Hong Kong Residents Fight Stolen Identity Photos Spreading Online

A secondary school teacher from Quarry Bay noticed something wrong in March when a colleague flagged a dating profile carrying her photograph. The profile was not hers. Within a week, she had found three more accounts on separate platforms using the same headshot she had posted to her Instagram page in 2024. She is one of a growing number of Hong Kong residents discovering that their photos have been lifted, duplicated, and deployed by strangers, sometimes for fraud, sometimes for harassment, sometimes for reasons that remain entirely unclear.

The pattern has sharpened in 2026 for reasons that overlap with broader anxieties in the city. Generative AI tools capable of producing convincing synthetic variations of a real person's photograph have become cheap and widely accessible. At the same time, the Office of the Privacy Commissioner for Personal Data (PCPD) has been handling a rising volume of complaints related to doxxing and unauthorised use of personal images since the expanded provisions under the Personal Data (Privacy) Ordinance came into force following 2021 amendments. The combination has left many residents feeling exposed in ways the existing framework was not fully designed to address.

What residents are actually experiencing

Community members contacted through mutual aid groups in Sham Shui Po and Taikoo Shing described a recognisable sequence of events: a friend or family member spots the duplicate image, the victim files a report with the PCPD and separately contacts the platform, and then waits. Platforms with no local office in Hong Kong, many of the relevant ones are based in the United States or mainland China, respond inconsistently and sometimes not at all. One man from To Kwa Wan said he submitted takedown requests to two platforms in January and had received no confirmation of removal by late June.

The PCPD received 3,892 complaints in the financial year ending March 2025, according to its annual report published that year, a figure that represented a significant increase over prior years. The office does not publish a granular breakdown by complaint type in real time, so the specific share attributable to image duplication is not publicly available. Advocates at Privacy Concerns HK, a community group that operates out of a shared office on Portland Street in Mong Kok, say image-related complaints have become among the most common enquiries they field on their weekly drop-in sessions.

Affected residents describe the psychological toll as distinct from other forms of online abuse. Unlike a text-based attack, a photograph carries an immediate and visceral sense of identity theft. Several people described checking reverse-image search results repeatedly over days, a process that privacy advocates say can itself become compulsive and distressing. One woman from Tai Po said she had removed almost every photograph from her social media accounts and felt the decision was forced on her rather than chosen.

What the law offers, and where it stops

Under the Personal Data (Privacy) Ordinance as it currently stands, the unauthorised collection and use of a person's image can constitute a breach where the image qualifies as personal data. The PCPD has enforcement powers including issuing enforcement notices and referring cases to the Department of Justice. However, criminal prosecution under the doxxing provisions, introduced via the 2021 amendments, requires proof of intent to cause harm, a threshold that complicates cases where the motive behind image duplication is unclear or commercial rather than targeted.

The Hong Kong Bar Association and several legal commentators have noted publicly in recent years that civil remedies for image misuse remain underdeveloped compared with jurisdictions such as the United Kingdom, where the Data Protection Act 2018 and evolving case law around misuse of private information provide more direct routes to compensation. Residents seeking private legal action in Hong Kong typically face costs at the District Court that make individual cases economically unviable for most people.

Privacy advocates recommend that residents file with the PCPD promptly, the office's online complaint portal accepts submissions in both Chinese and English, and simultaneously submit platform reports using the specific language of copyright or identity fraud rather than general harassment, which tends to trigger faster internal review processes. Keeping dated screenshots of every instance of a duplicated image, advocates say, is essential groundwork if a case eventually escalates to formal investigation or litigation.