Everything you need to know about exposed content
Whether from a hack, a breach, or pirated content from a closed platform, exposed intimate content can be removed. Here is how the law protects you, what the 72-hour window means, and how to act fast.
Remove exposed content→Definition
What is sexual exposure?
Sexual exposure (also called exposed content) occurs when private sexual photos, videos, webcam recordings, or intimate conversations are published online without the subject’s consent. This includes hacked photo libraries, cloud storage breaches, stolen devices, pirated content from paid platforms, and dark web trading of personal intimate archives.
Unlike revenge porn, which typically originates from a relationship breakdown, sexual exposure often stems from technical attacks: credential stuffing, phishing, malware, or unauthorized access to cloud storage. The subject may have shared the content with one trusted person, or stored it entirely for private use. Once exposed, content spreads rapidly through Google indexing, forum sharing, and automated reposting.
The defining feature of sexual exposure is that the violation is entirely technological and criminal: someone accessed what they had no right to access, and shared what was never meant to be shared. Nothing about the original creation or storage of the content changes the nature of that crime.
Legal status
Is exposed sexual content illegal?
Yes, in every major jurisdiction, and regardless of how the content was obtained.The crime lies in the non-consensual distribution, not in the original creation. Hacking, breach, or purchase do not affect the perpetrator’s liability. Platforms that fail to act on removal requests are increasingly subject to regulatory penalties under laws enacted specifically to address this harm.
Hover or tap each card to see the specific statutes and remedies available in your jurisdiction.
Article 139h Sr, Computer Crime Act (Wet computercriminaliteit III)
Non-consensual distribution of intimate images is a criminal offence under Article 139h Sr regardless of how the content was originally acquired. Unauthorized system access is separately prosecuted.
Article 139h Sr (introduced in 2019 via the Wet computercriminaliteit III) criminalizes the non-consensual publication of intimate images regardless of the acquisition method, including hacked, leaked, or purchased content. Maximum sentence is 2 years imprisonment. When content is obtained via unauthorized computer access, the Computer Crime Act adds a separate hacking charge carrying up to 4 years. GDPR Article 17 (right to erasure) applies in parallel, giving victims a direct mechanism to demand removal from platforms and search engines operating in the Netherlands or processing Dutch residents' data.
GDPR Art. 17, DSA, NIS2 Directive
EU residents have a statutory right to erasure of intimate content published without consent. The DSA requires platforms to act rapidly on illegal content. NIS2 imposes security obligations on platforms that store user content.
GDPR Article 17 gives EU residents the right to demand deletion of personal data, including intimate images, where there is no lawful basis for continued processing. Controllers who fail to comply face fines of up to 4% of global turnover. The Digital Services Act (DSA, effective 2024) requires very large platforms to maintain accessible reporting channels and act quickly on notified illegal content, with significant penalties for non-compliance. The NIS2 Directive imposes minimum cybersecurity standards on platforms that store user data, creating a basis for civil claims when poor security causes a breach that exposes intimate content.
47 state revenge porn laws, CFAA, Video Voyeurism Prevention Act
47 states have specific non-consensual pornography laws that apply regardless of original consent. Federal hacking statutes cover unauthorized access. The Video Voyeurism Prevention Act covers recordings made without consent.
47 US states have enacted non-consensual pornography ('revenge porn') statutes that criminalize distribution of intimate images without the subject's consent, even where the original creation was consensual. The Computer Fraud and Abuse Act (CFAA) covers hacking-based exposure, unauthorized access to cloud storage, email, or devices. The Video Voyeurism Prevention Act (18 U.S.C. § 1801) covers recordings made without consent in private settings. Federal jurisdiction applies where content crosses state lines (nearly all internet-based cases). Google, Meta, and most major platforms maintain dedicated teams for intimate image removal under the STOP CSAM Act framework and NCII Hash Matching programs.
Online Safety Act 2023 Sections 179-181, Computer Misuse Act 1990
The Online Safety Act 2023 created specific criminal offences for sharing, threatening to share, or taking intimate images without consent. Hacking-based exposure is separately covered by the Computer Misuse Act.
The Online Safety Act 2023 created three new intimate image offences: sharing (Section 179, up to 2 years); taking images without consent (Section 180, up to 2 years); and installing equipment to enable non-consensual image capture (Section 181). These apply regardless of how the image was originally acquired. The Computer Misuse Act 1990 covers unauthorized access to devices, accounts, or cloud storage used to obtain intimate content. Victims can also pursue civil damages for misuse of private information, breach of confidence, and harassment, UK courts have awarded significant damages in intimate image cases. Platforms are required under the Online Safety Act to proactively prevent and remove intimate images without consent.
Statistics & scope
You are not alone in this
The exposure of intimate content is among the fastest-growing categories of digital harm. Behind every reported case is a person who stored content privately, assumed it was secure, and had that security violated by someone else’s deliberate criminal act.
187K+
Reported in 2025
Reported cases of exposed sexual content in 2025, a figure that represents only the fraction of victims who came forward.
73%
From hacks & breaches
Of exposed content originates from hacks, cloud breaches, or stolen devices, not relationship breakdowns.
92%
Still online at 6 months
Of exposed intimate content remains accessible online more than 6 months later without professional removal intervention.
Reported cases represent only a fraction of actual incidents, most exposure goes unreported out of shame and the mistaken belief that nothing can be done. Both assumptions are wrong: the shame belongs to the perpetrator, and content can be removed, suppressed, and monitored.
Professional removal exists precisely because this problem is systemic: there are established relationships between removal services and platform trust-and-safety teams, legal frameworks designed to compel erasure, and technical tools that catch reposts before they spread. This can be addressed.
The law is on your side
Prevention
Prevention before exposure
Most intimate content exposure originates from account compromise, not from sophisticated targeted hacking. The most effective defenses are cloud security, unique credentials, and early detection: none require technical expertise to implement, and together they account for an estimated 84% risk reduction in exposure impact.
Response guide
What to do when content is exposed
How much permanent damage occurs depends almost entirely on what you do in the first 72 hours. Content removed before Google indexing may never appear in search results at all. These steps are ordered by urgency.
Act within 72 hours
Need professional help?
Leakserv removes exposed intimate content from Google, platforms, forums, and dark web indexes. 24-hour response to new exposures, with ongoing monitoring to catch reposts before they spread. The 72-hour window matters, act now.