Your face is on something you never shot. Here's the actual workflow.

I'm not a lawyer and this isn't legal advice. This is a workflow — the sequence of things I'd actually do, in order, on the day it happens — assembled from public tools and public law. If there's real harm or real money in your situation, that's a lawyer conversation.

A while back I wrote that you can strike a bad AI clause but you can't strike a deepfake. That post was about ownership: whether your face is yours, what a contract can and can't sign away, where the law was heading.

It didn't tell anyone what to do on the day it happens. That's this post.

First, sort the problem. The tools are different.

Almost everyone who lands here has one of two problems, and reaching for the wrong tool wastes the week that matters most.

Your content was stolen. You shot it, you published it, someone ripped it and reposted it on a tube site. This is piracy. It's a copyright problem, and the tool is a DMCA takedown — I've written the DIY version of that separately, and it works, and it's not what this post is about.

Your face was used in something you never shot. A face-swap. A synthetic clip. A still of you pasted onto a body that isn't yours. You don't own the copyright in that video — someone else made it — so DMCA is a bad fit and often just bounces. This is non-consensual intimate imagery, and it has its own machinery.

Sorting these two takes ten seconds and saves you from spending a month sending the wrong notices to platforms that were never going to act on them.

The hash tool: StopNCII

StopNCII.org is the piece most performers don't know exists, and it's the one I'd reach for first on a face-swap.

Here's the part that matters and that people get wrong: you don't upload the image. The tool generates a hash — a digital fingerprint — on your own device, and only that fingerprint gets shared with participating platforms. The original never leaves your machine. I want to be blunt about that because the single biggest reason performers don't use it is a completely reasonable fear of handing intimate material to yet another database. That isn't what happens.

The platforms then match that fingerprint against what gets uploaded to them, and pull matches.

What you need to know before you spend the evening on it:

• You have to be the person in the image, and 18 or over in it.
• It explicitly covers manipulated images and deepfakes, not just real photos. That's the whole reason it's on this list.
• It works globally.
• It only reaches participating platforms. It is not a sweep of the internet, and anyone telling you otherwise is selling something.
• Hash matching is literal. A cropped, filtered, or re-encoded version can slip the match. Expect to re-submit variants.

That last limitation is real and it's the honest ceiling on this tool. It is not a magic delete button. It is a very good, very cheap first move that costs you an hour and quietly stops a whole category of re-uploads you'd otherwise be chasing one at a time forever.

The federal rule that went live this year

The TAKE IT DOWN Act was signed in May 2025 and gave platforms one year to build the machinery. That deadline — May 19, 2026 — has now passed, which means as of this summer the obligations are live, not theoretical.

What it actually gives you:

Covered platforms have to run a removal process you can use. On a valid request, they have 48 hours to take the content down. They also have to find and remove identical copies — which is the sleeper provision, because the copy-whack-a-mole is what grinds people down. Enforcement sits with the FTC, which treats non-compliance as an unfair or deceptive practice, with civil penalties per violation that are large enough for a platform's legal team to care.

A valid request generally needs: your signature (electronic is fine), enough information for them to actually find the content, a good-faith statement that it's non-consensual, and your contact details.

Read that list again and notice what it means practically: the request is a form, not a lawsuit. You can send it yourself, today, without paying anyone.

The workflow, in the order I'd run it

Document before you do anything else. URLs, screenshots, timestamps, the account that posted it, the account's other posts. Do this first, because your next moves are designed to make the content disappear, and disappeared content is hard to evidence later if this turns into something bigger.

Sort it. Stolen scene, or invented one? That decides everything downstream.

Hash it. If it's synthetic or non-consensual, run it through StopNCII before you start hand-sending notices. Set the trap before you start chasing, because the trap keeps working while you sleep.

Send the platform notice. Use the platform's own NCII removal flow — post-May-2026 they're required to have one, and it's now a much shorter path than it used to be. 48 hours is their clock. Note when it starts.

Escalate on the clock, not on the feeling. If 48 hours pass on a valid request to a covered platform, that's not a disappointment, that's a compliance failure with a federal regulator attached. Say so, in writing, calmly. Platforms respond to a person who is visibly counting.

Then go after distribution, not just copies. The search result, the aggregator, the reupload account. The video is the symptom.

What I'd tell you honestly

None of this makes it not have happened. I want to be careful not to sell a workflow as a cure, because getting the video down doesn't undo the fact that it existed.

And I'm still not a lawyer. Everything above is a sequence of public tools and public processes, not a legal strategy — if there's real harm or real money in this, the workflow is what you run while you're getting someone properly qualified on the phone, not instead of it.

But the difference between someone who has a sequence and someone who doesn't is enormous, and it's mostly a difference in the first 48 hours. Having the order written down before you need it — sort, document, hash, notice, clock, escalate — is what keeps you from spending that window frozen, or spending it sending DMCA notices about a video you don't own the copyright to.

Bookmark it now. That's the whole point of it existing.

— Sly