An AI Image of You Was Posted. The Order You Do Things In Decides How Much It Costs You.
You want a name. That is a completely reasonable thing to want, and it is also the slowest thing on this page, the one a private party is least able to get, and the one that most often has to wait for a lawyer or a detective. Meanwhile the image is still up and the record of who put it there is still deletable. So this page is built the other way round: what to capture, how to force a takedown, which federal law now applies to a picture that was never real, who to tell, and only at the end, honestly, what identification does and does not look like.
The short version
Answer one question before you touch anything else: was the person shown in the image under eighteen? If yes, the material may be contraband under federal law and the advice below about saving copies does not apply to you — skip to the first section, which routes that case separately. If the person shown is an adult, the sequence that works is: capture the post, the profile and the timestamps before you report, because reporting very often deletes the thing you would later need; send the platform a written removal request, which since May 2026 carries a forty-eight-hour clock; submit the image to a hash-matching service so copies get blocked at other platforms; report it to police, because publishing an AI-made intimate image of a real person is now a federal crime in its own right; and then talk to an attorney about identification, which in practice runs through a court, not through a search box.
Watch: why identification is the last step, not the first
A short briefing on the sequence, and on the one question that changes all of it.
Start with the age of the person in the image
This is not a softer version of the adult case. It is a different body of law, and the standard advice to save a copy of everything is the wrong advice here.
Federal law defines child sexual abuse material by reference to what the picture shows, not to how it was made. Section 2256 of title 18 reaches a visual depiction that “has been created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct,” and the same section defines an identifiable minor as a person who was a minor when the depiction was created, adapted or modified, or whose image as a minor was used in making it, and who is recognizable as an actual person by face, likeness or another distinguishing feature. It adds that this does not require proof of the minor’s actual identity. A nudify app applied to a real school photograph lands inside that definition on its face.
Two consequences follow, and both are the opposite of what a general article about deepfakes will tell you. The first is that “it is not real” is not the defense people assume. Under section 2252A, the affirmative defense that no actual minor was used in producing the material is expressly unavailable in any prosecution involving material described in that “created, adapted, or modified” clause. Congress wrote that carve-out specifically so that synthesis would not become a loophole.
The second consequence is the one that matters to you today. Do not build an evidence archive. Do not download the image, do not email it to a relative or a lawyer or a removal company, and do not put it in a shared folder. The same section 2252A gives a narrow affirmative defense to a possession charge, and reading its conditions tells you exactly what safe conduct looks like: it applies where a person possessed fewer than three images and, promptly and in good faith, and without retaining or allowing any person other than a law enforcement agency to access any image or copy, either took reasonable steps to destroy each one or reported the matter to a law enforcement agency and gave that agency access. Notice what is doing the work there — without allowing anyone other than law enforcement to access it. Forwarding a copy to a well-meaning third party is the step that turns a victim’s parent into a defendant, and it happens.
So what do you record instead? Text, not pictures. Write down the exact URL of the post and of the profile, the account name as displayed, the date and time shown on the post, what the caption said, and where else you have seen it. That is a description, and a description is not contraband. Then hand the locations to the people whose job it is to look.
There is a second reason reporting a minor’s case does not destroy your evidence the way it can in an adult case, and almost nobody knows it. Section 2258A of title 18 provides that when a provider files a report to the CyberTipline, that completed submission is treated as a request to preserve the contents provided in the report for ninety days, and the provider must also preserve any visual depictions, data or other digital files that are reasonably accessible and may provide context or additional information about the reported material or person. In other words, in the minor case the act of reporting creates preservation, including of material that might bear on who posted it. That is the strongest single argument for reporting fast rather than gathering first.
The CyberTipline is operated by the National Center for Missing and Exploited Children, which is the body section 2258A names, and it takes reports from the public as well as from providers. For blocking distribution of a sexual image of someone who was under eighteen when it was made, the corresponding hash-matching service is Take It Down, also run by that organization. We name both rather than linking them, because linking policy on this site is limited to government and university sources; you will find them by name. If a child is in immediate danger, that is a 911 call, not a form.
Capture it before you report it
For adult cases only. The most common irreversible mistake on this topic is hitting report first and discovering afterwards that the post, the handle and the timestamp are gone.
A takedown is a deletion. When it works, the post disappears, and depending on the platform the account may go with it. What you are left with is a memory of a URL. Investigators and attorneys both need the specifics, and reconstructing them from recollection weeks later is close to worthless. Ten minutes of capture before you report is the highest-value ten minutes in this whole process.
What to write down, in this order
The full URL of the post itself, not the feed you found it in. The full URL of the profile that posted it, and if the platform exposes a permanent numeric account identifier anywhere in that URL or in a share link, that identifier too — display names get changed the moment somebody feels heat, and a numeric identifier does not. The date and time displayed on the post, together with a note of your own time zone, because platforms render timestamps in the viewer’s local time and a mismatch later reads as an inconsistency in your account of events. The caption, the hashtags and the visible replies, because intent is an element of the offense discussed further down and captions are where intent usually shows. Every other location you have seen it, each as its own URL.
Then screenshot the whole browser window with the address bar visible, rather than cropping to the image. A crop proves nothing about where the thing lived. Keep one untouched copy of every screenshot and do your annotating on duplicates. Finally, record the date and time you did the capture, in a plain text file alongside it. That single line converts a folder of images into something with a chain of custody.
Yes, you may keep a copy of an image of yourself
Adults sometimes hesitate here, worried that holding the file is itself a problem. For an adult image it is not, and the statute discussed in the next section says so from several directions at once. Its exceptions expressly cover a disclosure made reasonably and in good faith to a law enforcement officer or agency, a disclosure made as part of a document production or filing associated with a legal proceeding, a disclosure made to seek support or help with respect to the receipt of an unsolicited intimate visual depiction, a disclosure reasonably intended to assist the identifiable individual, and a person who possesses or publishes a depiction of himself or herself. A victim keeping the file, showing it to a lawyer, handing it to a detective and submitting it to a support service is inside every one of those.
What you should not do is send it back to the poster, post it yourself to ask “is this me?”, or upload it to a random detector site that keeps what it is given. If you want a second opinion on whether an image is synthetic at all before you escalate, we keep the technical tells on a separate page about spotting AI-generated images and profiles, and it is worth five minutes when you are not certain.
Three ways to get it down, and who each one is actually for
They are not competing options. Two of them are free, one of them is now legally compelled, and none of them requires you to know who posted it.
The first is the platform’s own removal request, and it is no longer a favor. The TAKE IT DOWN Act required every covered platform to build a removal process, and to publish a clear and conspicuous notice of it, written to be easy to read and in plain language, explaining the platform’s responsibilities and how to submit a request. If you cannot find that notice on a site that hosts user content, that absence is itself reportable, and the next section explains where.
The statute is specific about what makes a request valid, and this is where most requests fail. It must be in writing and it must include four things: a physical or electronic signature of the person depicted or someone authorized to act for them; an identification of the depiction and information reasonably sufficient for the platform to locate it; a brief statement of good-faith belief that the depiction is not consensual, together with any relevant information helping the platform determine that it was published without consent; and contact information sufficient for the platform to reach you. Four items, no more. Write them as four labeled paragraphs and the request becomes hard to refuse on form. The clock in the next section only starts once the request is valid, so the shape of it is worth getting right the first time.
Note the phrase “or an authorized person acting on behalf of such individual,” which appears in that provision and again in the removal duty. A parent can file for a child. An attorney can file for a client. You do not have to do this yourself while you are in the worst week of your life.
The second is hash matching, and it is the only one that works on copies you have not found yet. A hash is a short digital fingerprint computed from the file. Two identical files produce the same fingerprint; the fingerprint cannot be turned back into the picture. The service takes the fingerprint rather than the image, shares it with participating platforms, and those platforms can then match and block uploads without anyone at any of them having to look at your photograph.
Which service depends entirely on age, and the line is hard. For someone who was eighteen or older in the image, the service is StopNCII.org. For someone who was under eighteen when it was made, it is Take It Down, the service described in the previous section. Read each service’s own eligibility page before you begin rather than taking our summary for it — the age rule is a hard cut, not a guideline, and submitting to the wrong one wastes the days that matter. Both are named here rather than linked, for the reason given earlier.
The third is search removal, which is a separate job from host removal. Getting an image off the site that hosts it does not clear it from search results, and clearing search results does not remove the file. Do both. Major search engines run their own request forms for nonconsensual explicit imagery; find the form on the engine itself rather than through an intermediary.
About paid removal services
Search for help on this topic and most of what ranks is a company selling removal. Some of them do real work. None of them has any authority you do not have: the statutory removal request is free, the hash services are free, and the complaint route described next is free. Before you pay anyone, ask them to name the specific mechanism they will use on your behalf and what it costs you to use it yourself. A firm that cannot answer that plainly is selling the panic rather than the remedy.
Six routes, and the honest limit of each
Nothing here is exclusive. They stack, and only the last of them is aimed at identifying anybody.
| Route | What it does | What it does not do |
|---|---|---|
| Written removal request to the platform | Starts a forty-eight-hour clock, once valid, for removal of the depiction and reasonable efforts to find and remove known identical copies Fastest hard stop | Does not reach email, broadband providers, or a site whose content is preselected rather than user-generated. Does not tell you who posted it |
| Hash submission for adults | Blocks the same file from being uploaded again at participating platforms, without your image leaving your control | Matches identical files. A recrop, a re-encode or a fresh generation from the same source produces a different fingerprint |
| Hash submission for minors | Same mechanism, run by the organization that operates the CyberTipline, for people who were under eighteen when the image was made | Not a substitute for a report. Where a minor is depicted, the criminal referral is the primary action, not the secondary one |
| Complaint to the Federal Trade Commission | Reports a platform that missed the forty-eight hours, has no removal process, or has one that does not work. Enforcement began 19 May 2026 | The Commission enforces against the platform. It does not remove the image itself and it is not an investigation of the poster |
| Criminal report | The only route that can lawfully compel a platform to disclose who was behind an account, and the only one with subpoena power behind it | Filing does not guarantee a case is worked. Agencies rarely report back to a complainant about a suspect’s identity |
| Civil action through counsel | The route most likely to actually produce a name for you, because a party to a lawsuit can seek discovery that a private citizen cannot. It is also slow, costs money, usually starts against an unnamed defendant, and depends on a court agreeing that unmasking is warranted. Talk to a lawyer about it early even if you do not file, because limitation periods run and platform logs do not last forever. | |
Where a case needs someone to work out which legal entity actually operates a host, where its registered agent sits, and what address a demand has to reach to be effective, that public-records legwork is what we do, and the boundaries around it are set out further down this page.
Images that were never real, and the law that now reaches them
The most-read guidance on this topic online predates the current federal statute by more than a year. Here is what it actually says, read at the enrolled text.
The TAKE IT DOWN Act, Public Law 119-12, was approved on 19 May 2025. Its section 2 inserted a new subsection (h) into section 223 of the Communications Act, and that subsection is the part that concerns a synthetic image directly.
What counts as a digital forgery
The Act defines a “digital forgery” as any intimate visual depiction of an identifiable individual created through the use of software, machine learning, artificial intelligence, or any other computer-generated or technological means, including by adapting, modifying, manipulating or altering an authentic visual depiction, that, viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction of the individual. An “identifiable individual” is someone who appears in whole or in part in the depiction and whose face, likeness or other distinguishing characteristic — the statute gives a unique birthmark as its example — is displayed in connection with it. A picture generated from nothing, and a real photograph of you edited to remove clothing, both sit inside that definition.
The elements, for an adult
Publishing a digital forgery of an adult through an interactive computer service, in interstate or foreign commerce, is unlawful where four things are true: it was published without the depicted person’s consent; what is depicted was not voluntarily exposed by that person in a public or commercial setting; what is depicted is not a matter of public concern; and publication either was intended to cause harm or in fact caused harm, which the statute says expressly includes psychological, financial or reputational harm. That last clause is worth sitting with. You do not have to prove the poster meant to hurt you if you can show the publication hurt you, and distress counts.
The elements, for a minor, are lower
Where the person depicted is a minor, the harm element disappears entirely. It is unlawful to publish a digital forgery of a minor with intent to abuse, humiliate, harass or degrade the minor, or to arouse or gratify anyone’s sexual desire. Nothing about consequences has to be established. The penalties differ on the same axis: publishing a digital forgery of an adult carries a fine and imprisonment of not more than two years, and of a minor, not more than three years.
Threats are a separate offense
If someone is threatening to post rather than posting — the pattern behind most sextortion messages — that is charged on its own. Intentionally threatening to commit the digital-forgery offense for the purpose of intimidation, coercion, extortion or to create mental distress carries imprisonment of not more than eighteen months where an adult is involved, and not more than thirty months where a minor is. A person who has not published anything yet has still committed an offense, which is why “I will just pay them and it will stop” is both untrue and unnecessary.
The two sentences that answer the blame
The Act carries rules of construction that exist because of exactly the conversation victims get dragged into. The fact that you consented to the creation of an intimate depiction does not establish that you consented to its publication. The fact that you disclosed it to one person does not establish that you consented to its publication by whoever is alleged to have published it. If a real photograph of yours was the raw material for the fake, that is the provision to quote.
The forty-eight-hour clock, and its edges
Section 3 of the Act is the removal duty, and it gave covered platforms one year from enactment — to 19 May 2026 — to establish the process. On receiving a valid request, a covered platform must, as soon as possible and not later than forty-eight hours, remove the depiction and make reasonable efforts to identify and remove any known identical copies. Because the Act defines a digital forgery as a kind of intimate visual depiction rather than as a separate category, that removal duty reaches AI-made images as well as real ones. Platforms are also protected from liability for removing in good faith, which removes their usual excuse for hesitating.
Two edges matter. First, “covered platform” means a public-facing website, service or application that primarily provides a forum for user-generated content, or that publishes or hosts this kind of content in the regular course of its business — and the Act expressly excludes broadband internet access providers, electronic mail, and services consisting primarily of preselected content where interaction is incidental. If the image sits on a self-hosted site or arrived by email, the forty-eight-hour route is not available and you are into hosting complaints and legal process instead. Second, the Federal Trade Commission enforces section 3 rather than a court: a failure to reasonably comply is treated as a violation of a rule defining an unfair or deceptive act or practice. The Commission began enforcing on 19 May 2026 and opened a complaint portal for platform violations. Its own guidance for consumers confirms you can complain not only when a platform misses the deadline but when you cannot find its removal process or the process is broken, and that you may file for yourself, for your child, or for someone else with their permission.
Suing, and one honest complication
Separately from the criminal provision, section 6851 of title 15 gives a federal civil cause of action for nonconsensual disclosure of an intimate visual depiction, with liquidated damages of $150,000 as an alternative to proving actual loss, attorney’s fees, injunctive relief, and permission for a court to protect the plaintiff’s anonymity behind a pseudonym. It is a powerful section. But read its definition before you rely on it. It is keyed to a “depicted individual,” defined as someone whose body appears in whole or in part in the depiction. Whether that reaches a wholly synthesized body carrying a real face is a genuine question, and it is exactly why the newer Act defined “digital forgery” separately. We are not going to pretend otherwise on a page people will act on: ask counsel which theory fits your facts.
State law often closes that gap more cleanly, and it varies enormously, so check your own. California is a useful illustration because its provision was written for synthesis specifically: Civil Code section 1708.86 defines “digitization” to include computer-generated nude body parts realistically depicted as the depicted individual’s own, gives a cause of action against someone who creates and intentionally discloses such material, against someone who only discloses it, and against someone who knowingly facilitates or recklessly aids it, and allows statutory damages from $1,500 to $50,000, rising to $250,000 where the act was committed with malice, alongside punitive damages, fees and injunctive relief. It also puts a presumption of non-consent on anyone operating a service whose primary purpose is generating this material. We name California because we read California; we are not going to assert a count of states we have not read.
Who to tell, and in what order
Four different bodies, four different jobs, and only one of them is looking for the person who posted it.
Local police first, in the jurisdiction where you live. Not because they are best equipped, but because a report number is the thing every later step asks for, and because the person who did this is often geographically close to you. Bring the URL list rather than the images. Ask specifically for the report to record that the material is a digital forgery of an identifiable individual and, if applicable, that the person depicted is a minor, because those phrases determine which unit it gets routed to.
The Federal Bureau of Investigation. The Commission’s consumer guidance on this law tells people to report the perpetrator to local criminal law enforcement and to the Bureau, giving its online tip form at tips.fbi.gov or the number 1-800-CALL-FBI. We are naming those rather than linking them because our link policy here is strict and we do not link anything we could not independently confirm was reachable at the time of writing; type the address yourself.
The CyberTipline, where a minor is depicted. This is not optional and it is not second. It is the referral pathway federal law is built around, and as explained earlier, a report to it triggers a ninety-day preservation obligation on the provider side.
The Federal Trade Commission, if the platform fails you. That is a complaint about the company, not about the poster, and it is the only lever anyone has over a platform that shrugs.
The school, the employer, the campus
Where the people involved are students, the institution usually has a faster and blunter set of tools than any of the above — suspension, device seizure under its own policies, an internal investigation that does not need a warrant. Report there as well as to police, in writing, and keep the copy. Where an adult’s workplace is the distribution channel, the same logic applies. If the conduct is part of a wider pattern of targeting, our guide to documenting stalking and harassment covers how to build the log that these bodies actually act on, and a log covering months is far more persuasive than a single incident.
What not to do, stated plainly
Do not contact the account. Not to ask why, not to demand a deletion, not to warn them you have gone to the police. Three things go wrong. The person deletes the post, the account and the messages, taking your evidence and the platform’s logs with them. Your message becomes part of the record and gets characterized as harassment or as a threat, which is the standard defense playbook. And if the poster is someone who knows you, telling them you are watching escalates a situation you cannot control. If a friend offers to “handle it,” ask them not to, for the same reasons. The route to the poster runs through people with legal authority, and every shortcut around them costs you evidence.
The identification ceiling, described honestly
This is the question you arrived with. Here is the truthful shape of the answer, including the parts that sellers of hope leave out.
What the platform knows
A platform typically holds far more than the profile shows: the address used to register, connection records, device and application signals, any payment instrument, and the account’s relationships with other accounts on the same service. That is usually enough to identify a person or at least a household. It is also exactly the category of information a platform will not hand to a private party, and should not — a service that gave out subscriber identity on request would be unusable for everyone, including you. It moves on legal process, or on a law enforcement request, and essentially not otherwise.
What a court can compel
The realistic civil path runs through counsel. A lawsuit can be started against an unnamed defendant, and the plaintiff can ask the court for permission to serve discovery on the platform early, before the defendant is known, precisely in order to learn who to name. Courts do not grant that automatically; anonymous publication has some constitutional protection and judges weigh it, and the standard applied differs between jurisdictions. Your attorney will tell you which one yours uses. The criminal path runs on the same principle with different instruments and a prosecutor rather than you deciding what happens. Both are slower than you want and both are the actual answer.
Why a private firm generally cannot
Nobody outside that process has lawful access to platform subscriber records. A company advertising that it will unmask an anonymous poster for you is describing one of three things: information bought from a breach, an impersonation of you or of law enforcement to talk an account representative into a disclosure, or a guess dressed up as a finding. The first two are offenses. The third is worse than useless, because a confident wrong answer aimed at a real person is a harm you cannot take back, and it will end your credibility in the proceeding that could have worked.
What reverse image search really gives you
Run it anyway. It is genuinely useful, just not for the reason people think. What it maps is spread: the other places the same file is sitting, which is precisely the list your removal requests and your hash submission need in order to be complete. What it will not do is name a poster, and for an image that was generated rather than copied there may be no earlier appearance to find at all, which is itself informative. Treat a null result as evidence about the image’s origin, not as a dead end.
What metadata really gives you
Less than the internet suggests. Most platforms strip embedded metadata when a file is uploaded, so the copy you download usually carries nothing about its creation. Some generators embed provenance signals designed to survive, and it is worth having a specialist look. But be clear about the ceiling even when one survives: a provenance signal identifies the tool that made the image, not the human who typed the prompt. It is corroboration for a case, not an identification.
We do not publish techniques for unmasking anonymous accounts, and this page contains none. That is a deliberate editorial decision rather than an oversight. A method that would identify the person who did this to you would identify anyone, and the readership of a page like this one is not exclusively victims. Where the underlying conduct is ongoing rather than a single post, our guides to building a case against an online harasser and to what social media evidence a case can actually use stay on the same side of that line.
Six versions of this that arrive here
The first move is different in each. Find yours before you start clicking.
It is going round a school year group
Minor case. Do not collect copies. Record URLs as text, call the police, file with the CyberTipline, and tell the school in writing the same day.
Someone is threatening to post unless you pay
Threatening to publish a digital forgery is its own federal offense, whether or not anything is ever posted. Do not pay. Keep the messages and report it now.
The site has no removal form at all
Either it is not a covered platform, or it is one that has ignored the law. Both are worth reporting, and both usually turn into a hosting complaint rather than a form.
You reported it and now everything is gone
Including the URL and the handle. Work from your browser history, your notifications and anyone who saw it, and rebuild the list before more of it fades.
A real photograph of yours was altered
The statute answers the blame directly: consenting to a photograph being taken is not consent to it being published, and sending it to one person is not consent either.
You are certain you already know who did it
Put the name in the police report and nowhere else. Say nothing to the person. Being right and acting on it yourself still costs you the case.
Four steps, in an order that is not arbitrary
Each one either protects something the next one needs, or starts a clock that runs while you do the rest.
Settle the age question
It decides whether you may hold a copy at all, which hash service applies, and whether the CyberTipline is in play. Everything downstream branches here.
Capture, then log the capture
URLs, handles, timestamps, captions, locations, plus the date you recorded them. For a minor, text only. Ten minutes now, or a reconstruction from memory later.
Send the request, then submit the hash
The removal request in the four-part form starts the forty-eight hours. The hash submission works on the copies you have not found. Neither needs a suspect.
Report it, then raise identification with counsel
Police and, where relevant, the CyberTipline. Only then the identification conversation, with someone who can actually ask a court for it.
What we take on here, and what we turn down
On this subject the limits are the substance. The wrong kind of help produces a false accusation, and there is no version of that anybody recovers from.
We do not accept work to identify an anonymous poster on a victim’s account of events alone, and no amount of documentation changes that. Not because we doubt you. Because the only lawful holders of that answer are the platform, a court and a criminal investigator, and a private firm that inserts itself into that chain is either guessing or breaking something. A guess handed to a person in the worst week of their life gets acted on, and the cost falls on whoever the guess happened to land on. That refusal is the single most important sentence on this page.
What we do instead is the unglamorous half nobody sells. We work out which legal entity actually operates a host or a site when the brand on the page is not the company, and where its registered agent or corporate service address sits, so that a lawyer or an agency has somewhere real to serve. We map where an image has spread across public pages so a removal list is complete rather than partial. We assemble the packet — the URL schedule, the capture log, the dated record of what was sent where and what came back — in the form an attorney or a detective can pick up and use. And we tell you when the honest answer is that the material is already outside anywhere a public-records researcher can reach.
Every file opens with a stated lawful purpose, recorded before any research starts, and on a subject like this one the intake question is not a formality. Where the request is really “find the person behind this account so I can deal with them myself,” the answer is no, and we would rather have that conversation at the start than halfway through.
Nobody on this team holds a private investigator’s license, and we never suggest otherwise. What this is instead is a public records research firm that does skip tracing work; we are not licensed private investigators, and the distinction is not cosmetic. Surveillance, pretext interviews and the rest of the licensed-investigator toolkit are outside what we do and outside what this page recommends.
We do not pretext, ever. No one here calls a platform, a host or a carrier claiming to be you or claiming to be anyone else in order to talk a representative into releasing account information. Impersonation is close to the heart of what was done to you, and answering it with more impersonation would be both unlawful and contemptible. On the same principle, we do not obtain the contents of private accounts — no message contents, no login records, no payment card or bank account detail, no device location. Those are not public records and a firm offering them is describing an offense.
People Locator Skip Tracing is not a consumer reporting agency and nothing we produce is a consumer report. Our work must not be used, in any part, to decide whether someone gets a job, a tenancy, credit, insurance, or a license or benefit. Those decisions belong to the regulated process the Fair Credit Reporting Act built, with the notice, accuracy and dispute rights that come with it — and it is worth saying that if you are the person depicted here, those rights run in your favor, which is one reason we will not let a file about you be repurposed into a screening decision about someone else.
This page is also the kind of page that attracts the opposite of its intended reader, and we plan for that. “Someone posted an image of me, find who is behind the account” is a sentence an abuser can say as easily as a victim, and it is a well-worn route to locating a person who moved away to be safe. So a request on this subject gets more scrutiny at intake, not less. We decline any matter that is in substance an attempt to locate someone who has left a violent or controlling relationship, whatever it is labeled as, and we decline it without explaining what we noticed. Nobody who is hard to find is hard to find by accident; the distance is usually the point, and the fact that a person cannot be found easily is never treated here as evidence of anything. If you are the person being sought, a state Address Confidentiality Program and a domestic violence advocate are better protection than any request we could refuse, and an advocate can also help you time a police report around your own safety.
Everything above is general information about federal and California law as written, not legal advice about your situation, and reading it creates no professional relationship with anyone. Statutes are amended, agencies change practice, and your own state may give you rights well beyond the federal floor described here. If money has changed hands, if a threat has been made, or if a minor is involved, talk to a lawyer and to the police, and take this page with you.
The people who send us this
Different starting points, the same sequence, and the same answer about naming anybody.
People who were targeted
Adults working the removal sequence
Parents of a targeted child
Routing it correctly on day one
Schools and campuses
Handling an incident inside a year group
Attorneys
Locating a host to serve process on
Victim advocates
Sequencing filings around a safety plan
Employers and unions
Supporting a staff member who was targeted
The deliverable is identical every time: a complete location list, a dated capture log, the correct entity and address to serve, and a file somebody with authority can act on. Never a suspect.
The free steps come first, and we will say so
Almost everyone who writes to us about this can do the most valuable parts without paying anybody, and we will point you at them before we quote for anything. If the whole of your case is a removal request and a hash submission, you will hear that in the first reply, at no charge. We would rather be the firm that told you the work was unnecessary than the one that billed for it.
Questions people ask us in the first day
Can you find out who posted the AI image of me?
No, and we decline that work rather than attempting it. The information that would answer the question sits with the platform, and a platform releases it on legal process or to law enforcement, not to a private firm or a private citizen. Anyone advertising otherwise is describing bought breach data, an impersonation, or a guess. The routes that genuinely can produce a name are a criminal investigation and a civil action in which your attorney asks a court for permission to take discovery from the platform before the defendant is named. What we can do is find the correct legal entity and service address behind a host, map everywhere the image has spread, and hand you a packet that a lawyer or a detective can act on.
Should I screenshot it before I report it?
If the person depicted is an adult, yes, and it is the most valuable ten minutes in the whole process, because reporting usually deletes the post and sometimes the account with it. Capture the full URL of the post and of the profile, any permanent numeric account identifier, the displayed date and time with a note of your time zone, the caption and visible replies, and every other place you have seen it. Screenshot the whole window with the address bar showing rather than cropping to the image, keep an untouched copy of each, and write down the date and time you captured them. If the person depicted is a minor, do not save copies at all; record the locations as text only.
Is it actually illegal to make an AI nude of someone?
Publishing one is a federal crime. The TAKE IT DOWN Act, Public Law 119-12, approved 19 May 2025, added a subsection to section 223 of the Communications Act that makes it unlawful to knowingly publish a “digital forgery” of an identifiable individual through an interactive computer service. For an adult, the elements are publication without consent, that what is depicted was not voluntarily exposed in a public or commercial setting, that it is not a matter of public concern, and that publication was intended to cause harm or in fact caused harm, expressly including psychological, financial or reputational harm. For a minor there is no harm element at all, only intent to abuse, humiliate, harass or degrade, or to arouse or gratify sexual desire. Penalties run to two years for an adult and three for a minor. Merely threatening to publish is a separate offense.
What is the difference between StopNCII and Take It Down?
Age, and it is a hard line rather than a preference. StopNCII.org is for people who were eighteen or over in the image. Take It Down, run by the National Center for Missing and Exploited Children, is for people who were under eighteen when it was made. Both work the same way: a short digital fingerprint, called a hash, is computed from the file and shared with participating platforms so they can match and block re-uploads, rather than the picture itself being sent around. Read each service’s own eligibility page before starting, because submitting to the wrong one costs you days. We name them here rather than linking them because this site links only to government and university sources.
The image is of my child. What do I do first?
Do not download it, do not forward it, and do not put it in a shared folder, even to send to a lawyer. Under section 2256 of title 18, a depiction created, adapted or modified to appear that an identifiable minor is engaged in sexually explicit conduct falls within the federal definition of child pornography, and section 2252A expressly removes the “no actual minor was used” defense for exactly that category. Instead write down the URLs, the account name, the timestamps and the caption as text, call your local police, file a report with the CyberTipline, and tell the school in writing the same day. Reporting has a hidden benefit here: under section 2258A, a provider’s CyberTipline report is treated as a request to preserve the reported contents for ninety days, along with data that may give context about the material or the person.
Will a reverse image search tell me who made it?
Almost never, but run it anyway for a different reason. What it reliably produces is a map of where else the same file is sitting, which is exactly the list your removal requests and your hash submission need in order to be complete rather than partial. It does not name a poster. And where an image was generated rather than copied, there may be no earlier appearance to find at all, so treat an empty result as information about the image’s origin rather than as a failure. The same goes for metadata: platforms usually strip it on upload, and even a surviving provenance signal identifies the tool that made the picture, not the person who typed the prompt.
Do I have to pay a removal company?
No. The most effective steps are free. The written removal request to the platform is a statutory right, the hash services cost nothing, the complaint to the Federal Trade Commission about a non-compliant platform costs nothing, and a police report costs nothing. Paid services rank highly on this topic because it is a distressing search with commercial value, not because they hold powers you lack. Before paying anyone, ask them to name the exact mechanism they intend to use and what it would cost you to use it yourself. If they cannot answer that in one sentence, you are being sold the panic rather than the remedy.
I sent a valid request and the platform ignored it. Now what?
Complain to the Federal Trade Commission, which enforces the removal duty and began doing so on 19 May 2026 through a dedicated portal at takeitdown.ftc.gov. Its consumer guidance confirms you can report a platform that failed to remove within forty-eight hours of a valid request, and equally one whose removal process you cannot find or which does not work. You can file for yourself, for your child, or for another person with their permission. Before you file, re-read your original request against the statutory four parts, because a request missing your signature, enough information to locate the depiction, a good-faith statement that it is nonconsensual, or your contact details may never have started the clock.
Send us the list of links, not the images
Give us the URLs and what you have already tried, and you will get back a written assessment of which of the free routes applies to your facts, where the image has spread beyond what you found, and which entity a demand actually has to reach. If a minor is involved, say so in the first line and we will point you straight at the reporting route instead. Not sure it is worth asking? Put the question to a researcher and you will have a straight answer within 24 hours.
Get the removal packet built
