Finding your picture somewhere you never agreed to is stressful, and it is tempting to react immediately. A calm, ordered approach works better: document, report, escalate. Which route fits depends on who took the photo, where it was posted and where you live.
Step 1: Preserve evidence before you report#
- Take full-page screenshots showing the image, the account name, the caption and the date or time if visible.
- Copy the exact page URL and the profile URL into a document, with today's date.
- Save any messages or comments connected to the post.
- Do not confront the poster before you have saved everything; content is often deleted and re-uploaded.
- Keep the original file of your photo, with its metadata, if you took it. It can prove authorship.
If you do not yet know where your photos appear, our guide to finding them explains free tools and our own similarity search (match count first; the full report with links and a removal roadmap unlocks with 1 credit (packs from $9.90 / €9.90)).
Step 2: Report to the platform#
Every large platform has a reporting tool for privacy violations, impersonation or non-consensual content. Use the report option on the post itself, choose the reason that best matches (privacy, impersonation, intimate imagery, harassment) and attach your evidence if the form allows it.
| Platform | Route |
|---|---|
| Instagram and Facebook (Meta) | Report from the profile or post menu; non-users can use Meta's contact forms. See the Instagram impersonation guide. |
| TikTok | In-app report, or a web form for people without an account (select impersonation). |
| X | Impersonation reports are available in the Help Center and do not require an X account. |
| Report button on the content, plus a help-center form for impersonation. | |
| Websites and blogs | Find the contact page or the host through a WHOIS lookup, then email a removal request. |
Step 3: DMCA takedown for photos you took#
If you are the photographer, you own the copyright in most countries, even if you appear in the picture. In the United States, the DMCA (17 U.S.C. §512) lets a copyright owner send a notice to a service provider to remove infringing material. A valid notice must include a signature, identification of your work, the location of the infringing material, your contact details, a good-faith statement and a statement under penalty of perjury that you are authorized to act for the owner.
Most platforms publish a copyright reporting form or a designated agent address. Send one notice per service provider and keep a copy.
Step 4: GDPR erasure request (EU and UK)#
A photo of an identifiable person is personal data. Under Article 17 of the GDPR (and the UK GDPR), you can ask the organization that controls a website to erase it, for example when processing is unlawful, when you withdraw consent or when you object to the processing. The right is not absolute: it can be refused for reasons such as freedom of expression and information or legal claims.
- Find the right contact
Look for a privacy policy, a data protection officer address or a contact form on the site. Requests can be made verbally or in writing; writing gives you a record.
- Write a short request
Give the URL, explain that you are the person pictured, say that you did not consent, and ask for erasure under Article 17 GDPR. Do not send more personal data than needed to verify who you are.
- Wait for the deadline
Organizations generally must respond within one month, which can be extended by up to two further months for complex requests, as the UK ICO explains.
- Complain if ignored
If the operator refuses or does not answer, you can complain to your data protection authority, for example the ICO in the UK or your national authority in the EU.
Step 5: Remove it from search results#
Removing a link from Google does not delete the page, but it makes the page much harder to find. Google has dedicated request forms for non-consensual explicit imagery (including deepfakes), certain personal information and content on exploitative sites; copyright and court-order removals go through its Legal Help Center. Details are in our Google removal guide.
Step 6: Escalate when reports fail#
- Contact the hosting provider or domain registrar with the same evidence; abuse contacts are usually listed in WHOIS data.
- File a complaint with your data protection authority if a European or UK operator ignores an erasure request.
- Report to the police if there is harassment, extortion, threats or fraud.
- Contact a lawyer if damages are significant or the poster is identifiable.
Special cases: intimate images and minors#
If the image is intimate and shared without your consent, adults can use StopNCII.org: your device creates a hash (a digital fingerprint) of the image, and only the hash is shared with participating platforms, not the image itself. It only works on participating platforms. For explicit images or videos taken before age 18, NCMEC's Take It Down service works in a similar way. Our search tool must not be used with images of minors; if a child is affected, a parent or guardian should use these services and contact the police. See also leaked intimate images.
Not sure where your photos appear? Start a search and see how many matches exist.
New search