks, and an almost incomprehensible volume of reported harm. They are doing serious, skilled work within the powers the law gives them, and those powers are genuinely significant where the legal threshold is met. The Commissioner has been a consistent and courageous voice for stronger protections, and the office has pushed platforms to act in cases where those platforms would otherwise have done nothing. None of what follows is a criticism of the people doing that work.What it is, is an honest description of a structural gap. The distance between what the law currently covers and what harm currently looks like on the ground in Australian schools and beyond. That gap is not the eSafety Commissioner's failure to fill. It is a policy and resourcing challenge that sits with government, with platforms, and significantly, with schools themselves. The Commissioner cannot legislate beyond the Act. They cannot compel platforms beyond their existing powers. And they cannot be present in every staffroom where a teacher is sitting with their phone, looking at something that has been done to them, trying to work out whether what they are feeling constitutes serious enough harm to be worth reporting.

That last part, the uncertainty, the self-doubt, the sense that perhaps this does not rise to the level where anyone official will care is itself a harm worth naming. Report anyway. Every time. Not because the outcome is guaranteed, but because the record matters, the data matters, and every report that goes through the eSafety system contributes to the evidence base that makes the case for stronger powers and better-resourced responses. The Commissioner needs to know the full scale of what is happening in schools. Your report, even if it does not result in immediate action, is part of how they make that case. A deepfake of a teacher circulating within one year level rather than the wider public. A post that humiliates without quite threatening. A coordinated campaign that undermines authority and erodes safety without ever crossing into territory that a regulator can formally act on. These situations are not edge cases. They are happening every week, in ordinary schools, to ordinary people who came to work because they believed in children and in teaching, and who are now managing a form of harm that did not exist when they trained.

Deepfakes in particular represent something that policy and some laws have not yet fully caught up with, because the technology arrived faster than the frameworks designed to govern it. Where content is sexualised, existing image-based abuse provisions may provide a pathway. Where it is not, where it is simply a teacher's face attached to something ridiculous or humiliating or professionally destructive, current thresholds may offer no formal remedy at all. This is not a criticism of the eSafety Commissioner. It is an honest description of where the legal architecture currently stands, and why waiting for the law to solve this problem is a strategy that will fail the people who need help today.

If you are a teacher who has been targeted, or a school leader watching this happen to someone on your staff, here is what actually needs to happen, in order.

Preserve everything before you do anything else. Screenshots, links, usernames, timestamps, the names of the platforms involved and the approximate number of people who have seen it. Evidence disappears. Take it while you can.

Report to the platform using their in-app tools. This is not satisfying and it is often slow, but platform removal is currently the fastest practical remedy available, and a formal record of your report matters if you need to escalate. Take screenshots of your report.

Lodge a complaint with eSafety regardless of whether you believe the threshold will be met. The process itself provides guidance, creates a formal record, and in cases involving image-based abuse, the Commissioner has strong powers to act. Even where formal action is not possible, the eSafety office can support you in understanding your options. Their website is esafety.gov.au

Tell your school leadership immediately and in writing. Not because they will necessarily know what to do, but because you need a record that they were informed, and because what happens next is substantially their responsibility.

Do not navigate this alone. The psychological impact of having your image or your identity weaponised against you by people in your care is not something that resolves by ignoring it. Access whatever wellbeing or counselling support your employer provides, and if that support is inadequate, say so clearly and in writing.

Depending on the severity of what has occurred, contact police and seek legal advice. Serious harassment, threats, and some forms of image-based abuse have criminal dimensions, and a conversation with a lawyer costs less than most people assume.

But here is the harder truth, and it is aimed directly at school leaders. The law sets a floor. Schools are responsible for everything above it. Duty of care, child-safe standards, workplace health and safety obligations around psychosocial risk all of these create a clear and enforceable expectation that schools will treat digital abuse of staff as a serious incident, respond to it immediately and substantively, and build the kind of culture in which it is less likely to occur in the first place. The workplace health and safety dimension of this is more enforceable than most school leaders realise, and ISO 45003 the international standard for managing psychological health and safety at work makes the framework explicit.

ISO 45003 identifies the psychological hazards that employers are required to identify, assess, and control, and the list is not abstract. Harassment, including online harassment. Exposure to traumatic content. Threats to professional identity. Situations that create fear, humiliation, or a sustained sense of being unsafe in the workplace. A teacher who has been targeted by a deepfake, or by a coordinated campaign of online abuse, is experiencing a psychosocial hazard in their workplace, and their employer has a duty under work health and safety law to manage that hazard with the same seriousness they would apply to a physical safety risk. In most Australian jurisdictions this obligation is enforceable, and Safe Work Australia's guidance on psychological safety at work aligns directly with the ISO 45003 framework. This means that a school's response to digital abuse of staff is not simply a pastoral matter or a question of good leadership culture. It is a compliance obligation. Ignoring it, minimising it, or managing it inadequately carries legal risk for the employer, not just human cost for the employee. Document your response. Record what support was offered and when. Treat it as the workplace injury it is, because under the law, that is exactly what it is.

The obligation sits primarily with the PCBU — the Person Conducting a Business or Undertaking. For a government school that is the relevant Department of Education. For a Catholic school it is the Diocese. For an independent school it is the school's governing body or company. The principal can also be individually liable as an officer of the PCBU if they failed to exercise due diligence meaning they knew or should have known about the psychosocial hazard and failed to act on it. Given how frequently staff are now being targeted by students online, and how widely that targeting is discussed in the media, professional learning, on parent forums, and across school communities, the argument that a principal did not know is becoming increasingly difficult to sustain.

There is another part of this that some schools have not yet fully considered, and it will matter enormously as deepfake incidents increase. Many schools publish photographs of their staff and specilist speakers and other guests on public websites, in newsletters, on social media accounts, and in community communications often without explicit consent and almost never with any consideration of how that image might be used by someone with malicious intent. When a publicly available photograph is used to generate a deepfake, the question of where that image came from is not incidental in these cases. The school published it, therefore the school may have materially contributed to the harm. This sits at the intersection of privacy law, the school's duty of care to its staff and anyone onsite, and the workplace health and safety obligations already described. Schools should urgently audit what images are publicly accessible through their own channels, establish a clear consent process for any publication of staff or visitor photographs, and consider whether images currently published should be removed. A staff member's face is not school property publishing it freely and without restriction — is a practice that the deepfake era has made genuinely dangerous, and that no school communications policy seems to be adequately addressing. There are ways to continue to publish safely, your team need to be trained on how to do it and staff and visitors must give informed consent.

The full and current penalty table is published by Safe Work Australia here: https://www.safeworkaustralia.gov.au/law-and-regulation/legislation/maximum-monetary-penalties-under-whs-laws

From 1 December 2025, every Australian jurisdiction now requires employers to explicitly identify, assess, and control psychosocial hazards meaning there is no longer any jurisdiction in which a school can argue this framework does not apply to them.

If a teacher is targeted by a deepfake or sustained online abuse campaign, experiences psychological harm as a result, and the school failed to have an up to date policy, failed to respond adequately, or failed to document its response the employing body is exposed. Not theoretically. Enforcably. A deepfake of a teacher is not a prank. Describing it as one, or allowing students to describe it as one, is a leadership failure with consequences that extend far beyond the individual targeted.

What schools need to do is not complicated, but it requires the willingness to treat this as the genuine emergency it is.

Policies on acceptable use need to explicitly name deepfakes and synthetic media and the risks. Consequences for creating or distributing them need to be clear, proportionate, and consistently applied. Staff who are targeted need immediate support, not a meeting scheduled for the following week. And students need genuine education about what harm, consent, and digital responsibility actually mean not a thirty-minute assembly, but sustained, age-appropriate, embedded understanding of why what they do online to other people is real, and has real consequences for real human beings.

The Online Safety Act matters. The eSafety Commissioner matters. Report to them, use them, and advocate loudly for the legal frameworks around deepfakes to be strengthened, because they need to be. And while you are doing that, do not wait for the law to build the culture your school needs right now. The law addresses the most serious harms at a national scale. Culture is built one classroom, one staffroom, one conversation at a time. Nobody is coming to do that for you.

Your teachers are watching how you respond when one of them is targeted. So are your students and their parents. What happens next tells them everything they need to know about whether your school is genuinely safe, or whether it is safe only in the places the regulator can see.

If your school is navigating these challenges and needs clear, practical policy guidance on digital behaviour, deepfakes, emerging technologies and staff protection, please contact us at hello@ctrlshft.global