search3
Tools to fight online harassment

FAQs About Online Privacy

Contents

  1. Is the nonconsensual creation or publication of private intimate images unlawful?
  2. What are the relevant legal claims I might bring against someone who published private intimate images of me without my consent?
  3. What’s the first thing I should do when unwanted images appear online?
  4. Someone from my past won’t stop contacting me/my new partner/my family. How do I get him/her to stop?
  5. How do I find an attorney?
  6. I may want to get a restraining order. What is a restraining order? Where do I go for help?
  7. Can I sue the person who did this to me?
  8. Can I sue the website where the photo is posted?
  9. Is it a crime to post nude images of someone online without their consent?
  10. The police say this is not a crime, and won’t pursue the matter.
  11. How do I present my case to law enforcement?
  12. Will it do any good to try to take down the content myself?
  13. What if I can’t take down the content?
  14. Who else is talking about this?

  1. Is the nonconsensual creation or publication of private intimate images unlawful?

    Generally speaking, yes. “Involuntary porn,” the nonconsensual creation, publication, or dissemination of a person’s private intimate image, for no legitimate public concern, should be legally actionable in almost every situation. The specific law(s) broken will vary by state. For an educational resource on the relevant state and federal laws, you may want to check out WithoutMyConsent.org's 50 State Project. Without My Consent (“WMC”) is a 501(c)(3) privacy nonprofit currently undertaking a 50-State survey to compile a comprehensive overview of the possible civil claims that a victim of such conduct might explore, and the potential criminal consequences of the unlawful conduct, in each jurisdiction. The site also includes practical information for victims of online harassment and the attorneys who advocate on their behalf.

    ↑ Back to top

  2. What’s the first thing I should do when unwanted images appear online?

    It is important to immediately preserve the evidence the instant the content appears. Some methods of preserving the evidence are to save the webpages as .pdfs, or take screenshots of the pages (and make sure to get the whole page), or print the pages out and store them securely. If the content in question is a video, be sure to download the entire video to a secure hard drive. For a checklist approach to preserving and taking down images, please see this excellent resource by WomenAgainstRevengePorn.com.

    Typically you or your attorney would send a litigation hold letter in the interest of preserving evidence – websites may not keep data for very long (maybe a few months at most), and a hold letter may serve to preserve crucial evidence. It may take a while to find the right attorney or the proper detective to investigate your case. You are going to need evidence from the intermediaries – the websites and email service providers – used by the perpetrator to commit the unlawful acts, and you need to ask those online service providers to save that evidence for later use. In the litigation hold letter, an attorney would: (1) inform the website that you are taking legal action; (2) provide links to the material, and (3) request that the website provide to you now, or, archive and hold all identifying information regarding the party or parties responsible for posting the material, including IP addresses.

    ↑ Back to top

  3. Someone from my past won’t stop contacting me/my new partner/my family. How do I get him/her to stop?

    It depends on the individual, but caution is advised. We recommend consulting a professional before proceeding – including an attorney and possibly a psychologist. In some cases, a response from you can be perceived as positive reinforcement that harassment works. The harassing ex-partner may get what s/he wants: access to you and proof that they have affected you emotionally. This person may now think “Aha! This is how I maintain contact,” which may lead to escalated attempts at contact, or this person may think “Aha!, This is how I maintain control,” which could reignite an abusive relationship. Try to avoid a cycle where the threat of publication to control you, keep you close, or keep you in an unwanted relationship is used to maintain contact with you. An attorney, who will handle all communications on your behalf, can be a very powerful tool. An attorney can write a cease and desist letter and/or seek a restraining order. If you fear for your safety, contact the police.

    ↑ Back to top

  4. How do I find an attorney?

    The best way to find an attorney is to ask people you know and trust for referrals. Look for an attorney who has experience and expertise in the area of law that applies to your situation. Another option is to contact the State Bar of your state, and ask for a referral for an attorney who specializes in cyberlaw and privacy. You may also be able to find an attorney through legal aid organizations, law schools, or nonprofits in your area – those groups focused on domestic violence may be especially useful. This will take some research on your part.

    ↑ Back to top

  5. I may want to get a restraining order. What is a restraining order? Where do I go for help?

    A criminal restraining order is a court order issued by a judge to protect someone from a “Restrained Person.” It may be issued after the defendant (the Restrained Person) is arrested, charged, or found guilty of certain crimes against the party seeking the order. The case is filed by the District Attorney’s Office on behalf of the People. To request a criminal restraining order, you may wish to start by contacting your county’s District Attorney’s Office and speaking with the victim advocate about how to secure the order. The precise terms and rules surrounding criminal restraining orders may vary by state, but are probably readily available on your state court’s website at the self-help section. See, for example, Santa Clara County Superior Court’s self-help section on criminal restraining orders here.

    A civil restraining order is a court order issued by a judge that prevents the defendant from doing or publishing certain things or going to certain places. *You* file the request for a civil restraining order. Because this is a *civil* restraining order, the District Attorney’s Office is not involved. If the defendant violates the civil restraining order, he or she is likely to be found liable for “civil contempt;” violating a civil restraining order can also carry criminal penalties.

    So how do you get a civil restraining order? You can represent yourself, and we explain this route in more detail below. However, if you have the resources to hire an attorney, this is a good time to do so.

    Whether you represent yourself or hire an attorney, you should consider answers to the following questions, most of which should be readily available on your state court’s website self-help section. See, for example, Santa Clara County Superior Court’s self-help section on civil harassment orders here.

    What kind of restraining order are you seeking? Typical choices include a domestic restraining order (for those with whom you have been in a romantic relationship) or a civil harassment restraining order (for everyone else). Some states, such as Florida, offer special cyber-harassment restraining orders, but it is not necessary for your state to have a cyber-harassment restraining order for its restraining orders to apply to conduct that occurs online. You, or your attorney, can draft the terms of the proposed order you wish to receive from the court, and specify that the order applies to online and offline behavior in that proposed order. It’s important to recognize that old laws (and old practices regarding restraining orders) sometimes must be applied to the new facts of the day, and that efforts to enact new cyber-specific laws are often unnecessary and arguably even harmful because such laws creates the false impression that existing laws aren’t adequate. They often are. They simply need to be enforced!

    From what court should I seek a civil restraining order? And, do I have a choice? You typically have at least two choices in selecting a court: family court or state court. Consider and weigh the following: Which court is more likely to have experience in matters of anonymous speech and online invasions of privacy? This is a very important factor to consider, because judges who are familiar with technology and the relevant speech/privacy balancing tests might issue rulings that are more nuanced and thoughtful in your particular case; they are also more likely to provide a concrete precedent for future litigants. Next, which court is more likely to appreciate the sensitive, private nature of the dispute, or the special circumstances that surround domestic disputes, especially if your situation involves children? Does one court offer more favorable law or procedure than the other? How much publicity will your filing attract? Family court filings may be more likely to fly under the radar. In certain states, family court records are entitled to a greater degree of privacy protection, whereas civil court filings are more frequently tracked and picked for publication online. There are pros and cons to either choice, and an attorney can help you consider these questions before you bring an action, and help ensure that the forum you select is the one in which you are the most likely to achieve your goals.

    ↑ Back to top

  6. Can I sue the person who did this to me?

    Yes, but there are some practical considerations that often make this option cost prohibitive for many people. In some situations, proceeding through the criminal (rather than civil) justice system may also be an option.

    In thinking about whether to file a civil lawsuit, you and your attorney must think through the issues below.

    What are the relevant claims you may have against the perpetrator? There are many legal claims that can be brought in a lawsuit against the defendant who posted the images. Relevant state claims to consider often include: defamation, invasion of privacy, intentional and/or negligent infliction of emotional distress, stalking, and harassment. Federal causes of action like copyright infringement, federal stalking claims, and computer fraud and abuse claims should also be explored. And most, if not all, states have the following criminal statutes on the books: criminal invasion of privacy, voyeurism, impersonation or fraud, harassment, and stalking. To view a list of relevant civil and criminal laws in your state, please access WithoutMyConsent.org 50 State Project for your state. (Note: WithoutMyConsent’s 50 State Project is a work in progress. WMC has completed research for some, but not all, of the 50 states. If information regarding your state is incomplete, you may search other states to get an idea for the types of civil and criminal laws that may be available in your area.)

    Then, do you know who the defendant is? If yes, you can name the defendant by true name in the complaint and you’re ready to go. If the defendant is anonymous, you can still file a lawsuit naming “John Doe” or “Jane Doe” as the defendant. Once filed, the complaint provides subpoena power, subject to the law and court rules of your jurisdiction, and your attorney can serve subpoenas targeted to reveal the identity of the anonymous speaker. Once revealed, you can name the defendant in your lawsuit. For an overview of this process, see Erica Johnstone’s article on Unmasking Anonymous Posters here.

    Next, how important is it to you to proceed anonymously? In invasion of privacy cases, the plaintiff often needs to be able to proceed anonymously; otherwise, the plaintiff will not file the lawsuit because court documents are public records, and filing a lawsuit in a true name would simply exacerbate the harm – potentially the case could be published, blogged and tweeted about, indexed in search engines, and so on, and soon the one thing the plaintiff may be trying to keep private (the naked images) would be the first thing that appeared in search results for his or her name – exactly the opposite outcome the plaintiff hopes to accomplish and an outcome that exacerbates the harm suffered by the victim. In this scenario, there is no easy path to justice. To combat this problem, there is sometimes the option of filing a pseudonymous complaint. This is where the plaintiff proceeds as “Jane Doe” or “John Doe”, or perhaps by initials, and the identity of the plaintiff is therefore not revealed in public court records. To view the federal rules or the rules of a state on how to proceed pseudonymously, see WithoutMyConsent.org's 50 State Project for Filing Under a Pseudonym.

    What is the defendant’s financial status? You may be thinking that you can recoup the cost of litigation through damages or getting the defendant to pay your attorney fees once you win the case. This is easier said than done. The defendants in these cases often don’t have any assets. So, even if you were to get a million dollar judgment, you need to be realistic about your chances of collecting on the judgment. While there are many legal options available to you, none are likely to result in your recovery of a financial windfall or (often) even in the recovery of your costs of suit.

    All hope need not be lost if you can’t afford to sue, and the defendant has no assets. Even without filing a lawsuit, you and your attorney may be able to take down the images and negotiate a settlement agreement with the person who posted them. There are many ways to gain leverage in a dispute. With the right attorney, through artful and truthful letter writing, you may be able to negotiate a winning settlement agreement on your behalf without the need for filing a lawsuit, or risking your name being in news headlines.

    ↑ Back to top

  7. Can I sue the website where the photo is posted?

    This is complicated. Under section 230 of the Communications Decency Act, websites cannot be held liable for certain claims that arise from content published, disseminated, or made available by a third party (i.e., the harasser). (See 47 U.S.C. § 230(c).) There are narrow exceptions to this rule. For instance, section 230 does not immunize websites that are responsible, in whole or in part, for the creation or development of unlawful content. Involuntary porn websites will claim they are immune from liability under section 230 of the Communications Decency Act. Are they really? The law in this area is unsettled, and the specific facts of your situation will matter greatly. But some sites dedicated solely to involuntary porn may not necessarily be immune from liability. It will depend on the facts and the court in which you sue.

    Moreover, even if the website is immunized against some claims by Section 230, the website may be vulnerable to intellectual property–related claims such as those arising under copyright law. Many of the images that are published to involuntary porn websites without the consent of the victim are self-portraits. In such cases, the victim is the photographer and therefore the likely owner of the copyright in the photograph, which s/he can typically ask that a website remove pursuant to a Digital Millennium Copyright Act takedown notice. Other images can have their copyright assigned to the victim. You should consult with your attorney regarding how copyright law (and other IP claims) might help to take down the images and work with the parameters of section 230. The copyright act and other laws may provide in some cases for recovery of attorneys fees and costs by the prevailing party.

    Finally, websites may also be vulnerable to federal criminal liability, despite Section 230. For example, Hunter Moore, the founder of the now-defunct website IsAnyoneUp? is reportedly being investigated by the FBI. But whether or not the government is investigating a crime related to the specific website that may concern you, criminal conduct is exempt from the immunity of Section 230, as is content published by the website itself (as opposed to published to the website by an unaffiliated user).

    ↑ Back to top

  8. Is it a crime to post nude images of someone online without their consent?

    t depends on your state, but it is a distinct possibility. This conduct is more likely to be a crime if your state has made e-crimes a priority, but many traditional criminal laws may also apply. For example, most states have the following criminal statutes on the books: criminal invasion of privacy, voyeurism, impersonation or fraud, harassment, and stalking. New Jersey has a noteworthy Invasion of Privacy statute, N.J.S.A. 2C:14-9, which prohibits both recording and disclosing a private image of another person without consent. If your state does not already have a criminal invasion of privacy law on the books, you may petition your state lawmakers to pass a law modeled after N.J.S.A. 2C:14-9 in your state. In addition, depending on how the potential defendant obtained the photos, s/he may face criminal liability under the federal Computer Fraud and Abuse Act, your state’s anti-hacking or cybercrime laws, or related criminal statutes. Sometimes, the problem is not that the government doesn’t have laws on the books addressing cyber-harassment crimes, it’s that it doesn’t have the training, technological familiarity with online websites, and/or resources to enforce the laws that ARE on the books.

    Federal criminal laws may also apply to the facts of your case, especially if your case involves hacking or fraud, or if the conduct occurs across state lines. At the federal level, such crimes should be reported to your local branch of the FBI and possibly the Internet Crime Complaint Center (IC3).

    ↑ Back to top

  9. The police say this is not a crime, and won’t pursue the matter.

    They may be wrong about the law, but be mindful that the police department does have a great deal of discretion with regard to whether or not to prosecute any given matter. Many officers have received minimal training on cyberlaw, intellectual property law, or how to investigate e-crimes. Police officers are trained to investigate brick and mortar crime scenes, but sometimes lack a robust framework for processing requests to investigate crime committed using online technology. This will not change until states allocate resources to properly train investigators and prosecutors. If the prosecution of technology-related crimes is an issue that matters to you, you should contact your state’s Attorney General and let him/her know that the residents of your state believe privacy matters. Begin a dialogue in your state. There is already a model in place, developed by the state of California.

    California Attorney General Kamala Harris has made privacy a top priority for the California Department of Justice. In 2011, the California DOJ created an eCrime Unit that: (1) trains police and prosecutors in light of new technologies; and (2) prosecutes criminal online invasions of privacy, among other crimes. The eCrime Unit is not for every complaint – it focuses on large-scale identity theft and technology crimes with actual losses in excess of $50,000; however, it is another place to turn should you need backup after reporting the crime to your local police department.

    When you report the crime, you may have to insist on filing a police report. While it may take some time to find the right detective for your matter, it is very important that, as a victim of crime, you report it immediately to your local precinct. It is this initial accurate documentation that often proves invaluable to the proper preservation of evidence and a successful prosecution of the perpetrator.

    ↑ Back to top

  10. How do I present my case to law enforcement?

    As this question implies, you’ll do best if you approach law enforcement with a folder full of your evidence (print outs of those .pdf files you saved, and copies of your litigation hold letters) that you have preserved to document your case. You may encounter some resistance when you attempt to report the crime at your local police department. Here are some considerations.

    You may be told, “You gave the photo to him/her. It’s his/her property.” You may politely explain that this may be incorrect. Your complaint relates to intellectual property, not the mere possession of physical copies of the work, and that special rules apply. Is the photo a self-portrait? If so, you likely own the copyright. If not, you may be able to get an assignment of copyright in writing from the copyright owner.

    You may be told, “This isn’t a crime.” This may also be incorrect. There are many criminal laws that may be applicable. Most, if not all, states have the following criminal statutes on the books: criminal invasion of privacy, voyeurism, impersonation or fraud, harassment, and stalking. In addition, depending on how the perpetrator obtained the photos, s/he may also be guilty of your state’s anti-hacking law (the state law equivalent to the Federal Computer Fraud and Abuse Act). For a list of crimes that may be applicable, please access WithoutMyConsent.org's 50 State Project for your state. (Note: WithoutMyConsent’s 50 State Project is a work in progress. WMC has completed research for some, but not all, of the 50 states. If your state is incomplete, you may search other states to get an idea of the types of criminal laws that are usually available.)

    You may be told, “S/He says it wasn’t her/him.” This need not necessarily end the inquiry. If you bring suit, you have the option to serve subpoenas to identify the defendant after filing your complaint. For more information, see Erica Johnstone’s article on Unmasking Anonymous Posters here. The police have similar and additional tools at their disposal. In either case, a proper litigation hold letter sent to the appropriate websites, ISPs, and email service providers can be critical to preserving the evidence relevant to your case.

    You may be told, “This online stuff isn’t a physical safety issue.” First, not all crimes are “safety issues,” but are prosecuted nevertheless. Second, if you are being stalked, harassed, or otherwise being threatened online it may well be a safety issue. In fact, the anonymous and boundary-defying nature of the conduct may itself present a credible threat to safety. Some victims are being followed, pursued, monitored, and/or watched by an often unstable or abusive person who knows a significant amount of personal information them.

    You may file a police report, and receive no reply. You can continue to follow up, but ultimately, you can’t force a criminal case. It’s the police who investigate the crime, and the district attorneys who prosecute the offenders. You do, however, have control over making the case to the detectives that: (a) you have proof; and (b) the conduct violates the law. Your case is most likely to be referred by the police to the District Attorney for prosecution if: (a) you have solid evidence; and (b) the offender is violating a pre-existing restraining order; or (c) the offender is violating a criminal statute that is obviously on point (e.g., see New Jersey’s criminal invasion of privacy statute). Law enforcement and prosecutors often have their plates full, and courts are flooded. District Attorneys prosecute thousands of cases per year. They are often focused on prosecuting violent crimes. Technology crimes are notoriously expensive and difficult to bring to trial. You have to make your case.

    Remember that if the criminal route stalls, civil remedies are still available – though be aware that there are statutes of limitation that can forever bar your ability to bring a civil case if you wait – sometimes these periods can be a year or less, so acting promptly is important. In civil court, your remedies may be a combination of money damages, a court order that the perpetrator cease & desist, and, in some circumstances, attorney fees.

    ↑ Back to top

  11. Will it do any good to try to take down the content myself?

    It may, and this is something a lawyer can help you with. But preserving the evidence and sending litigation hold letters is an important and often overlooked step. This is explained above. It is important to preserve evidence immediately, prior to attempting to take down offensive content, so you have a record of the conduct.

    Often, websites are responsive to friendly, non-threatening letters requesting that content be removed. Many websites will voluntarily use their editorial discretion to comply with your request, and will take down content that is defamatory, harassing, stalking, violates privacy, or otherwise runs afoul of the website’s terms of service. For more information, see Erica Johnstone’s article on Removing Offending Web Posts here.

    If still images or video is involved, and you own the copyright, you can send a takedown notice to the website under the Digital Millennium Copyright Act. Upon receipt of a proper takedown notice, most websites will remove photographs that are sworn by the owner to infringe their copyright. Before you use the Digital Millennium Copyright Act though, there are a few things to note. First, you must actually own the copyright. How do you own the copyright? If you took the photograph, you generally own the copyright. If you didn’t take the photograph, you may contact the person who did and obtain an assignment in writing. Second, you must scrupulously comply with the statutory requirements of Section 512(c)(3) of the Digital Millennium Copyright Act. If you don’t, your request usually won’t work. The elements of a proper takedown notice are described in this overview provided by the Citizen Media Law Project, and a sample notice is available here by WomenAgainstRevengePorn.com.

    Consider registering your copyright with the US Copyright Office (helpful tips here), and mentioning this in your takedown request. If you register your copyright before an infringement takes place, or within 90 days of first publication, statutory damages are available as an alternative to actual damages and profits. This is sometimes preferable if actual damages and profits are either too small, or too difficult to prove, or both. Statutory damages range from $750 per work to $150,000 per work. In a suit for the infringement of registered works, you may also be eligible to recover your attorney’s fees.

    It is generally most effective to use accurate but boilerplate language in takedown requests. Beware of unfriendly websites – those sites structured as involuntary porn sites or some other flavor of “harassthem.com.” Assume that everything you write will be published and will be used to heckle and embarrass you. After all this, you don’t want your takedown letter to become an internet meme. For great tips on style, tone and content, see this post by Ken at Popehat.

    Once the content is removed, you can request that search engines remove cached versions of the webpages as well. Even after the website owner has removed the content, it sometimes appears that the content is still online because the removal of cached pages happens automatically, but sometimes slowly; it can take some time for these pages to “fall out” and disappear from search results. For example, if you do an internet search for: “site: nameofthesite.com jane and doe”, you may see dead links that are in line to be removed the next time the site is re-indexed. To expedite the process for Google searches, you can log in to your personal gmail account, and then request that Google re-crawl those dead link pages to remove the content from the Google index, as described here.

    ↑ Back to top

  12. What if I can’t take down the content?

    One approach to especially virulent content is to bury it using search engine optimization (SEO) techniques. The goal is to push the content off the first couple of pages of search results, which are all that most internet users review. The strategy is two-part: defense and offense. There are companies like Reputation.com and BrandYourself that will help manage your reputation for you. But, for those of you with a DIY curiosity, here are some SEO tips.

    Defense: take down negative content

    • Who is linking to the negative content? Contact those people, and ask them to remove the link. Delete comments at the source – especially those that mention your name. In these cases, even if the site is resistant to removing the content entirely, you may be able to persuade the administrator to modify the original content so that it includes your initials only, or delete all references to your first and last name together.

    Offense: generate positive content

    • Own your own domain name.
    • Buy Google AdWords (Ads that appear when someone searches your name). The Ad could be as high on the page as the first result and the Ad could say something like: “Click here for the real story about ”…
    • Set a Google alert so that you are notified of all online content about you immediately and can file a lawsuit within the (potentially short) statute of limitations if necessary.
    • Create a personal website or blog.
    • Join LinkedIn, Facebook, and Twitter and the rest of the social media cast and cross-reference. Link all of these sites. For example, your website should also link to LinkedIn, Facebook, and Twitter, and vice versa. Then, when you update your Twitter feed, include a link to your website. This is a great to way to proliferate links to your website without spamming and to push the content you want people to know to the top of the list.
    • But, then again, one person’s spam is another person’s treasure. So upload those 50 cat videos to YouTube. Create as much content as possible that is positive or neutral.
    • Connect online with other websites and blogs. You want as many websites as possible linking to your personal website.
    ↑ Back to top

  13. Who else is talking about this?

    To learn more about the general state of affairs surrounding involuntary porn and the joint efforts to end involuntary porn, the following websites may be of interest.

    ↑ Back to top