People who had intimate images shared without their consent turned to Google for help. They used an official process specifically designed to get those images removed from search results. What happened next made things worse: the removal request process itself appears to have exposed their private identifying information online. That is the core of what is now being reported as a Google removal request privacy leak, and it raises serious questions about whether official victim-support tools can be trusted to protect the people who use them.
What happened
Google operates a formal system that lets people ask for non-consensual intimate images — sometimes called NCII — to be removed from search results. The intention is to protect victims. Instead, confirmed cases show that submitting a request through this system resulted in the victim’s own identifying details being posted online.
This was not an isolated incident in one place. Confirmed cases stretch across multiple countries, which means the problem was built into the process at a structural level, not triggered by a local error.
One victim reported that images taken when they were a minor were distributed without consent. When they used Google’s official removal tool to fight back, their own information was exposed through that same system. That detail is important: a child’s identity was connected, publicly, to illegal sexual imagery — through a process meant to help them.
The exact technical mechanism that caused the exposure has not been fully disclosed publicly.
Who is affected
Anyone who has ever submitted a removal request to Google for non-consensual intimate images may be affected, regardless of where they live. The problem was not limited to one country or one type of user.
Confirmed victims include people who were minors when the images were taken. People who believed they were using a safe, official channel to protect themselves are the core group at risk.
The total number of people affected and the full list of countries involved beyond Korea have not been disclosed.
What the real risk is
When a victim’s identifying information appears online alongside a removal request, it tells anyone watching exactly who is fighting back. That is a direct threat.
- Harassment and stalking: Exposed details — a name, a location, a contact — can be used by abusers to find and target the person again.
- Further threats: Knowing a victim has identified themselves to a platform can give an abuser new leverage.
- Legal consequences for minors: A child’s identity being connected publicly to illegal sexual imagery carries serious legal and personal weight that cannot be undone easily.
- Chilling effect: If victims learn that asking for help exposes them, many will stop asking. That leaves harmful content online longer.
This is re-victimisation in a precise sense. The person who was wronged is harmed again — not by the original abuser, but by the system they trusted to protect them.
What to do today
These steps are specific. You can do all of them this week.
1. Search yourself right now
If you or someone you know has submitted a Google removal request for non-consensual intimate images, open a browser and search your full name, your email address, and any username you used in the request. Do this in a private or incognito window so results are not shaped by your own browsing history. Look at the first three pages of results.
2. Screenshot everything before you touch it
If you find personal information about yourself online, do not try to remove it yet. Take dated screenshots first. On most phones you can do this by pressing the power and volume-down buttons together. On a computer, use your system’s screenshot tool or a free browser extension that captures the full page. These screenshots are evidence. You will need them if you pursue legal support.
3. Contact a specialist organisation, not just the platform
Search for an image-based abuse support organisation in your country. In the UK, the Revenge Porn Helpline is one example. In Australia, eSafety Commissioner handles these cases. These organisations know the current state of platform removal processes and can advise you on steps that are safer than submitting another online form right now.
4. Before submitting any future removal request, ask what happens to your data
Do not assume that an official tool keeps your information private. Before you submit anything sensitive to any platform, look for their privacy policy specific to that tool. If it is not clear what data is collected and who can see it, pause and get advice first.
5. If you are a parent, have the conversation now
Tell your child that if they ever encounter this situation, they should come to you before taking any action online — including using a removal tool. The confirmed exposure of a minor’s identity through this process shows that even well-intentioned steps can cause new harm. Children need to know they will not be judged for coming to you first.
Why this keeps happening
Platforms build removal tools primarily to meet legal obligations or to respond to public pressure. The safety of the person using the tool during the process itself is often treated as secondary to the goal of getting content down.
But there is a deeper problem. Online systems have no reliable way to confirm that the person submitting a request is who they say they are, or to ensure that the data they submit stays protected end-to-end. Because identity on these platforms is essentially unverified and unanchored to any real-world accountability, the response to abuse is always reactive — chase the harm after it happens, rather than prevent it by design.
In this specific case, that gap meant a victim’s data moved through a system without adequate protection. The people most harmed — victims of image-based abuse — are the least likely to scrutinise the privacy mechanics of a removal form at the moment they most need help. They are in crisis. They click submit.
Until platforms are required by law to demonstrate that victim data is protected at every point in the pipeline — not just at the point of submission — gaps like this will keep appearing. Accountability for what happens to that data inside these systems remains limited.
Frequently asked questions
Is it still safe to submit a removal request to Google for non-consensual images?
The exact cause of the exposure has not been publicly disclosed, which makes it difficult to say whether the risk has been fixed. Before submitting a new request, contact a specialist support organisation in your country first. They can advise on the current state of the process and whether safer options exist.
How would I know if my information was exposed through a removal request?
Search your own name, email address, and any username you used in the request, using a private browser window. Look carefully at the first several pages of results. If you find anything unexpected, screenshot it with the date visible before doing anything else.
Does this only affect people in Korea?
No. Confirmed cases stretch across multiple countries. Korea has been named in reporting, but the problem appears to have been built into the process globally. The full list of affected countries has not been disclosed.
Originally reported by databreaches.net. This article summarises that reporting and adds practical guidance.
Mafiology tracks the tactics behind these schemes so you can recognise them early. Get our fraud-pattern alerts, plus a free copy of Wes Kussmaul’s Escape the Plantation on how scammers attack you and your family, and what can be done to stop them.
