Your Content Was Leaked. Here's the First 48 Hours.

At some point, if you sell content, some of it will show up where you did not put it — reposted, bundled, or "leaked." The creators who handle this well are not calmer people; they are prepared people. They have a runbook, they follow it in order, and they do not waste the first hour spiraling. This guide is part of our compliance hub, and it is the one to read before you need it.

The order matters more than the speed. Do these in sequence.

Step one: preserve evidence before you touch anything

Your instinct will be to report it immediately. Resist that for ten minutes and document first, because the moment a poster realizes they have been noticed, content moves and accounts disappear — taking your proof with them.

Capture, for every instance:

• A screenshot that clearly shows the full URL or web address of the page.
• The date and time you found it.
• The username, handle, or profile of whoever posted it, where visible.

Save copies somewhere you control — a private drive, a folder, a second device. Organize by date. This evidence is what makes every later step possible, and it is what an attorney or platform will ask for first.

Step two: understand your main tool — and its hard limits

In the US, your primary lever is copyright, exercised through the DMCA notice-and-takedown process in Section 512 of the Copyright Act. Send a valid notice to the service that hosts the content and, under the law, they remove or disable access to it to keep their own safe-harbor protection.

Two things decide whether this works for you:

You must own the copyright. When you shoot the photo or video yourself, you generally own it — a selfie or a self-recorded clip puts you on strong footing. If someone else took the image, that photographer usually owns the copyright, which can weaken or block a DMCA claim by the person depicted. That is not a loophole against you; it is just how copyright authorship works, and it is why the intimate-image tools below exist as a parallel path.

A valid notice has required parts. Section 512 lists what a takedown notification must contain. In plain terms, you need to include:

1. Your physical or electronic signature as the owner (or someone authorized to act for the owner).
2. Identification of the work being infringed — your original photo or video.
3. Identification of the infringing material and enough information to locate it (the URLs you preserved).
4. Your contact information — address, phone, email.
5. A good-faith statement that the use is not authorized by you, your agent, or the law.
6. A statement that the information is accurate, and — under penalty of perjury — that you are authorized to act for the owner.

Send that notice to the service's DMCA designated agent. Most platforms publish this contact, and the U.S. Copyright Office maintains a public Designated Agent Directory you can search to find it.

Now the limits, because they are the part people get wrong when they are upset:

• A DMCA takedown removes content; it does not unmask the poster and it is not a punishment. Pursuing the person is a separate path, usually involving an attorney and, where it applies, your state's non-consensual image law.
• A takedown gets content off a specific host or out of search results. It does not scrub the internet. The same file can live on multiple sites; each one is its own notice.

Step three: for intimate images, use the purpose-built tools

If the content is a non-consensual intimate image, there are systems built specifically for this that are faster and less exposing than chasing individual hosts, because you never have to send anyone the image.

• StopNCII.org creates a hash — a digital fingerprint — on your own device. Only the hash is shared, never the image or video; the content stays on your device. Participating platforms match that hash and remove content across their services. You are 18 or over in the image to use it; if the person in the image is under 18, StopNCII directs you to the separate Take It Down service.
• The Cyber Civil Rights Initiative (CCRI) runs a US crisis helpline for image abuse and can point you to platform-specific removal help. Their number is 1-844-878-2274.

These are the right first move for intimate-image leaks specifically. Use them alongside — not instead of — takedowns to the hosts.

Step four: get it out of Google

Removing content from the host is the real fix, but you also want it out of search so it stops being discoverable. Google provides two relevant paths:

• A general "Report content for legal reasons" tool that handles copyright removals via the DMCA, court orders, and other legal bases. You supply the URLs and the legal reason.
• A dedicated tool to remove explicit or intimate personal images from Google Search when they were shared without consent — usable directly from the search results.

Keep the limitation in mind: removing a result from Google stops it showing up in Google, but the file still lives on the hosting site and stays reachable by direct link, resharing, or another search engine. Google itself points you back to the host as the real fix. Do both.

The 48-hour runbook

When it happens, work the list:

1. Document every instance — URL, date/time, username. Do not skip this.
2. Triage by reach. Kill the highest-traffic copies first.
3. File DMCA notices to each host's designated agent for content you own.
4. Hash it with StopNCII if it is an intimate image, and call the CCRI helpline if you want support.
5. Report to Google for legal removal and, if applicable, the explicit-images tool.
6. Log everything — what you sent, to whom, when. That record matters if it escalates.
7. Decide on escalation. Repeat offenders, or content you cannot remove, are the point at which you bring in an attorney or, where a crime has occurred, law enforcement.

Build the kit before you need it

None of the above should be assembled for the first time during an incident. Prepare it now, while you are calm:

• A saved DMCA notice template with the six elements, ready to fill in.
• A list of the platforms you sell on and their designated-agent contacts.
• Accounts set up with StopNCII and the CCRI helpline number saved.
• A habit of capturing evidence the instant something appears.

A leak is not a referendum on you and it is not the end of your business. Handled with a runbook, it is a contained, procedural afternoon.

This connects to the rest of the hub: strong privacy hygiene reduces how often this happens and how much it exposes, and clean records and income tracking make any escalation far easier to substantiate.

This is general information, not legal advice. It is sourced to the U.S. Copyright Office and platform documentation as of the access dates below, but it cannot account for your situation or your state's specific laws. For a serious incident, consult an attorney and, where a crime may have occurred, law enforcement.