Fake Nudes Vanished in a Day When Reported as Copyright. As Abuse, They Stayed Up for Weeks

The 50 images went up on X over two days, scheduled at random hours between noon and midnight, tagged with the crudest hashtags the platform’s adult content trades in. Every one was a lie. The women in them didn’t exist, conjured instead by a generative model and checked against facial-recognition tools to make sure no real face had leaked through. Then the researchers waited, and reported, and watched the clock.

What they were testing wasn’t the images themselves but the machinery behind them: the two front doors X gives you for getting intimate content taken down. One is marked privacy. The other is marked copyright. They lead to very different places.

Half the images, 25 of them, were reported through X’s own non-consensual nudity policy, built expressly for this kind of abuse. The other half were reported as copyright violations under the Digital Millennium Copyright Act, the same federal law that pulls down bootleg films and leaked albums. Identical pictures, identical removal requests, near-identical wording. The only real difference was which legal scaffolding sat behind the complaint.

The copyright reports worked. All 25 of those images were gone within 25 hours, the fastest in roughly 13, with a mean around 20. The privacy reports didn’t work at all. Three weeks on, every one of the 25 images flagged as non-consensual nudity was still sitting there.

A law gets answered. A policy gets ignored.

“The contrast is stark,” says Qiwei Li, the University of Michigan doctoral candidate who led the audit. “Reports filed through a law got fast action, and reports through the internal channel got nothing. X responds to legal pressure, not to their own stated policies. Legal pressure works; platform goodwill doesn’t.”

There was a second tell, in what happened to the accounts doing the posting. The five accounts caught by copyright claims were all temporarily suspended and sent an email spelling out the complaint against them, the full DMCA notice included. The five accounts reported for non-consensual nudity? Nothing. No suspension, no warning, no acknowledgement that anything had been reported at all. One framework comes with teeth and a paper trail; the other, on this evidence, comes with a shrug.

The design itself was a careful piece of ethical tightrope-walking. Instead of touching a single real survivor’s image, the team manufactured the whole scenario from synthetic faces. “The idea came from watching AI-generated nude imagery enter mainstream public consciousness and recognizing it could let us study a real, urgent problem without risking survivor content,” she says. That choice, posting fabricated abuse to study how abuse is handled, is the sort of thing an ethics board might balk at; the work was classed as not involving human subjects, which tells you something about how slowly the rules have kept pace.

The law arriving now, and the hole it leaves

The timing here isn’t incidental. The audit lands as the TAKE IT DOWN Act comes into force, the new federal law (the clunky acronym unpacks to Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks) that from 19 May requires platforms to pull non-consensual intimate imagery, deepfakes included, within 48 hours of a valid report. It’s enforced by the Federal Trade Commission, and the penalty for ignoring it runs to more than $53,000 a violation.

In other words, it does to privacy reporting roughly what copyright law already did: it puts a law behind the request. Li’s data suggests that is exactly the lever that moves platforms.

But she is wary of reading the result as simple good news, and here the argument gets more interesting. “Our audit suggests that platforms will remove when there’s legal pressure behind a report. That’s the part of TAKE IT DOWN that could work,” she says. “The more challenging question is what else might come down along with it. A law that mandates fast removals on the internet risks creating collateral damage.” A 48-hour clock and a five-figure fine are a strong incentive to take things down fast; they may also be an incentive to take things down first and ask questions later.

And there’s a deeper gap the law barely touches, which is who does all the labour. The mandate tells platforms to act on valid reports, but somebody still has to find the content, prove it’s them, file the paperwork, and then keep watching. “The law still leaves survivors doing the work, searching for their own abusive content, documenting it, submitting reports, monitoring after submission and doing it all again when the content reappears on a new website,” Li says. The copyright route, the one that actually functions, has its own cruel catch built in: you can only file a DMCA claim if you own the copyright, which generally means you have to have taken the picture yourself. The abuse most easily removed, then, is the abuse the victim happened to photograph.

Roughly one in eight American adults, by the figures the researchers cite, have had intimate images shared without consent or been threatened with it, and around nine in ten of those harmed are women. Against numbers like that, a single audit of a single platform is a small thing, and Li knows it. What it offers is a clean before-and-after of a system that, until a law showed up, simply wasn’t listening.

“TAKE IT DOWN might better address the platform-side failure our audit documented,” she says. “But it does not fix the survivor-side burden, and that gap is where policy attention needs to go next.” The front door marked privacy may finally be opening. Whether anyone is waiting on the other side to do the searching, the filing and the endless watching is still very much an open question.

Frequently Asked Questions