The call usually comes in the same way. Someone who sells private content through a subscription platform, or someone whose private images were never meant for anyone else, has found copies on websites they do not control. They want to know two things: can it be taken down, and can anyone be held responsible. Two separate bodies of law may apply, they ask different questions, and the right first step depends on which fits your facts. This guide walks through both.
Two laws, two different questions
Copyright law asks who owns the material. If you took the photograph or recorded the video yourself, you own the copyright from the moment of creation, registered or not. That ownership is what the federal Digital Millennium Copyright Act, at 17 U.S.C. § 512, lets you assert against the websites and search engines that host or index the copies. It does not matter whether the material was intimate or whether you sold it to paying subscribers; what matters is that you made it and someone else is distributing it without permission.
Intimate-image law asks a different question: was an identifiable person shown in a private state, and was the image distributed without that person’s consent. Maryland’s statute, Criminal Law § 3-809, makes it a misdemeanor to knowingly distribute such an image with intent to harm, harass, intimidate, threaten, or coerce the person depicted, where the person did not consent and had a reasonable expectation the image would remain private. Federally, the TAKE IT DOWN Act of May 2025 obliges covered online platforms to take down an intimate image published without the depicted person’s consent within 48 hours of that person’s valid request.
The distinction matters for subscription content creators. Both intimate-image statutes were drafted with a former partner or a hacked phone in mind. Where material was produced for sale and delivered to subscribers, the consent and privacy-expectation elements become contested, and an anonymous uploader chasing advertising revenue may not satisfy the intent-to-harm element at all. The copyright route therefore does the heavy lifting in creator cases; the privacy route becomes decisive when the person responsible is known and the material was never meant to leave a private relationship.
Preserve the evidence before you do anything else
Every option below depends on proof you cannot reconstruct once a page is taken down or edited. Before sending a single notice, capture what you found in a form a court could accept.
Save each infringing page as a full-page screenshot and a PDF, with the full URL, date and time visible.
Record the address of every copy, including direct image and video file addresses, not only the page displaying them.
Keep your originals with metadata intact, and records showing when and where you first published the material.
If you suspect a specific person, preserve messages and account records that tie them to the upload, and do not confront them.
Do not send notices from a personal address you would not want published; some sites forward notices to the uploader.
The copyright route: administrative, fast, repeatable
A DMCA notice is not a lawsuit. It is a letter, sent to the hosting provider’s registered agent, that contains the elements listed in § 512(c)(3)(A): your signature, identification of the work, the exact location of the copy, your contact details, a good-faith statement that the use is unauthorized, and a statement under penalty of perjury of your authority to act. A host that wants to keep its liability protection must act expeditiously on a compliant notice. A parallel request to Google, through its legal removal form, removes the identified addresses from search results, where much of the damaging traffic originates.
The weakness of this route is volume. Copies reappear, and each new address needs its own notice. Creators with a recurring problem often hand the monitoring and the paperwork to a specialized service such as SuppressLeak, so that the creator or their lawyer reviews outcomes instead of drafting letters.
The privacy route: police, platforms and civil claims
If the facts fit § 3-809, a report to local law enforcement is the starting point, and the statute carries a penalty of up to two years of imprisonment, a fine of up to $5,000, or both. Under the federal Act, a removal request goes directly to the platform, which has 48 hours to act once the request is valid. On the civil side, Maryland common law claims such as intrusion upon seclusion and intentional infliction of emotional distress remain available against an identified distributor, and copyright infringement itself carries statutory damages of $750 to $30,000 per work, and up to $150,000 for willful infringement, provided the work was registered in time under 17 U.S.C. § 412.
When to involve a lawyer, and what to expect
Most takedowns do not require counsel. Involve a lawyer when the uploader is someone you know, when a platform refuses a compliant notice, when you need a § 512(h) subpoena to identify an anonymous account, when you want to register the works and sue, or when a counter-notice arrives and you have roughly ten business days to decide whether to file suit before the material goes back up. A content removal lawyer can also tell you, early, whether the copyright or the privacy route has the better prospects on your facts.
Set realistic expectations. Compliant hosts often remove within days; search delistings can take longer; a criminal complaint moves at the pace of the investigating agency; a civil action for damages is measured in months, sometimes years. None of these timelines is a reason to wait. The evidence you preserve today is what every later step will be built on.