Your face is on something you never shot. Here's the actual workflow.

I'm not a lawyer and this isn't legal advice. This is a workflow — the sequence of things I'd actually do, in order, on the day it happens — assembled from public tools and public law. If there's real harm or real money in your situation, that's a lawyer conversation.

A while back I wrote that you can strike a bad AI clause but you can't strike a deepfake. That post was about ownership: whether your face is yours, what a contract can and can't sign away, where the law was heading.

It didn't tell anyone what to do on the day it happens. That's this post.

First, sort the problem. The tools are different.

Almost everyone who lands here has one of two problems, and reaching for the wrong tool wastes the week that matters most.

Your content was stolen. You shot it, you published it, someone ripped it and reposted it on a tube site. This is piracy. It's a copyright problem, and the tool is a DMCA takedown — I've written the DIY version of that separately, and it works, and it's not what this post is about.

Your face was used in something you never shot. A face-swap. A synthetic clip. A still of you pasted onto a body that isn't yours. You don't own the copyright in that video — someone else made it — so DMCA is a bad fit and often just bounces. This is non-consensual intimate imagery, and it has its own machinery.

Sorting these two takes ten seconds and saves you from spending a month sending the wrong notices to platforms that were never going to act on them.

The hash tool: StopNCII

StopNCII.org is the piece most performers don't know exists, and it's the one I'd reach for first on a face-swap.

Here's the part that matters and that people get wrong: you don't upload the image. The tool generates a hash — a digital fingerprint — on your own device, and only that fingerprint gets shared with participating platforms. The original never leaves your machine. I want to be blunt about that because the single biggest reason performers don't use it is a completely reasonable fear of handing intimate material to yet another database. That isn't what happens.

The platforms then match that fingerprint against what gets uploaded to them, and pull matches.

What you need to know before you spend the evening on it:

• You have to be the person in the image, and 18 or over in it.
• It explicitly covers manipulated images and deepfakes, not just real photos. That's the whole reason it's on this list.
• It works globally.
• It only reaches participating platforms. It is not a sweep of the internet, and anyone telling you otherwise is selling something.
• Hash matching is literal. A cropped, filtered, or re-encoded version can slip the match. Expect to re-submit variants.

That last limitation is real and it's the honest ceiling on this tool. It is not a magic delete button. It is a very good, very cheap first move that costs you an hour and quietly stops a whole category of re-uploads you'd otherwise be chasing one at a time forever.

The federal rule that went live this year

The TAKE IT DOWN Act was signed in May 2025 and gave platforms one year to build the machinery. That deadline — May 19, 2026 — has now passed, which means as of this summer the obligations are live, not theoretical.

What it actually gives you:

Covered platforms have to run a removal process you can use. On a valid request, they have 48 hours to take the content down. They also have to find and remove identical copies — which is the sleeper provision, because the copy-whack-a-mole is what grinds people down. Enforcement sits with the FTC, which treats non-compliance as an unfair or deceptive practice, with civil penalties per violation that are large enough for a platform's legal team to care.

A valid request generally needs: your signature (electronic is fine), enough information for them to actually find the content, a good-faith statement that it's non-consensual, and your contact details.

Read that list again and notice what it means practically: the request is a form, not a lawsuit. You can send it yourself, today, without paying anyone.

The workflow, in the order I'd run it

Document before you do anything else. URLs, screenshots, timestamps, the account that posted it, the account's other posts. Do this first, because your next moves are designed to make the content disappear, and disappeared content is hard to evidence later if this turns into something bigger.

Sort it. Stolen scene, or invented one? That decides everything downstream.

Hash it. If it's synthetic or non-consensual, run it through StopNCII before you start hand-sending notices. Set the trap before you start chasing, because the trap keeps working while you sleep.

Send the platform notice. Use the platform's own NCII removal flow — post-May-2026 they're required to have one, and it's now a much shorter path than it used to be. 48 hours is their clock. Note when it starts.

Escalate on the clock, not on the feeling. If 48 hours pass on a valid request to a covered platform, that's not a disappointment, that's a compliance failure with a federal regulator attached. Say so, in writing, calmly. Platforms respond to a person who is visibly counting.

Then go after distribution, not just copies. The search result, the aggregator, the reupload account. The video is the symptom.

Update — September 2026: what enforcement actually looks like

I wrote the section above three months into the new rule and framed it as obligations that are "live, not theoretical." That's still true, and it's also incomplete in a way worth correcting: required and enforced are not the same word.

The FTC has built the intake, not the case law. There is now a victim complaint portal at TakeItDown.ftc.gov. Per its own press releases, the Commission sent reminder letters to fifteen major platforms and warning letters to twelve providers of AI "nudify" tools, telling that second group they appear to be in violation for having no removal process at all, with civil penalties available in the tens of thousands of dollars per violation. What has not happened, as far as I can find, is a single announced fine, consent order, or lawsuit. So the honest status is warning letters and a complaint box, not a proven enforcement record. Plan your workflow as though the clock is real and the consequence is still being tested.

The most useful change for anyone in my line of work is StopNCII's partner list. When I wrote the hash section it read as a mainstream social-platform tool. It isn't any more. On StopNCII's published partner list, OnlyFans, Pornhub, xVideos, RedGIFs and FetLife now sit alongside the social networks. If you hash your material there, the block now reaches the sites where this content actually spreads for people who do what I do. That moves StopNCII from a decent first move to the clearly correct first move.

Copyright is still doing more work than the new rule. The uncomfortable practical finding is that a DMCA claim often produces faster removal than the purpose-built takedown process, because copyright infrastructure has had two decades to mature and this one has had months. If you shot the original, that route is open to you. Run both.

The 48-hour clock is narrower than I implied. It binds covered platforms responding to valid requests. It is not an internet-wide guarantee, and it does nothing about a site hosted somewhere that does not care about US law. That limitation was always true and my section could have said it plainly.

One more thing on the horizon rather than in force. The DEFIANCE Act, which would add a federal civil claim with statutory damages against people who make and spread this material, passed the Senate by unanimous consent in January 2026 and has been sitting in the House since. Passed one chamber is not law. I'm not a lawyer, and if this is happening to you right now, the workflow above is what you can actually use today.

What I'd tell you honestly

None of this makes it not have happened. I want to be careful not to sell a workflow as a cure, because getting the video down doesn't undo the fact that it existed.

And I'm still not a lawyer. Everything above is a sequence of public tools and public processes, not a legal strategy — if there's real harm or real money in this, the workflow is what you run while you're getting someone properly qualified on the phone, not instead of it.

But the difference between someone who has a sequence and someone who doesn't is enormous, and it's mostly a difference in the first 48 hours. Having the order written down before you need it — sort, document, hash, notice, clock, escalate — is what keeps you from spending that window frozen, or spending it sending DMCA notices about a video you don't own the copyright to.

Bookmark it now. That's the whole point of it existing.

— Sly