Glossary

Images or videos created or altered using artificial intelligence to depict a real person in a nude, sexually explicit, or intimate context. When created or shared without the depicted person’s consent, this may be considered image-based sexual abuse (IBSA) or non-consensual intimate imagery (NCII) (these terms are interchangeably used), even when the depicted sexual activity never actually occurred.

Information based on a person’s unique physical or biological characteristics that can be used to identify or recognize them. Examples may include facial features, fingerprints, voice patterns, or iris scans.

A temporarily stored copy of online content that allows a browser, search engine, or other service to retrieve information more quickly. Cached content may sometimes remain accessible for a period of time even after the original webpage or file has been changed or removed.

Luring someone into a relationship using a fake online identity, often to scam them. In IBSA it is usually the front end of sextortion: a fabricated profile builds trust, obtains images, and the demands begin. Recognizing that the whole relationship was constructed for that purpose is often the moment a person stops blaming themselves.

Images, videos, or other visual material depicting the sexual abuse or sexual exploitation of a child. The term CSAM is preferred over “child pornography” because children cannot consent to their sexual exploitation, and the material documents or depicts abuse rather than consensual pornography.

Criminal and civil tracks run independently. A prosecutor can decline to charge and you can still sue. You can also sue after a conviction. The standards of proof differ: criminal cases require proof beyond a reasonable doubt, civil cases generally require only a preponderance of the evidence — meaning more likely than not. In IBSA cases the main routes are the federal civil remedy at 15 U.S.C. § 6851, a copyright claim if you took the image yourself, a state statutory claim, or common-law privacy torts. One important limit: Section 230 generally blocks civil claims against the platform for content a user posted, so most civil actions target the person who created or distributed the images.

This activity involves the swapping and/or collection of nonconsensually distributed sexually explicit material from text/messaging groups or third-party Internet platforms for private or member-only collections. Collections can become a form of “social currency” among traders, and collectors may “target” specific individuals by working collectively with others to obtain sexually explicit materials of targeted persons. Collectors are not necessarily creators of IBSA material.

Computer-generated IBSA is sexually explicit or sexualized material generated using any computer technology. It can range from material created by standard software programs (e.g., Photoshop) to machine learning, artificial neural networks, and other AI-related technology. AI-generated IBSA involves the use of AI-related technology to generate forged or “new” pornography from existing material. Currently there are two main categories of AI-generated IBSA: 1) forged pornography created by either superimposing an innocuous image of an identifiable person into pre-existing pornography so that one or more persons originally in the pornography are “replaced” with the image of another person, or by the use of “nudifying” apps which strip images of clothed, identifiable persons of their clothing, and 2) AI-generated pornography which utilizes massive collections of images of people scraped from the Internet and AI-related technology to create “new” pornography typically depicting an unidentifiable, AI-generated “person” but which may generate identifiable persons. AI-Generated Forged Pornography: The forging of pornography, to depict people who have not been filmed or photographed for pornography as if they had, has been practiced for centuries. However, given the limitations of technology, such materials were previously detectable as forgeries. Now, modern advances based on the use of “deepfake” technology yield hyperrealistic images that make detection of AI-generated IBSA exceedingly difficult if not impossible. By utilizing what is popularly referred to as “deepfake” technology, users may swap images of any person they wish into an existing pornography scene. Thus, people who have not participated in recordings of pornographic acts are technologically sex trafficked into pornography. Many women celebrities, journalists, and politicians have suffered this form of IBSA, and increasingly women (and children) who are not famous are also becoming targets of this form of IBSA. In addition to “swapping,” AI-related technology allows for the nudification of clothed persons. Nudifying technology strips images of clothed people so that they appear to be partially or fully naked. Research released in 2023 reported that 98% of AI-generated forged images are of pornography and that 99% of this pornography depicts women. The appropriation of a person’s image or likeness for the unauthorized production of sexual materials is a form of identity theft, fraud, and sexual violence. It constitutes public sexual humiliation and sexual assault. AI-Generated New Pornography: By utilizing massive collections of sexually explicit and other images of people scraped from social media, pornography, and other websites (or related metadata obtained via other technology), AI-related technology can be used to create “new” pornography featuring computer-generated “persons.” Such material is formulated based on the training the AI model receives from harvested images of real persons—all obtained without the consent or knowledge of the individuals depicted in the images used for training purposes. In some cases, the datasets used to train AI models are known to have utilized material depicting rape (e.g., pornography of sex trafficking victims), other non-consensually distributed sexually explicit material, and/or CSAM. AI-models are frequently used to generate pornography of presumably unidentifiable “people.” However, female celebrities and influential women (reporters, journalists, politicians) have been identifiable victims of AI-generated new pornography because of the vast amounts of visual content depicting these women online. AI-generated pornography perpetrates IBSA on a massive scale by its dependence on nonconsensually obtained material in AI training datasets.

A distributed network of servers that helps websites deliver content to users quickly and reliably by storing or transmitting copies of content from locations closer to the user. CDNs generally do not create the content they deliver, but they can form part of the technical infrastructure through which online content is made accessible.

Moderation combines automated detection (hash matching, classifiers) with human review, applied against a platform's own written policies. Two things worth understanding as a person reporting: a platform enforces its policies, which may be narrower or broader than the law, and most first-pass decisions are automated. This is why a report that is refused can sometimes succeed on appeal or when resubmitted with clearer evidence that the person depicted is you and did not consent.

A form of legal protection given to creators or other copyright owners for original works, including photographs and videos. Copyright can provide the owner with certain exclusive rights over how a work is copied, distributed, displayed, or otherwise used. In some circumstances, copyright law can provide a pathway for requesting removal of unauthorized copies of intimate imagery.

This applies to the copyright route specifically. Under 17 U.S.C. § 512(g), if you send a DMCA takedown and the uploader files a counter-notification, the platform must restore the material not less than 10 nor more than 14 business days later — unless you first file a court action. Two things to know before choosing the DMCA route: a counter-notice requires the uploader to provide their name, address, and consent to court jurisdiction, which is sometimes how an anonymous poster gets identified; but your own contact information is disclosed to them in the process, and stopping restoration means going to court on a two-week clock. Platform NCII removals are a separate track with their own appeals and no statutory restoration deadline.

Under the TAKE IT DOWN Act, a covered platform is a public-facing website, online service, or app that primarily provides a forum for user-generated content, or that regularly publishes non-consensual intimate imagery in the ordinary course of business. The definition is broad. The FTC has stated it reaches gaming sites and message forums, not just major social networks. It excludes broadband providers, email, and services where interactive features are incidental to preselected non-user content.

Section 66A of the Sexual Offences Act 2003, inserted by the Online Safety Act 2023 and in force since January 31, 2024, criminalizes sending a photograph or film of genitals with intent to cause alarm, distress, or humiliation, or for sexual gratification with recklessness as to those effects. In the US, coverage is state by state. It is frequently dismissed as trivial, is extremely common, and is often the opening move in a longer pattern.

Section 2261A(2) covers using an interactive computer service or electronic communication system, with intent to kill, injure, harass, intimidate, or place under surveillance, in a course of conduct that causes or would reasonably be expected to cause death, serious bodily injury, or substantial emotional distress. It is frequently charged in IBSA cases involving sustained campaigns, but it is not an NCII-specific statute and it requires a course of conduct — a single posting generally will not qualify.

Operated by the National Center for Missing & Exploited Children. Electronic service providers are legally required to report to it; the public can report voluntarily. In 2025 it received 21.3 million reports covering 61.8 million files, including more than 170,000 reports from the public and over 5,700 submitted directly by the young person depicted. More than 53,000 reports were escalated as urgent. NCMEC issued 172,000 removal notices with an average takedown time of 2.6 days. Sextortion reports exceeded 50,000 — about 137 a day — up from 36,000 in 2024. Report at report.cybertip.org

This is often the single highest-impact step, because most real-world harm comes from someone searching your name and finding the images, not from someone browsing the host site directly. Google removes URLs showing non-consensual explicit imagery from Search, covering both real images and AI-generated sexual content of identifiable people, and cases where someone's name has been falsely associated with a porn site. What it does not do: the content still exists on the web, and can still be reached through a direct link, a social post, or another search engine. It does not delete the file or notify the host.

In US law the precise term is now digital forgery, defined in the TAKE IT DOWN Act.

To keep its DMCA safe harbor, a service must register a designated agent with the US Copyright Office and publish the contact information on its site. Notices sent to a general support inbox may not start the legal clock. The Copyright Office maintains a searchable public directory, which is frequently the fastest way to find a real contact for an otherwise unresponsive site.

The everyday word for a hash. This is the foundation of privacy-preserving removal: because the fingerprint cannot be reversed back into a picture, your images never have to be handed over or viewed by staff at any company in order to be blocked.

Defined in the TAKE IT DOWN Act as any intimate visual depiction of an identifiable individual created through software, machine learning, artificial intelligence, or other computer-generated means — including adaptations or manipulations of authentic images — that appears indistinguishable from a genuine image to a reasonable person. This is now the precise legal term in the United States. It is more accurate than "deepfake porn," and using it signals that the harm is recognized in statute, not just in advocacy language.

Regulation (EU) 2022/2065. Article 16 requires hosting providers to operate easy-to-access electronic notice-and-action mechanisms open to any individual or entity. Notably, notices normally require the reporter's name and email, but there is an express exemption for notices concerning non-consensual intimate imagery offences, so survivors are not forced to identify themselves. A sufficiently precise notice gives the platform actual knowledge, which removes its liability shield. Article 17 requires a statement of reasons for the decision, Article 20 an internal complaint system, and Article 21 access to out-of-court dispute settlement. One thing to know before filing: Article 16 requires the reporter's name and email address. The only exemption is for notices involving child sexual abuse offences. An adult reporting their own images under the DSA cannot do so anonymously, which is a real consideration if the person who posted them may see the notice.

This matters enormously in IBSA, where images often surface years after they were taken or first shared. Where the discovery rule applies, the clock starts when you reasonably discovered or should have discovered the disclosure. Whether it applies depends on the claim and the state. A related question with no uniform answer: whether each new re-posting restarts the clock. This is unsettled and jurisdiction-dependent, which is one reason to consult a lawyer early rather than assume a deadline has passed.

The Digital Millennium Copyright Act's notice-and-takedown process requires an online service to remove infringing material expeditiously to keep its safe harbor from liability. A valid notice must identify the work, give the exact URL, include your contact information, state a good-faith belief that the use is unauthorized, and be made under penalty of perjury. Why this works when other routes stall: Section 230 has an express carve-out for intellectual property, so copyright claims reach platforms in a way most other claims do not. Three honest limits: it only works when you took the image (a selfie), because otherwise you are not the copyright owner; the uploader can file a counter-notice that forces the content back online in 10–14 business days; and filing requires disclosing your contact information to the person you are complaining about. DMCA is a supplement to NCII or IBSA-specific channels, not a substitute.

The intentional online exposure of an individual's identity, private information, or personal details without their consent. In IBSA cases doxxing frequently travels with the images — a name, employer, and city posted alongside them, which is what converts a posting into a targeted campaign and drives real-world harm.

Entered into force June 13, 2024, with a transposition deadline of June 14, 2027 — meaning national implementations are still in progress and vary across member states as of 2026. Article 5 criminalizes making intimate material publicly accessible without consent where it is likely to cause serious harm; producing, manipulating, or altering material to make it appear a person is engaged in sexual activity and making it publicly accessible (expressly covering deepfakes); and threatening to do either in order to coerce. Articles 6–8 cover cyber stalking, cyber harassment, and cyber incitement. Article 23 allows judicial authorities to order prompt removal or disabling of access to material relating to these offences.

Content gets removed, reuploaded elsewhere, or deleted by hosts before anyone can document it, and hosts purge the IP logs that identify who posted it. The Cyber Civil Rights Initiative advises: save webpages as PDFs; screenshot the entire screen including the URL, date, and time (a cropped screenshot of just the image has far less evidentiary value); download full videos to secure storage; save all related emails and messages; keep organized printouts; and send preservation letters to platforms asking them to retain identifying data before retention windows expire. Two things people get wrong. First: preserve everything, including material that seems unhelpful to your case. Selectively destroying evidence can result in legal sanctions. Second: if you are living with the person who did this, think about where you store it before you start. You do not have to look at all of it yourself. A trusted person, an advocate, or a service can document on your behalf.

The original "deepfake" or forgery technique, and still distinct from full generation often used with AI. In a face swap, real footage of sexual acts exists underneath — which is legally and practically different from an image generated from nothing but a clothed photo. Both are covered by the TAKE IT DOWN Act's "digital forgery" definition, which is deliberately drafted to reach adaptations and manipulations of authentic material as well as wholly synthetic output.

The Act treats a platform's failure to maintain a compliant notice-and-removal process as an unfair or deceptive act or practice under the FTC Act. The FTC began enforcement in May 2026, launched a complaint portal at TakeItDown.ftc.gov, and sent compliance letters to major platforms. Reported civil penalty exposure is $53,088 per violation. Important limit for survivors: the Act gives you no private right of action against a platform. If a platform misses the 48-hour deadline, your route is an FTC complaint, not a lawsuit against the platform.

With a cryptographic hash such as SHA-256, changing a single bit produces a completely different output. That property is valuable in security, and nearly useless for image removal, because simply re-uploading a photo through a different app changes the file. This is the contrast that explains why perceptual hashing exists.

Open-sourced by Meta in August 2019 through ThreatExchange, alongside a companion video algorithm, TMK+PDQF, developed with Meta's AI research team and academics at the University of Modena and Reggio Emilia. Its significance is that it is free and open, so smaller platforms can implement matching without licensing proprietary technology — one of the few places where the infrastructure of removal is genuinely widely available.

Matching works by measuring the distance between two hashes against a threshold, rather than requiring an exact match. That tolerance is what makes real-world removal possible, since almost every copy circulating online has been re-encoded at least once. The trade-off is that a threshold loose enough to catch edited copies also produces occasional false matches, which is why platforms pair hash hits with review.

Developed by Microsoft with Hany Farid's lab at Dartmouth College in 2009 and donated to the National Center for Missing & Exploited Children. It generates a robust signature for an image and compares it against databases of previously identified CSAM. It is not facial recognition, and the signature is not reversible as an image cannot be reconstructed from it. Licensed free to qualified tech companies, nonprofits, and law enforcement. It is a CSAM tool specifically.

The image is converted into a hash. Only the hash is shared. Platforms compare uploads against a list of hashes and block matches. The image itself never leaves your possession. It only works on participating platforms where hash lists are shared through voluntary programs, not universally. An image that has been meaningfully edited — cropped hard, filtered, clipped from a video — produces a different hash and may need to be hashed separately. Even so, matching survives the common transformations (resizing, re-compression, minor edits) that defeat simpler methods.

The sexual violation of a person committed through the abuse, exploitation, or weaponization of any image depicting the person. As an umbrella term, IBSA encompasses a wide range of abusive activities including the creation, manipulation, theft, extortion, threatened or actual distribution, or any use of images for sexual purposes without the meaningful consent of the person/s depicted or for purposes of sexual exploitation. It also includes sexual violence or harassment committed towards a person’s representation (e.g., a person’s avatar) in virtual reality or online gaming. Also known as NCII (non-consensual intimate images) or NCEI (non-consensual explicit images).

Importantly, sexually explicit and sexualized material depicting children ages 0–17 constitutes a distinct class of material, not to be confused with IBSA, known as child sexual abuse material (CSAM) (i.e., “child pornography”), which is illegal under US federal statute.

Under 15 U.S.C. § 6851 a federal court may grant injunctive relief in NCII or IBSA cases, including ordering removal. For many survivors this matters more than damages: a judgment for money is worth little against a defendant with no assets, while a court order backed by contempt power can actually stop distribution.

A photograph, video, or other visual depiction showing nudity, sexual activity, or private sexual or intimate areas of a person. Depending on applicable law or policy, the term may also include digitally created or altered depictions that realistically portray an identifiable person in an intimate or sexually explicit context.

"Leak" implies something escaped on its own. What actually happens is deliberate non-consensual distribution, often organized by name, school, town, or source platform. These sites frequently pair images with identifying details, which is what makes them a targeted harm rather than a hosting problem. The accurate description is a site trafficking in images shared without consent.

"Leak" describes something escaping on its own — a pipe, a document. It removes the person who made the decision to share. Images do not leak. Someone distributes them, deliberately, usually with an understanding of the harm it will cause. The term appears constantly in headlines, on hosting sites, and in search queries, which is why it is defined here. What actually happened has a name: non-consensual distribution and abuse.

Information associated with a digital file or piece of online content that describes the file or provides information about its creation, modification, or use. Metadata can include information such as file type, creation date, modification date, device information, dimensions, or other technical details. Some metadata may be altered, removed, or unavailable when content is uploaded to an online platform.

Mirrors are often automated, so removal at one address can be followed within hours by the same content at another. Each mirror generally requires its own takedown notice. This is the structural reason that one-time removal is not a solution and proactive blocking, such as hashing, de-indexing, monitoring, matters more than any single successful takedown.

NCII is an operational term — statutes, platform policies, hashing services, and regulators all use it. IBSA or image-based sexual abuse is the umbrella term for the abuse itself, and the one that centers the harm rather than the file. A note on "intimate": the word implies closeness and consent. For someone whose likeness was fabricated by AI, or whose assault was recorded without their knowledge, that framing often feels wrong. We use "images shared or created without consent" in our own voice, and "NCII" where statutory or platform language requires it, which is most removal contexts. Related acronyms you will encounter: NDII (non-consensual distribution of intimate images) and NCP (non-consensual pornography, now less used) and NCEI (non-consensual explicit images).

The sharing or online posting of sexually explicit or sexualized images or videos of another person without their meaningful consent. This includes, but is not limited to, the distribution of sexual images initially created and exchanged consensually in the context of a romantic relationship, but subsequently redistributed by the recipient to others such as by forwarding to friends, posting on social media sites, or uploading to pornography websites without the permission of the person depicted (commonly referred to as “revenge pornography”). It also includes distribution of nonconsensually created material, such as recordings of sexual assault and rape or AI-generated images. Such images or videos may be shared in their original unaltered form, or in edited formats (e.g., blurring the face of one individual but not another; placing emojis on the faces of people depicted). In many cases, the material is distributed with the intention of causing mental anguish and reputational harm to the victim, or even to provoke the victim to commit self-harm or suicide. “Doxxing,” the sharing of personally identifying information such as a person’s name, address, and workplace, frequently accompanies nonconsensual distribution of sexually explicit material.

The mechanism is image-to-image generation where a diffusion model synthesizes a body in place of clothing. A single photo from a public social account is enough input, which is what makes this a risk for people who have never taken or shared an intimate image in their lives.

Section 188 inserted sections 66B–66D into the Sexual Offences Act 2003, creating four offences: intentionally sharing an intimate image without consent; sharing with intent to cause alarm, distress, or humiliation; sharing for sexual gratification; and threatening to share. These cover "purported" images — deepfakes — and came into force January 31, 2024. Separately, section 66A (inserted by the same Act, in force January 31, 2024) criminalizes cyberflashing. Ofcom regulates platform duties: illegal content safety duties came into force March 17, 2025, and protection-of-children duties requiring "highly effective age assurance" came into force in July 2025. In May 2026 Ofcom strengthened its Illegal Content Codes to recommend automated hash-matching to detect and block non-consensual intimate images including explicit deepfakes; that change is expected to come into force in autumn 2026.

Platforms purge logs on a schedule, often within weeks or months. Once the log is gone, the trail to an anonymous uploader is usually gone with it. A preservation letter sent early, even before you have a lawyer or a case, can be the difference between identifying a perpetrator and never knowing who it was.

The taking pictures or creating videos of another person’s sexual assault or rape. Recorded sexual violence often depicts persons who have been drugged or who are incapacitated, as well as sex trafficking victims who are subjected to serial rape by their sex traffickers and buyers. Such recordings are typically shared with others, and in some cases, are distributed on Internet platforms, commonly mainstream pornography websites.

Distinct from a civil judgment (which requires you to sue) and from victim compensation (which comes from a state fund). Restitution is ordered by the criminal court against the defendant, and can cover documented losses such as counseling costs, lost wages, and removal expenses. It depends on there being a conviction, and collecting on it depends on the defendant having assets.

The core reason removal alone does not end the harm. Reuploads are why hash matching, ongoing monitoring, and proactive filtering matter more than the outcome of any single takedown, and why services are measured by what they do over months rather than by a first sweep.

We define it here because it is what most people search, and because correcting it is worth doing. "Revenge" implies the person did something to provoke it — that there is a grievance being answered. That is victim-blaming built into a phrase. It is also empirically wrong about motive: a large share of distribution is driven by financial gain, social status among other men, entertainment, or nothing personal at all. Much of it is committed by strangers, hackers, scrapers, and organized criminal groups with no relationship to the person at all. "Porn" implies content produced and shared consensually for an audience. What is being described is abuse. The Cyber Civil Rights Initiative puts it directly: the word "revenge" suggests the survivor did something to cause the violation, and the phrase inappropriately places blame on the person harmed rather than the offender. Accurate alternatives: image-based sexual abuse (IBSA) for the category, non-consensual distribution of intimate images (NDII) or NCII for the specific act.

Under DMCA § 512, a service avoids liability for user-posted infringing material if it meets conditions including having a registered designated agent, lacking knowledge of the infringement, and removing material expeditiously on valid notice. Understanding this explains a great deal of otherwise baffling platform behavior: the system was designed to protect the intermediary, so a technically complete notice moves faster than a compelling one.

Scrapers pull images from social profiles, dating apps, school and workplace directories, and public photo sites at scale. Two distinct harms follow. First, scraped photos of a specific person become the raw material for a targeted model. Second, mass-scraped datasets become the training corpus for the generators themselves.

47 U.S.C. § 230(c)(1) provides that no provider of an interactive computer service shall be treated as the publisher or speaker of information provided by another. It has real carve-outs: federal criminal law (including child sexual exploitation offences), intellectual property law, the Electronic Communications Privacy Act, and the FOSTA-SESTA sex trafficking carve-out added in 2018. It also does not shield a platform for content the platform itself created. The TAKE IT DOWN Act did not create a Section 230 carve-out. It imposes an FTC-enforced regulatory duty instead. Core immunity is intact, which is precisely why a survivor cannot sue a platform for missing the 48-hour deadline. Section 230 has not been amended since 2018.

The use of sexual images to blackmail the person (or persons) depicted for the purpose of obtaining more sexually explicit material or money, coercion into in-person sex or sex trafficking, pressuring the person to stay in a relationship, or other benefits to the perpetrator. The sexual images may initially be shared consensually, may be obtained by theft (e.g., computer hacking), by alteration of nonsexual images of the person (i.e., forged pornography), or other means. Sexual extortion is popularly referred to as “sextortion.”

Sexual harassment and sexual violence occurring in online or technologically augmented environments in which two- or three-dimensional images are used to simulate a person, a character, or a persona within a game or forum and in which such images may interact with each other. In such cases a person’s “avatar,” the electronic representation of a person in a virtual environment, is sexually harassed or assaulted by another person’s avatar or by a nonplayable character.

The term covers cameras concealed in changing rooms, bathrooms, hotel rooms, short-term rentals, workplaces, and everyday objects, as well as phones used covertly in public. "Spycam" entered wider English use largely through reporting on South Korea's molka hidden-camera crisis. The recording is often only the first harm. Material captured this way is frequently uploaded to sites and forums trading in it, which turns a single act of surveillance into indefinite distribution and means removal work continues long after the camera is found.

Deadlines are short, jurisdiction-dependent, and easy to miss. Talk to a lawyer early rather than assuming you have run out of time or that you have plenty. Copyright claims run three years from accrual. State tort claims commonly run one to three years, varying by state and by tort. The federal civil remedy at 15 U.S.C. § 6851 contains no express limitations period, so courts borrow an analogous period — a genuinely unsettled area. Two doctrines can extend your window: the discovery rule and tolling for minors.

Built and operated by SWGfL, the UK charity that runs the Revenge Porn Helpline, originally developed jointly with Meta. You select the images on your own device; a hash is generated locally and only the hash is shared with StopNCII and participating companies. They don't proactively search for your content or help with takedown of existing content.

A neutral, descriptive umbrella term. It carries no implication about consent or harm, which is exactly why it is the wrong word for abuse: a synthetic image of a landscape and a synthetic sexual image of a real person are both "synthetic media." When the subject is a real, identifiable person and the content is sexual, the accurate terms are digital forgery (in US law) or AI-generated IBSA.

Operated by the National Center for Missing & Exploited Children. Same on-device model: the image stays on your device, only the hash is added to a secure list, and participating companies scan their public or unencrypted services against it.

Officially the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, Pub. L. 119-12, signed May 19, 2025. What it criminalizes (adding 47 U.S.C. § 223(h)(2)–(3)): knowingly publishing authentic intimate images of an adult without consent, or a digital forgery of an adult — up to 2 years. Intimate images of a minor, real or forged, published with intent to abuse, humiliate, harass, degrade, or for sexual gratification — up to 3 years. Threats to publish are also covered. Important for anyone assessing a case: the adult offence has further elements beyond lack of consent. The depiction must have been obtained or created in circumstances where the person had a reasonable expectation of privacy; what is shown must not have been voluntarily exposed in a public or commercial setting; it must not be a matter of public concern; and publication must be intended to cause harm, or actually cause psychological, financial, or reputational harm. The digital forgery offence carries parallel conditions. What it requires of platforms: covered platforms must offer a clear and conspicuous notice-and-removal process and, on a valid request, remove the image and identical copies as soon as possible and no later than 48 hours. The compliance deadline was May 19, 2026, and the obligation is in force now. The FTC enforces it. There is no private right of action against platforms.

The act of bullying or intimidating another person to create and share sexually explicit or sexualized images of themselves via forms of information communications technology (ICT). Such harassing and coercive activities may be carried out in person, via texting, comments or direct messages on social media platforms, or other technology-based forms of communication.

In most states the statute of limitations is paused until a survivor turns 18, meaning someone whose images were shared at 15 may still have a viable claim years later. Other tolling doctrines can apply where a defendant concealed their conduct or left the jurisdiction. Tolling rules are state-specific.

An umbrella term covering content and product policy, enforcement tooling, detection, and governance. The Trust & Safety Professional Association defines the function as the work of ensuring users are protected from harmful and unwanted experiences, and dates its emergence to roughly 1999–2010, with eBay an early adopter responding to fraud, scams, phishing, spam and malware. Scope has expanded steadily since.

There is no substantive difference between the terms. Treat "undressing app," "nudify app," and "nudification tool" as the same thing.

Upskirting is operating equipment or recording an image beneath a person's clothing to capture their genitals, buttocks, or underwear in circumstances where those would not otherwise be visible. Downblousing is capturing an image down a person's top or dress. Both are typically done in public — on transport, stairs, escalators, in queues, at events — where the person has no idea it is happening and often never finds out. United Kingdom (England and Wales). Upskirting is a specific criminal offence: section 67A of the Sexual Offences Act 2003, inserted by the Voyeurism (Offences) Act 2019 and in force since 12 April 2019. It covers two purposes — obtaining sexual gratification, or humiliating, alarming, or distressing the person — with a maximum of two years' imprisonment on indictment. Where the offence was committed for sexual gratification, conviction can lead to sex offender registration, subject to thresholds. The offence was extended in June 2022 to cover recording someone breastfeeding. Downblousing sits differently. Section 67A is limited to images taken beneath clothing, so it does not reach it. Sharing a downblouse image is an offence under section 66B of the Sexual Offences Act 2003, inserted by the Online Safety Act 2023 and in force since 31 January 2024. A dedicated offence of taking such an image — new section 66AB, via Schedule 13 of the Crime and Policing Act 2026 — has been enacted but is not yet in force. United States. There is no general federal upskirting law. The Video Voyeurism Prevention Act of 2004 (Pub. L. 108-495, codified at 18 U.S.C. § 1801) criminalizes intentionally capturing an image of a person's private area without consent where they had a reasonable expectation of privacy — but it applies only within the special maritime and territorial jurisdiction of the United States: federal enclaves, military installations, federal buildings and lands, US-flagged vessels and aircraft. It does not reach conduct in a shopping mall, gym, or short-term rental. It is a misdemeanor, maximum one year. The Act does contain a definition worth knowing, because it answers the argument perpetrators most often make. A "reasonable expectation of privacy" includes circumstances where a reasonable person would believe a private area of their body would not be visible to the public, regardless of whether that person is in a public or private place. Being in public is not consent. In practice, upskirting in the US is prosecuted under state voyeurism and unlawful surveillance statutes. Nearly all states have some form of these, but coverage of images taken in public places varies significantly, and some older statutes were drafted around a private-place requirement that upskirting defeats.

Federal VOCA money is distributed by the Office for Victims of Crime, but each state and territory runs its own program and sets its own eligibility rules. You apply to the program in the state where the crime occurred. Covered expenses commonly include medical costs, mental health counseling, and lost wages. Eligibility for IBSA specifically varies and is not guaranteed. It typically turns on whether the conduct is a crime in that state, whether you reported to law enforcement and cooperated, and whether the expense claimed is a covered category. Counseling is the most plausible route. Check with your state's program rather than assuming.

The surreptitious recording of images or videos of clothed people while engaged in public activities in order to obtain images of their private body parts (e.g., “down blousing,” and “upskirting”) or the recording of persons engaged in private activities (e.g., changing clothes, using the toilet or showering, having sex in private) without their knowledge. This form of IBSA is often referred to popularly as “spycamming”

Enacted March 15, 2022 as part of the Violence Against Women Act Reauthorization, and often called the federal "Cyber Civil Rights" provision. You may sue where your intimate visual depiction was disclosed without consent and the person knew or recklessly disregarded that you did not consent. Available: actual damages or liquidated damages of $150,000, plus attorney's fees and litigation costs. Courts may grant injunctive relief including ordering removal, allow pseudonymous filing, and issue protective orders. It currently reaches authentic images and it contains no express statute of limitations, so the filing deadline is unsettled. Exceptions include commercially produced pornography (unless produced by force or fraud or coecion), good-faith disclosures to law enforcement or in legal proceedings, matters of legitimate public concern, and disclosures reasonably intended to assist the person depicted.

Covered platforms must remove the depiction and make reasonable efforts to identify and remove identical copies as soon as possible, and no later than 48 hours after a valid request. In force since May 19, 2026, enforced by the FTC. The UK has a parallel 48-hour duty under the Crime and Policing Act 2026, in force since June 29, 2026. What this does not give you: a right to sue the platform if it misses the deadline. Section 230 still shields platforms from liability for user content; the route is an FTC complaint. Note also that the duty covers known identical copies. An edited, cropped, or re-encoded copy is not identical, which is why hash-matching services still matter.