What is a photo leak?
A photo leak happens when personal or sensitive photographs are obtained and distributed without the consent of the individuals in the images. This can happen through various ways, such as hacking into cloud storage accounts, unauthorised access to personal devices, or exploiting vulnerabilities in online platforms.
These photos may be shared on the internet, social media, or other digital channels without the owner's permission, leading to privacy violations, reputational damage, and potential legal consequences.
What are the implications of a photo leak?
Photo leaks can arise for various reasons, including hacking, data breaches, lost or stolen devices, intimate image abuse, social engineering, accidental sharing, and insecure practices like weak passwords or neglecting software updates.
A photo leak can have serious consequences, including privacy violation, emotional distress, damage to reputation, blackmail, legal repercussions, and cyberbullying. It can lead to feelings of shame, embarrassment, anxiety, and depression, as well as potential harm to personal and professional relationships.
Offenders may attempt to extort money or other favours. Both they and those who share the photos without consent could face legal action. Overall, it's crucial to address such incidents promptly and to take steps to prevent them from happening.
What should I do if someone is threatening to leak my personal photos?
If someone is threatening to leak your personal (or intimate) photos or videos (this is defined in more detail below), this can be considered sextortion, which is the abbreviation for 'financially motivated sexual extortion'. This form of online blackmail involves criminals threatening to expose sexual images, videos, or details about you, focused on extorting money by forcing you into doing something against your will.
It can also be considered intimate image abuse (or ‘revenge porn’), which is the act or threat of leaking personal photos or videos without your consent, with the intention of causing you distress.
Is sharing private photos or videos a crime?
Yes, sharing private photos or videos without permission is a crime in England, Wales and Scotland.
Sharing private photos or videos includes uploading them to the internet, sharing them with others via email or text, and showing someone a physical or electronic version.
England and Wales
The Criminal Justice and Courts Act 2015 (CJCA 2015) made sharing private photos or videos without permission a crime. It applies to such offences committed between April 2015 and 31 January 2024. It also explicitly addressed revenge porn.
Since 1 February 2024, the Sexual Offences Act 2003 (SOA 2003) has made sharing private photos or videos without permission a crime. Specifically, it makes the following acts crimes:
-
sharing an intimate photo or video without the consent of the person shown or a reasonable belief of having their consent
-
sharing an intimate photo or video without the consent of the person shown, with the intent to cause alarm, distress and humiliation
-
sharing an intimate photo or video without the consent of the person shown, or reasonable belief in their consent, for the purpose of obtaining sexual gratification
-
threatening to share an intimate photo or video
The SOA 20023 defines an intimate photo or video (including manufactured or altered images like deepfakes) as one that shows or appears to show another person in an intimate state. This will be the case if the photo or video shows or appears to show:
-
the person participating or engaging in an act that a reasonable person would consider to be a sexual act
-
the person doing a thing that a reasonable person would consider to be sexual
-
all, or part of, the person’s exposed genitals, buttocks or breasts (this includes if they are visible through wet/transparent clothing or obscured by underwear)
-
the person in the act of toileting, or
-
the person carrying out an act of personal care associated with the person’s toileting
Scotland
In Scotland, it is illegal to share, or threaten to share, an intimate photo or video with the intent to cause fear, alarm, or distress. Sharing (or threatening to share) an intimate photo or video recklessly is also against the law.
Under the Abusive Behaviour and Sexual Harm (Scotland) Act 2016, a photo or video is considered intimate if it shows:
-
a person engaging in, participating in, or present during an act that a reasonable person would consider to be a sexual act, and which is not normally done in public, or
-
the person's genitals, buttocks or breasts exposed or covered only with underwear
While the Abusive Behaviour and Sexual Harm (Scotland) Act 2016 does not apply to photos or videos that are entirely computer-generated, it does apply to those that are digitally enhanced or manipulated (eg Photoshopped).
Other legal considerations when private photos are leaked
Another aspect to consider is the context in which you find yourself. Contexts that carry additional considerations include:
-
when private photos are sent to another person - sending private photos to another person doesn't grant them the right to share them online. In addition, making threats to publish these photos could potentially constitute a criminal offence, especially if the individual demands money in exchange for not posting them, which amounts to blackmail under the Theft Act 1968
-
when private photos have been obtained through hacking into a mobile device or an individual account - the Computer Misuse Act 1990 outlines a range of offences associated with unauthorised access to computer data, all of which carry potential prison sentences as punishment, so if photos have been acquired through unauthorised access to a mobile device or an individual's account, probably an additional offence has occurred
-
when private photos belong to a minor - in England and Wales, under section 1 of the Protection of Children Act 1978, it is illegal to produce, distribute, possess, or display any indecent images to or of individuals under 18, regardless of whether the content was created with the consent of the minor. Similar provisions exist in Scotland under the Civic Government (Scotland) Act 1982. For more information and support, visit the NSPCC website
The UK General Data Protection Regulation (GDPR) should also be considered. The GDPR is the UK’s key data protection law, which protects individuals’ ‘personal data’ (ie any information that may identify a person, either directly or indirectly). Personal data encompasses direct identifiers like names, ID numbers, and addresses, as well as indirect identifiers such as phone numbers, credit card numbers, vehicle number plates, online identifiers (eg IP addresses), and personal characteristics (eg appearance or identity, including when having your photos leaked). The definition is broad, meaning almost any information related to a person can be considered personal data if it can be linked to them. As images of people are often considered personal data, anyone dealing with such images in a business context should be aware of the data protection rules they must follow. For more information, read our General Data Protection Regulation (GDPR) FAQs.
What should I do if my photos get leaked?
Having your private photos or videos leaked can be an incredibly stressful and emotionally challenging experience. The breach of privacy that accompanies such a leak can feel overwhelming and deeply invasive and may leave you feeling vulnerable and unsure of where to turn. However, it’s crucial to remember that you are not alone, and there are concrete steps you can take to regain control and protect your privacy. When necessary, you should:
-
end all contact with the offender immediately - avoid communicating with the person threatening you, as engaging may cause the situation to get worse
-
save all the evidence - keep all evidence associated with the threat, including messages, emails, screenshots of online interactions, and important URLs where your leaked photos may be accessible. This evidence will be essential for the police investigation
-
report the leak to the local police - contact your local police and notify them of the incident. Keep in mind that sextortion and threats to leak personal photos are severe offences, and the police can offer assistance and conduct an investigation into the matter
-
report the leak to the platforms - report the offender to the platform where the threat was made, as some social media and online services have mechanisms to handle such issues
-
seek emotional and mental support - given that having your photos leaked can result in feelings of shame, embarrassment, anxiety, and depression, as well as potential damage to personal and professional relationships, it's important to seek support to overcome this situation. The Revenge Porn Helpline provides a list of services that provide support, advice and information in such circumstances
-
seek legal support - this should be from a lawyer who has experience with your type of situation, to help you fully understand your rights and any potential legal actions you can take against the perpetrator. The Revenge Porn Helpline website provides a list of free legal advice services that may be able to help
For more information and/or support, visit the Revenge Porn Helpline online or by calling 0345 6000 459 (Monday to Friday, 10am - 4pm).
How do I report a photo leak?
If you find out that your private photos have been leaked online, you should take immediate action to report it. You should report it to the local police, contact the website or platform hosting the photos, request their removal, and cite a violation of privacy and potential copyright infringement, if applicable.
What if the victim is under the age of 18?
Any sharing of private images of individuals under 18 carries additional complexities and concerns. Various additional steps can and should be taken, often by the individual’s parents or caregivers, to make sure all appropriate actions are taken to protect the individual involved.
In this situation, additional advice should be sought. For more initial information, see the NSPCC’s guidance, and contact your local police if an incident occurs.
How can I protect myself after getting hacked?
Being hacked can cause considerable stress, anxiety, and a sense of vulnerability, impacting one's mental health and wellbeing. It's crucial to prioritise looking after yourself during this time, including:
-
looking after yourself and reaching out for support - after going through a distressing experience, it is important that you look after your mental and physical wellbeing. Consider speaking to trusted family members and/or friends and consider seeking professional help. You can find a list of support providers on the Revenge Porn Helpline website
-
consider adding Google Alerts for your name - you may find it useful to set up Google Alerts (eg for your name), which will send you email alerts whenever the alert terms appear on Google (eg when someone mentions your name). Follow Google’s steps for creating a Google Alert
-
hash your photos or videos on the Stop Non-Consensual Intimate Image Abuse (StopNICC) website - ‘hashing’ refers to the practice of assigning a unique hash value to an image or video which acts as a ‘digital footprint’. Any duplicates made will have the same hash value. StopNICC shares the hash value with participating websites so they can help detect and remove the images or videos from their websites, thereby preventing them from being shared online
You can find more information and help on the Revenge Porn Helpline website. For more information, visit the Childline website.
Note that the information in this insight applies to situations involving leaked photos of adults. The NSPCC’s guidance is a good starting point for information about leaked photos involving individuals under 18.
