Remove Leaked Photos: The Order That Works

To remove leaked photos, work in layers: keep a record of where they appear, block further uploads where a hashing service can, ask each platform and host to take the files down, and then ask search engines to stop listing the pages. The order matters because each layer feeds the next, and the layer that reaches the most copies, the host's own removal, is the one most people try last.

A leak means private photos reached an audience you never chose. Sometimes it is an intimate image shared by a former partner. Sometimes it is a folder taken from a hacked cloud account, or private family photos posted by an acquaintance. The distress is the same, but the routes differ with the type of image, your age in it, who took it and where it now sits. This guide is written for the person in the photos, or someone helping them.

The policies below are described as of the pages read for this guide: StopNCII.org, Google's help and blog pages on explicit imagery, the Federal Trade Commission's (FTC) pages on the TAKE IT DOWN Act, the Take It Down service of the National Center for Missing and Exploited Children (NCMEC) and the Copyright Office's page on section 512 notices, together with the text of the Act itself. Check the live page before you file. This is information, not legal advice. If you are being threatened, contact the police first.

The short version

Keep a private list of each link before anything is reported. Never forward the images, and never save anything that shows a person under 18.
Hash intimate images first, so partner platforms can block new uploads. If you were under 18 in them, use the NCMEC service instead.
Report each page to the platform and the host. In the United States, covered platforms have 48 hours to act on a valid request for intimate images.
Ask Google Search to delist the pages, and expect the page itself to stay online until the host or a court acts.
If you took the photo yourself, you probably own its copyright, which gives you a second route.

48 hoursthe time a covered platform has to remove a reported intimate image and known identical copies

May 19, 2026the date the FTC gives for the start of enforcement of that platform duty

10 to 14 business daysthe window after a counter-notice when a host may restore material unless the sender files a court action

From the FTC's business guidance on the TAKE IT DOWN Act, the Act's text and the Copyright Office's page on section 512, all read for this guide.

Remove leaked photos in this order: five layers, not one report

Leaked photos live in five places at once, and a removal that touches only one looks like a failure a week later. The layers are the original upload, the copies on other sites, the search results that point to both, your own devices and accounts, and the uploads that have not happened yet.

The order is: record, block, report at the source, delist, then watch. Recording comes first because later steps destroy proof. Blocking comes before reporting because a hash can stop a re-upload that a report cannot. Reporting at the source comes before delisting because a search engine only changes its own results, and a page that still exists can be found again.

The table matches the case to the lead route.

Your case	Lead route	Why it leads	Where it stops
Intimate image, you were 18 or older	StopNCII.org hash, then platform reports	Blocks matching uploads on partner platforms	Not non-partner sites or encrypted chats
Intimate image, you were under 18	NCMEC Take It Down, then police	Built for images taken before 18	Platform participation is voluntary
Private photo you took yourself	Copyright notice to the host	You usually own the work	Needs a host that acts on notices
Private photo someone else took of you	Platform privacy report	The copyright is probably theirs	Privacy rules vary by platform
Photos taken from a hacked account	Secure the account, report to host, police	The access itself may be an offense	Files may sit on many mirrors

Two related topics have their own procedures and are not repeated here: synthetic images made to look like you, and the full Google form for explicit images. If your images are fabricated, the layers still apply but the legal grounds shift.

First hour: protect yourself and keep a record without spreading anything

Your first job is to make sure no one is in danger and to keep a record that a platform, an officer or a lawyer can use without creating new copies of the images.

If anyone is threatening you or demanding money or more images, contact the police. Australia's eSafety Commissioner advises not paying, not sending more money or intimate content, and stopping all contact with the person making the demand.

A record is a list, not a gallery. For each place the photos appear, note the web address, the date and time, the site name, any account name shown and what the page says about you. Take a screenshot only where it helps identify the address, and crop or cover the image. Google's form for explicit imagery tells you that screenshots help it find content and that you can edit them so only your face is visible.

Never forward or reupload the images, not even to a helper or lawyer. Share the address list.
Never save or screenshot anything that shows a person under 18. Google's help page says not to include screenshots of child sexual abuse imagery or sexualized content involving someone under 18. Stop collecting and go to the NCMEC service and the police.
Keep the record somewhere private, not in a shared family album. An automatic cloud backup can undo a careful response.

If looking at the material harms you, ask one trusted person to keep the list. Reporting needs one single list and a calm hour, not repeated viewing.

The first-hour record

Check for dangerIf there is a threat or a demand for money, call the police first and do not reply to the sender.
List the addressesFor each page, write the address, site name, date and time, and any account name. Do not copy the images.
Note who has the originalsWrite down who took each photo and how it was first shared. This decides the copyright route later.
Secure your accountsChange passwords and turn on two-step sign-in for email and cloud storage before you report anything.

Securing accounts belongs in the first hour because a leak is often the second problem. If the photos came from a cloud account, the person who took them may still have access, and removing posts will not stop new ones.

Block the spread first: hash intimate images before you report them

If the photos are intimate and you were 18 or older in them, create a hash with StopNCII.org, because a hash can stop matching uploads on participating platforms that a report cannot. A hash is a digital fingerprint made on your own device, so the image itself is not sent to anyone.

StopNCII's pages explain the process. You select the images on your device, the hashes are created there, and only the hashes are sent. Its FAQ says the images never leave your device and are never saved by the service. You receive a case number and a PIN, which cannot be recovered if lost. Participating platforms compare the hashes against content on their services and review matches against their own policies.

The limits are as important as the process, and the FAQ states them:

It works only with the platforms on its partners page, not the whole internet.
Most messaging services use encryption, so hashing does not apply there.
An edited copy may not match the original hash.
It does not report content to the police.
You cannot add images to an existing case. A new image needs a new case.
You must be the person in the image and over 18 in it. Someone else cannot submit for you.

If you were under 18 in the images, use the service run by NCMEC. Its Take It Down page says it helps remove, or stop the sharing of, nude or sexually explicit images taken before the person turned 18, and it works the same way: the file stays on your device and only a hash goes to participating platforms. It warns you not to repost the content afterward, since future posts may be flagged. Tell the police as well. The FTC says that sharing an intimate image of a minor is a crime.

A hash does not remove what is already online. Treat it as a gate on the door. It matters most in the days after a first leak, when the same files are uploaded again to different accounts.

Report to each platform and use the 48-hour rule where it applies

Every platform that hosts a copy has its own removal process, and you must report each copy separately. Use the platform's form for non-consensual intimate imagery where it has one, since that is the category the removal rules are written for. For private photos that are not intimate, look for the privacy or personal information category.

In the United States, the TAKE IT DOWN Act adds a legal deadline. The FTC's business guidance says the platform duty is enforced from May 19, 2026. Covered platforms must run a notice and removal process, explain it in plain language, and remove a reported intimate image and known identical copies within 48 hours of a valid request. The FTC's consumer page says the law covers real images, digitally altered images and AI-generated deepfakes. You do not have to find every identical copy yourself.

Use the platform's own process. The Act sets out what a valid request must contain: it must be in writing and include the signature of the person depicted (physical or electronic) or of someone authorized to act for them, identification of the depiction with information reasonably sufficient for the platform to locate it, a brief statement of a good-faith belief that it was shared without consent, and contact information. A platform must then act as soon as possible and not later than 48 hours after receiving such a request. In practice that means the exact address, your name, a plain statement that you did not consent and a way to reach you. If the platform misses the 48 hours, has no findable process or has a broken one, the FTC points you to its Take It Down violations report at takeitdown.ftc.gov. You can report for your child, or for another person with their permission.

The deadline covers intimate images on covered platforms. A private holiday photo or an embarrassing but non-intimate picture depends on the platform's privacy rules. Outside the United States, other regimes apply. The eSafety Commissioner takes reports of image-based abuse, and the UK Revenge Porn Helpline supports adult victims in the UK with guides for reporting to platforms and adult sites. The eSafety page read for this guide does not state removal times or who may report, so check it.

Keep each report short and factual: your name, the address, the rule and the request. Do not describe the relationship or how the photo was taken. A reviewer applies a rule, and a long story gives them reasons to close the ticket as a private dispute.

Ask search engines to delist the pages after the source is reported

Delisting hides pages from search results, which cuts off casual discovery, but it does not take the photos off the web. Google's help page says it can only remove content from its own results pages. The files stay on the host, and other search engines, direct links and chat groups still lead to them.

For explicit images, Google has a specific route. Its help page on explicit imagery says you, or your representative, can request removal of sexual images of you, and that fake sexual content is covered where you are identifiable, the content is fake and it was distributed without consent. You provide the page addresses, and only those are reviewed. Google says it tries to find and remove duplicates, and you can opt out of that on the form.

Google's blog post on removing explicit images describes a quicker path in Image Search: open the menu on the image, choose "remove result," then "It shows a sexual image of me." You can submit several images together, opt in to filtering of similar explicit results, and follow requests in the "Results about you" hub, where you also get email updates. The post described a rollout in most countries, so it may not yet appear for you.

There are two outcomes. Full removal hides the page from all Search results. Partial removal hides it only for searches that include your name or another identifier. Google weighs public interest, so newsworthy content may not be removed.

Photos that are not sexual fall under other policies, such as those on personal information, and a plain photo is not automatically within them. Those policy pages were not part of this guide's sources, so treat the page the removal form points to as the authority, and expect refusal when the image is ordinary. There the host and copyright routes matter more.

Submit delisting after your platform reports, not instead of them. If the page disappears at the source, you can ask for the stale result to be refreshed.

Go to the host, the registrar and the copyright route when a site ignores you

When a site has no report form or ignores yours, pressure moves to the parties that make it run: the hosting company, the domain registrar and any proxy service in front of the site. Their terms usually forbid unlawful content and most publish an abuse contact. Identify the host through a standard domain lookup. A proxy can hide the true host, and whether its abuse form forwards reports was not confirmed for this guide, so check the provider's page. Send the same facts as in the platform report and leave the emotion out.

The copyright route. If you took the photo yourself, you most likely own its copyright, and in the United States a notice to the host under the Digital Millennium Copyright Act (DMCA) is often faster than an abuse report. The Copyright Office's page on section 512 lists what a notice should contain: the signature of the owner or an authorized agent, identification of the work and of the material with enough detail to locate it, your contact information, a good-faith statement that the use is not authorized, and a statement under penalty of perjury that the information is accurate and that you are authorized to act. Registration and a lawyer are not required. Notices go to the provider's registered agent, listed in the Copyright Office's directory.

Three cautions apply.

Ownership is the point. A photo someone else took of you is usually their work. The Copyright Office warns that a knowing material misrepresentation can lead to liability for damages, costs and attorneys' fees.
Your details travel. A counter-notice requires the poster to give a name, address and phone number and to consent to a federal court. Consider having a lawyer or agent send the notice.
The restoration clock exists. A provider may restore removed material after 10 to 14 business days unless the sender reports a court action.

Google's copyright removal process was not part of the sources read for this guide, so confirm in its help center how to delist the same pages. Outside the United States a notice is not always a recognized tool, and the host's local law governs. The route also fails for fabricated images, where no photo of yours stands behind the file.

Legal routes: police, regulators, civil claims and court orders

Legal routes sit behind the platform routes because they are slower and cost more, but they are the only ones that can reach the person who leaked the photos or a site that refuses to act.

Police. The FTC says that sharing an intimate image without consent is a crime and tells victims to report it to local law enforcement and the FBI. Other countries have their own offenses, and the eSafety page says police may be able to investigate under criminal laws on image-based abuse. Bring the address list, not the images.

Regulators. eSafety may act against the person responsible, if you want that. In the United States the FTC takes reports about covered platforms that ignore the removal duty.

Civil claims and orders. A lawyer can send a formal demand to the poster or the site, ask a court for a takedown order and seek damages where the law allows. The grounds vary: breach of confidence, misuse of private information, harassment, copyright, or a statute on sharing intimate images. A court order can be put to a host or search engine as a legal request, a stronger instrument than a policy report. Court filings can be public, so ask counsel about anonymity first. Do not threaten anyone yourself: a message that reads as a threat or a demand for payment can make you the respondent.

A lawyer in the country of the poster or host decides what applies to you. Many countries run free or low-cost advice lines for intimate image abuse, worth calling before you pay a private firm.

A realistic timeline from the first hour to the long tail

These are experience-based ranges, not promises. They assume a single leak onto a handful of sites with no threat attached.

When	What you do	What usually happens
Hour one	Safety check, address list, secure accounts	You have a record and the sender cannot get back in
Day one	Hash intimate images, report to the main platforms	Partner platforms start matching; US platforms have 48 hours
Days two to seven	Host and registrar reports, copyright notices, delisting	Cooperative hosts act in days; Search follows the source
Weeks two to six	Follow up refusals, escalate to regulators or counsel	Stubborn sites take weeks; some never answer
Month two onward	Watch for reposts, file again where a copy returns	Fewer new copies, with occasional resurfacing

Here is an invented scenario with generic parties. An adult finds private photos, sent to a former partner, on a small forum and a social platform. She lists both addresses, changes her email password, creates a hash case and reports the social post on its intimate-image form. She reports the forum post to the forum and to its host, then files a Search request for both addresses. The platform removes its post the next day, the forum never replies, the host acts after about a week, and a mirror appears a month later. The hash stops a re-upload on the platform, and she files one more report for the mirror. It is a realistic outcome, not a typical one: it used every layer and needed several attempts.

When a route fails: what to do when the photos stay up

Every layer can fail, and the failure usually has a nameable reason. Name it before you retry, because repeating the same request rarely changes the answer.

No abuse contact and a hidden host. Report to the registrar and the proxy service, and delist the pages regardless.
The platform says the image does not break its rules. Check the category you chose. Re-file under the intimate-image category if it applies. If the platform is covered and 48 hours pass, use the FTC violation report.
The edited copy did not match the hash. Submit it as a new StopNCII.org case, since an existing case cannot take new images.
The content sits in a private group or encrypted chat. Hashing does not apply to most encrypted messaging. Report the account to the app, and involve the police if threats are made.
The site is overseas and ignores notices. Legal routes get slower. A lawyer may reach the registrar or obtain an order a search engine will honor, which at least cuts discoverability.
A copyright notice draws a counter-notice. If you do not own the work, stop and use the privacy routes. If you do, speak to counsel before you decide.

Resist escalating in public. A post about the leak or a name-and-shame thread adds attention to the content and may breach platform rules. Be careful with anyone who promises certainty: no one can promise leaked material will vanish from the whole internet, and a service that asks for your passwords or the images themselves should be avoided. Legitimate help asks for addresses and your identity, not the files.

Next step: take the first three actions today

Write the address list, secure your accounts and open the hash case if you qualify. Everything else can follow in order over the coming days, with someone you trust beside you.

If this is happening to you now

You do not have to look at the files again to remove them. Reputation Partners handles leaked and intimate content removal in confidence, working from addresses and never asking you to send the images. Start with the leak removal service page.

Questions people ask

Can leaked photos ever be fully removed from the internet?

Rarely in full. You can usually remove them from the main platforms, from cooperative hosts and from search results, which covers most of what a visitor would find. Copies in private chats, on foreign sites that ignore notices and on someone's own device are beyond reach. The aim is to make the material hard to find and quick to remove each time it returns.

Should I contact the person who leaked the photos?

Usually not alone. A message can prompt them to delete evidence, start a dispute or escalate threats. If you want deletion demanded, let a lawyer or the police do it. If they are blackmailing you, stop contact and do not pay, as the eSafety page advises.

Will Google Search remove leaked photos that are not sexual?

Not automatically. Its explicit imagery policy covers sexual content, including fake sexual content where you are identifiable. Other private photos are judged under different policies, and plain images often fall outside them. Report to the host and consider the copyright route if you took the photo yourself.

What if I took the photo but sent it to someone who posted it?

You usually still own the copyright in a photo you took, even if you sent a copy, so a copyright notice to the host may be open to you. Sending a copy does not generally transfer ownership. Check the law of your country, and be ready for a counter-notice.