NCII Rights in Germany and the EU: What Creators Can Demand

German and EU law gives you more leverage than most creators realise — criminal provisions, GDPR erasure and the DSA all apply. Here is how to use each one.

Published 2026-08-03 · Updated 2026-08-03 · en

What NCII means and why the label matters

NCII stands for non-consensual intimate imagery: intimate or sexual images shared without the consent of the person shown. It covers leaked paid content, images shared by an ex-partner, secretly recorded material and sexualised deepfakes.

The label matters because it unlocks routes that a plain copyright complaint does not. A leaked OnlyFans set is simultaneously a copyright matter (you own the work) and an NCII / personality rights matter (you did not consent to this distribution). Filing on both grounds roughly doubles your leverage: platforms that ignore copyright notices often act quickly on intimate-image reports, and vice versa.

This article is general information, not legal advice. For an immediate practical step, a free [LeakStop Instant Scan](/instant-scan) documents where your content currently appears — evidence you will need for every route below.

Route 1: German criminal law

Several provisions can apply, depending on how the material was created and shared:

• § 201a StGB (violation of intimate privacy through images). Covers creating or distributing images that violate the highly personal sphere, including unauthorised distribution of intimate photos.
• § 184k StGB (upskirting). Covers non-consensual intimate recordings of genitals or underwear.
• § 185–187 StGB (insult, defamation). Often relevant where leaks are combined with fake profiles or false claims.
• § 33 KunstUrhG. Distributing a portrait without the depicted person's consent is a criminal offence, alongside civil claims.
• § 106 UrhG. Unauthorised commercial exploitation of your copyrighted work.

Practical notes: report to the police or public prosecutor with a complete URL list and screenshots with timestamps. German police units for cybercrime handle these cases, and an *Anzeige* creates a case reference that platforms and hosts take seriously. Deadlines matter for some offences, so do not wait months.

Route 2: Civil claims

Independently of criminal proceedings you can pursue:

• Injunctive relief (Unterlassung) against uploaders and, in some cases, intermediaries, usually via a cease-and-desist letter (*Abmahnung*) with a penalty clause.
• Damages and licence-analogy compensation for unauthorised exploitation of your copyrighted content.
• Monetary compensation (Geldentschädigung) for severe violations of general personality rights.
• Right to information about the extent of distribution.

Civil routes work best against identifiable German or EU-based actors. Against offshore leak sites the faster lever is usually the intermediary — host, CDN and search engine.

Route 3: GDPR right to erasure

Article 17 GDPR gives you the right to have personal data erased, and intimate images are special-category data under Article 9. This applies to any controller processing your data, including forum operators, image hosts and — crucially — search engines as separate controllers.

How to use it:

1. Send an Article 17 erasure request to the platform's DPO or privacy contact, naming the URLs and stating that the content is special-category data processed without consent.

2. Send a parallel request to Google's removal forms. Google operates a dedicated process for non-consensual explicit imagery that removes results from search even when the host does nothing.

3. If a controller refuses or ignores you, complain to your supervisory authority — in Germany, the data-protection authority of your federal state.

Erasure requests must be answered within one month. Google's intimate-image process typically removes results within days.

Route 4: The Digital Services Act

Since 2024 the DSA applies across the EU and gives you concrete, enforceable rights against platforms and hosting providers:

• Notice-and-action (Art. 16). Every hosting provider must offer an easy electronic mechanism to report illegal content and must act in a timely, diligent and non-arbitrary manner.
• Statement of reasons (Art. 17). You are entitled to a reasoned decision, not silence.
• Priority handling for trusted flaggers (Art. 22). Reports from designated bodies are processed with priority.
• Internal complaint handling and out-of-court dispute settlement (Art. 20–21) if a platform refuses to act.
• Enforcement in Germany runs via the Digital Services Coordinator at the Bundesnetzagentur.

In practice the DSA converts "the site ignored me" into a documented failure you can escalate — and it applies to the large platforms where leaked content spreads (search engines, social networks, video platforms).

Route 5: StopNCII and hash matching

StopNCII.org lets you create a cryptographic hash of an intimate image on your own device — the image itself is never uploaded. Participating platforms then block matching uploads proactively. It is free, works for adults, and is one of the few genuinely preventive tools available. Use it in addition to takedowns, not instead of them.

Putting it together: an enforcement order of operations

1. Document everything. URLs, screenshots with visible date, and a stable archive. Do this before filing anything.

2. File the fast lanes first: Google intimate-image removal + platform NCII reports. These cut discovery within days.

3. File DMCA / copyright notices to host, CDN and registrar in parallel — see our [DMCA takedown template](/blog/dmca-takedown-notice-template-for-creators).

4. Submit hashes to StopNCII to block re-uploads on participating platforms.

5. Escalate under DSA where a provider ignores a valid notice.

6. Criminal report and civil claims for identifiable perpetrators.

7. Monitor continuously — mirrors and re-uploads are the normal case, not the exception. [LeakStop](/instant-scan) handles steps 1–4 and the monitoring loop automatically across 5M+ sites and backlinks.

Frequently asked questions

Is sharing leaked intimate content a crime in Germany?

Yes. Depending on the circumstances it can fall under § 201a StGB, § 184k StGB, § 33 KunstUrhG and § 106 UrhG. You can file a criminal report with a URL list and timestamped screenshots.

Can I force Google to remove leaked intimate images?

Google operates a dedicated removal process for non-consensual explicit imagery and also handles GDPR Article 17 erasure requests as a separate controller. Results are typically removed within days even when the hosting site does nothing.

Does the Digital Services Act help against leak sites?

It obliges hosting providers serving EU users to offer a notice-and-action mechanism and to give reasoned decisions. That does not guarantee an offshore site complies, but it creates enforceable duties for the large platforms and search engines where leaks actually get found.

What is StopNCII and does it cost anything?

StopNCII.org is a free service that creates a hash of your intimate image locally, without uploading the image. Participating platforms use the hash to block matching uploads proactively.

FAQ

Is sharing leaked intimate content a crime in Germany?

Yes. Depending on the circumstances it can fall under section 201a StGB, section 184k StGB, section 33 KunstUrhG and section 106 UrhG. You can file a criminal report with a complete URL list and timestamped screenshots.

Can I force Google to remove leaked intimate images?

Google runs a dedicated removal process for non-consensual explicit imagery and also handles GDPR Article 17 erasure requests as a separate data controller. Results are usually removed within days even if the hosting site does nothing.

Does the Digital Services Act help against leak sites?

The DSA obliges hosting providers serving EU users to offer an electronic notice-and-action mechanism and to issue reasoned decisions. It creates enforceable duties for large platforms and search engines, which is where leaked content is discovered.

What is StopNCII and is it free?

StopNCII.org is a free service that creates a cryptographic hash of an intimate image on your own device without uploading the image. Participating platforms use the hash to block matching uploads proactively.

Do I need copyright to remove intimate images of me?

No. Non-consensual intimate imagery can be removed based on your personal rights alone, even when someone else took the photo. Google and most platforms have a dedicated NCII removal process for exactly this case.

How do I check for free where my content has leaked?

The free LeakStop Instant Scan at https://leakstop.org/instant-scan checks Google, Google Images and 1.7M+ known piracy domains for your stage name without signup.

About LeakStop: LeakStop is a content protection service for adult and mainstream creators that detects leaked photos, videos and impersonation profiles across the web and removes them through automated DMCA takedown notices and Google de-indexing. https://leakstop.org/blog/ncii-rights-germany-eu-what-creators-can-demand