Who is the man behind the notorious MrDeepFakes archive?

After the Internet’s biggest deepfake porn site shut down permanently, many are wondering who might be the key figure behind the MrDeepFakes archive, and some clues point to a Canadian pharmacist leading a double life.

Indeed, the MrDeepFakes archive has been effectively taken down, but there have been no details surrounding the mysterious person behind the world’s most notorious deepfake porn site until investigative media platforms CBC, Bellingcat, Politiken, and Tjekdet carried out their investigation.

Meet David Do, the operator of the MrDeepFakes archive

What they discovered was shocking. As it turns out, the orchestrator of the MrDeepFakes archives was David Do, an unassuming Canadian guy living just outside Toronto with his partner, driving a Tesla, and working as a hospital pharmacist – before losing his job in the wake of the report.

As it happens, Do’s name never appeared anywhere on the website, but the investigators pieced it together using data from the web, public records, and forensic analysis of the site, which led them to his door. They found out that he had a central role in running MrDeepFakes.

Not only that, but he had a long online history of discussing the details of running a popular adult website that turns a profit.

When confronted by one of the investigators at his job, Do told them “I don’t know anything about that” and went back to work. That said, realizing people were onto him, he took the website down for good on May 4, 2025, but the involvement cost him his job, which he lost on May 15.

Interestingly, sharing non-consensual deepfake porn is not a crime in Canada, so Do technically wasn’t doing anything illegal (immoral, yes) there. However, Prime Minister Mark Carney promised to pass a law making it so during his federal election campaign, stating he would “make producing and distributing non-consensual sexual deepfakes a criminal offense.”

As a reminder, MrDeepFakes had thousands of daily visits, with members using aliases and paying in cryptocurrency, before suddenly featuring nothing else but a message titled ‘Shutdown Notice’ stating it was shutting down and not coming back due to “terminated service” by its service provider.