A non-consensual intimate image is a file that should never have left a private device, or should never have been made, and is now sitting on a host with a URL. The Australian job is not to debate the ethics of the genre. It is to make the file harder to find, harder to re-upload, and more expensive for the host to keep. People still treat that as a single report button. It is three machines that only sometimes talk to each other.
If you remember one distinction from this guide, make it this one: hash-matching is not a takedown, and a takedown is not a notice. A hash list watches for a fingerprint. A platform tool deletes a URL the reviewer can see. An eSafety notice can require a service to remove image-based abuse. Google, separately, can stop printing the card. You will usually need more than one.
If the file is synthetic, start with deepfakes and synthetic intimate images and then come back for the tools. If a child is in the frame, do not use this guide as the lead; open when a child is in the footage and the child pathways first. The image-based abuse explainer sits underneath all of them as the legal category.
Hash-matching and StopNCII-style tools
Several large platforms now participate in shared-hash programmes for intimate images submitted by the person depicted. The best-known public brand is StopNCII, run with a UK charity and used by companies that have agreed to ingest the fingerprints. The Australian user does not need to understand the cryptography. You need to understand the limit.
You create an account on the tool, you generate a hash of the file on your own device, and participating services receive the fingerprint rather than the picture. When a later upload matches, those services can block or quarantine it. That is valuable. It is also incomplete.
Hash lists fail on crops, filters, screen-recordings, stills pulled from a video, and hosts that never joined. They fail on Telegram channels, small forums and “leak” blogs that do not run the matching software. They fail when the person depicted cannot get through the identity step. They are a fence around some of the big gardens, not a vacuum for the internet.
Use them anyway. Do it once, early, from a device you trust. Do not upload the original to a random “we will hash it for you” website that is not the official tool. Do not send the file to a freelancer so they can submit it. The whole point of the design is that the picture stays on your side of the glass.
Platform tools, as they actually behave
Meta, TikTok, Snap, Reddit and several others now keep a dedicated intimate-image or non-consensual-sexual-imagery flow, separate from bullying and separate from copyright. Use that flow. A copyright notice over a picture of you is the wrong door and can backfire; the standing warning is in the law hub. A public comment that names the poster is not a report. It is a prompt for a mirror.
Report from the account of the person depicted if that account is still safe. Victim flows unlock fields that a bystander report does not. Keep a second, locked-down account so a retaliatory complaint does not take the evidence with it.
You will need the URL, a cropped screenshot that proves publication without reproducing the intimate region, and a one-sentence hook: “This URL shows an intimate image of me published without consent.” If you cannot write that sentence, you may have a different job — impersonation, defamation, a nasty meme that is not intimate.
Decisions arrive as short emails: removed, left up, more information required. “Doesn’t violate” is a queue outcome, not a legal finding. Appeal once with the URL and the sentence. Then move to eSafety rather than arguing with the same reviewer for a fortnight.
YouTube and Google’s other consumer products sometimes hide the image flow inside a legal or privacy form. X will often need both an in-app report and a written privacy request. None of them will send you the poster’s registration data because you asked.
eSafety’s image-based abuse scheme
The Online Safety Act gives the eSafety Commissioner a specific IBSA power. It is the main Australian administrative route when a service has the file and has not taken it down, or when you want a notice on the record before the next scrape. What eSafety can actually order is the statutory map. This section is the form.
You file as the person depicted, or as someone with authority to act. You name the service and the URL. You say the image is intimate and was posted or threatened without consent. You do not need to attach the picture. You should not attach the picture unless the form expressly requires a narrow proof and there is no other way — and even then, follow the Commissioner’s instructions, not a blog.
eSafety can give a removal notice to a service provider and, in some cases, to an end-user. Services that ignore notices start accumulating a regulatory problem. That is the leverage the in-app button does not have. The clock is not instant. It is often faster than a statement of claim and slower than a lucky Instagram review.
eSafety is not a criminal court. If there is extortion, a threat to send the file to an employer, or a break-in that produced the image, that is also a police and ACORN file. File both. Do not wait for a case number before you use the platform tool.
Google image removal
A host takedown that leaves the file ranking in Google Images is a half-job. Google will not unpublish the page. It will, through its personal-information and sensitive-image products, de-index a URL or drop a thumbnail in defined cases. The method is in how to request a Google Search removal.
Name every Images URL and every Search URL. Capture the result as it appears in an incognito window in Australia. A successful image removal does not stop a new scrape from creating a new URL, which is why the hash tool and the weekly recheck exist.
Bing and the other indexes do not follow automatically. Do them if they are referring people. The Wayback Machine is a different letter and a worse chance; do not start there.
What “removed” means, and what it does not
A good week looks like this: the first URL is gone, the hash is in at least one participating network, an eSafety file is open or a notice has gone, and Google has accepted the ranking URLs. It does not look like a clean name search on day two.
It does not mean the poster’s device is clean. It does not mean a group chat has deleted the attachment. It does not mean a forum that never joined a hash programme has noticed. It does not mean you should now send the file to a journalist, a school group, or this desk “so they know what to look for”. That impulse creates the next copies. Our editorial standards are blunt on this: we do not hold the image, we do not embed it, and we do not want it in the inbox.
Agencies that promise to “wipe NCII globally” are selling a network nobody owns. Some of them will operate the same tools you can operate, then invoice you for the dashboard. There is no shame in paying for tedious filings. There is shame in letting a vendor become another host.
A working sequence we recommend
- Capture the URLs and cropped, non-intimate screenshots. Do not circulate the file.
- Report each host on the intimate-image or IBSA policy, from the depicted person’s account if it is safe.
- Submit hashes through the official StopNCII-style tool the platforms recognise, on your own device.
- File the eSafety image-based abuse report the same day, especially if a host has already refused or is offshore and slow.
- File Google image and personal-information removals for every ranking URL.
- If there is extortion or a child in the frame, add police or the child pathways. Do not treat those as optional extras.
- Recheck the hosts, Search and the obvious mirrors in a fortnight, then in ninety days.
If you want the desk to look at a general question about the process, use contact. Do not send the image, the video, or a cloud link “for context”. We publish method. We do not run your case.