PLACEHOLDER 1:1 · folded textile, flash, no skin
93 of 94:
A photo of your face was enough to name you in five minutes
Someone took photos of 94 German politicians and fed them to a face-search website. It found the right person 93 times out of 94. It took under five minutes. That site compares your photo against about 2.1 billion faces. A small, blurry photo beats it. So does covering your face. A picture from the side does not — it works just as well, which is the opposite of what most advice tells you.
PimEyes test, netzpolitik.org, 10.07.2020; index size per Bellingcat toolkit. This was tested on German politicians, not on sellers. The tool works the same way on any face, but nobody has run the same test on people doing this work. Checked
Why we sorted it this way
We sorted this by what gives you away, not by who might come after you. What someone else does is not yours to control. What you send out into the world is.
The uneven part
Only two of the eight can be undone later. One is the hidden extra data saved inside every picture file, which often includes the exact spot where the photo was taken. The other is the address you put on the parcel. The rest stay: your face, a tattoo, a birthmark, your voice, your DNA, the code printed on an instant photo, and your handwriting.
Counted from the list further down this page. Checked
What that means
Cleaning a photo’s hidden data does not change the photo itself
These tools delete the hidden notes attached to the file. They do not touch what the camera actually photographed — a tattoo, a reflection in a mirror, a stamp across the image. All of that stays exactly where it was.
mat2 manual, verbatim: “There is no reliable way to detect every single possible metadata for complex file formats.” It removes neither a stamp across the picture nor a message hidden inside the pixels. Checked
PLACEHOLDER 1:1 · lace on asphalt, 85 mm
46 % already do:
A birthmark gives you away just like a face does
Researchers asked sex workers how they pick the photos they post. Almost half of them — 46 in every 100 — choose their photos around tattoos and birthmarks. You can keep a mark out of a picture. You cannot take it off your body.
USENIX Security 2021, survey. Checked
What’s circulating
Apps like Glaze or Fawkes will hide my face from face-search sites
What’s true
They stop working the moment one normal photo of you is out there
These apps were built for a different job. They were made to stop AI copying an artist’s style. They were never meant to stop a website matching your face, which is the thing that actually happens here.
Hönig, Rando, Carlini & Tramèr, arXiv 2406.12027 (17.06.2024, rev. 11.02.2025): just enlarging the picture is enough to undo the protection, which the authors say leaves people with a “false sense of security”. Fawkes (USENIX 2020) claimed over 95 % protection. Leaving your face out of the picture, or covering it, is the only thing that reliably works. Checked
The list
Eight things that can give you away
For each one, the same question: can you undo it? Read the middle column straight down. That column is the whole point of this page.
What gives you away
Can you undo it?
What we found
Face
No
A face-search site named 93 of 94 politicians in under five minutes. A photo taken from the side works just as well. Small blurry photos and a covered face are what stop it.
PimEyes test, netzpolitik.org, 10.07.2020
Tattoo, birthmark
No
Almost half the sex workers surveyed pick their photos around these marks. You can keep a mark out of a photo. You cannot remove it from your body.
USENIX Security 2021, survey
Voice
No
Your voice is yours and cannot be swapped for another. That is a problem for audio clips, whispered recordings and voice messages — which happen to be some of the easiest things to sell over and over.
Category analysis; three seconds of recorded speech is enough to copy a voice
DNA
No
Cloth by itself does not carry your DNA. Things from your body do. A hair with the root still attached, spit or blood can identify you for good — and can even point to your relatives.
Category documentation. No known case of a seller ever being traced this way — this is the weakest entry on the list
The code on an instant photo
Avoidable
“On the back of every Polaroid photo, you’ll find a 10-11 digit code.” That code says which machine made the film, and on which day, month and year. It ties several of your photos together as coming from the same pack. For Instax film we found no such code described by the maker.
Polaroid Support 115012554408 / 115012396947, checked 13.09.2026
Handwriting
No
Handwriting can be compared and matched, the way it is in court cases. Put that together with the code on the film, and the most expensive thing people sell — a signed instant photo with a note written by hand — is no more anonymous than a digital photo you cleaned up. It just gives away different things.
Handwriting comparison as used in court; sales listings for the signed instant-photo format
Hidden data inside a photo file
Yes
Every photo file carries hidden extra data, often including the GPS spot where it was taken. You can strip it out on your own computer, for free. This is one of only two things on this list you can undo afterwards.
ExifTool FAQ #32. Watch out: with TIFF and RAW camera files, -exif:all= does not wipe every part
Your address on the parcel
Yes
A parcel has to carry a sender address. This is the second thing you can undo: rent a box at the post office, and the address on the parcel stops being the place where you sleep.
Postage rules → “Sending it”. Note: customs forms have to be filled in online; handwritten ones are refused
Two of the eight can be undone. A ninth entry belongs on this list and we left it out on purpose: the habits that show when you post and when you are online. We found only a passing mention of it and no measurement at all, so we did not give it a line of its own. Checked One entry left out
The mix-up
The tool everyone reaches for fixes the wrong problem
This is where most people waste their time, so we have given it the most room.
PLACEHOLDER 16:9 · wet asphalt, sodium, 35 mm
Fansly, own UI:
A VPN does not hide you from your neighbour
A VPN hides which country you are connecting from. It does nothing about who can look at your page. If what you want is “nobody in my own town should find me”, a VPN is the wrong tool. The right one is a setting on the site itself that shuts out visitors from places you choose. Only one site is documented as doing this down to a single town.
Fansly privacy settings, verbatim. Checked
How precisely each site can shut people out
Fansly
Country, state and town
“You can block Countries, States or Cities from accessing your profile.” Anyone you shut out just sees an empty page — in the site’s own words, “as if the profile doesn’t exist”. They are not told they were blocked. Checked
OnlyFans
Country and state only
“Block access to your profile and posts from selected countries.” We could not check this ourselves — onlyfans.com blocks the software we use to fetch pages, so this line rests on what others have written, not on the site itself. Could not check
So: if what you need is to keep your own town out, Fansly can do it and OnlyFans cannot. On OnlyFans you would have to shut out your whole state to get the same cover — and that means losing every paying customer in it.
In their own words · the limit Fansly admits to
“IP addresses are not always accurate to the city or state. It’s up to you to find a balance between privacy and minimizing revenue loss.”
Fansly, same panel
Shutting out a region only stops people who would have stumbled across you. It does nothing against somebody who is deliberately hunting for you, because that person can switch on a VPN just as easily as you can. It keeps out the neighbour. It does not keep out an ex.
Where a VPN really does cost you
Nobody bans your VPN. Appearing in the wrong country is what loses you the money.
We read the OnlyFans rules and privacy policy from start to finish and searched them. The words “VPN” and “proxy” (a proxy is a stand-in server that fetches pages for you, so the site sees its country instead of yours) do not appear once. So using one is not against the rules. The danger is different: if you look like you are in another country while the site is checking your identity or paying you out, that is when it goes wrong.
The rule
Make sure you appear to be in the same country as your ID and your bank account. Do not hop between countries. Never do it while you are signing up, or while you are changing where your money goes.
The site already has an error message ready for this: “Verification country did not match the country of your legal residence.”
Platform terms read in full; the error message as it appears in the product. Checked
Two answers
Does stamping your photos help?
It depends which of two jobs you had in mind. At one of them it fails. At the other it works.
IEEE S&P 2025:
A stamp cannot stop copying, and the tools to strip it are free
“defensive watermarking is not a viable defense”
UnMarker, IEEE Symposium on Security and Privacy 2025
One program strips these hidden stamps without needing to know anything about how they were made. After it runs, the stamp can still be found in fewer than half of the pictures — 43 in 100. Another team broke all five methods they tested, in under an hour of computer time, and the pictures still looked the same to the eye.
UnMarker, IEEE S&P 2025; Lukas et al., ICLR 2024; Zhao et al., NeurIPS 2024 with a formal proof. The programs that do this are free and public on GitHub. Checked
n = 43:
A stamp does tell you who leaked it
“14 participants practiced proactive watermarking … to trace specific people who stole the content via personalized watermarks”
Soneji et al., USENIX Security 2024
Giving every buyer a slightly different copy will not stop anyone stealing it. What it does is answer “which buyer’s copy is this?” — and at that it works. In one recorded case a stolen file was taken down because it could be traced back that way.
USENIX Security 2024, 43 people interviewed. This is a single study with a small number of people, and a lot of this page leans on it. Also from it: “OnlyFans does not challenge intellectual property infringement on behalf of its creators.” Checked
Steg.AI pricing:
Giving each buyer their own marked copy costs $10 a month
$10a month, sign up yourself
The cheapest plan gives you 100 marked files a month for one person. Its rules do not ban adult material — they only say what you do has to be legal. That is $10 a month, not the thousands these services usually cost.
steg.ai/pricing, retrieved and re-checked 13.09.2026. To be exact: hunting down a leak for you is part of their most expensive business plan. The $10 plan buys the marking itself, which is all you need to tell whose copy it was. For comparison: IMATAG starts at €299 a month, Truepic at $1,000 a month. Checked
What’s circulating
A visible stamp across your photo means fewer people steal it
What’s true
Nobody has ever measured this. There is no study either way.
Everyone tells you to stamp your pictures, and not one of them can point to a measurement. That does not mean stamping is useless. It means nobody knows, and the confident advice you have read was made up.
A hole in the research, and we are calling it a hole. We would rather tell you something is missing than fill the gap with a guess. Not measured
Difficult buyers
The difficult buyer, and why blocking comes last
Take away what they can see before you tell them it is over. The order you do it in is the safety measure.
PLACEHOLDER 16:9 · padded envelope, low angle, near-black lower 40%
AJPH 2003:
The most dangerous moment is the one where it ends
Research on women killed by their partners found that the risk roughly tripled after the woman moved out. If the man had also been very controlling, it rose to about nine times as high. Those numbers come from couples who lived together, not from buyers. What carries over is the pattern: the moment you cut someone off is the moment to plan for, not to rush.
Campbell et al., AJPH 93(7):1089, 2003; n=220 cases / 343 controls. aOR 3.64 (95 % CI 1.71–7.78) and 8.98 (95 % CI 3.25–24.83); the second range is very wide. Measured on women killed by a partner or ex-partner — not on sellers and their buyers. What we are carrying over is the pattern that separation is the peak, not the numbers themselves. Checked Different situation
The order other sellers use
Take away access without ever saying no
- Disappear from their viewShut out the town or region they are in. They just see an empty page, “as if the profile doesn’t exist”. You are gone, and they were never told no.
- Put your prices upOne seller raised her prices to “weed out assholes”. A higher price is just a number on a page, not a refusal aimed at anyone.
- Close off your messagesSet it so only paying subscribers can write to you, or only people who have already spent a certain amount. Asking for a card on file before anyone can follow you does the same job.
- Slow downReply more slowly instead of stopping altogether. Say it in your profile before it comes up, and turning something down stops feeling personal: “you are welcome to send requests but… I have every right to deny them.”
- Warn them, then limit them“restrict them or block them depending on the severity… how aggressive they’re being with it”
- Block them — and only nowBlocking works. It is also the one step that tells them plainly they have been rejected. Do it knowing that, not as your first move.
USENIX Security ’21 and ’24 (43 people interviewed), their own words quoted; Fansly documentation for the message settings. Checked
The catch nobody mentions
Blocking leaves you with an angry buyer who already paid
Blocking someone does not give them their money back by itself. If a refund is agreed, it comes out of your earnings. And the person you blocked keeps permanent access to everything they already bought.
Fansly documentation. This is exactly the situation the interviews describe as setting people off into obsessive behaviour. Checked
In their own words · how little the sites offer
“the only safe thing OnlyFans offers is blocking”
USENIX Security ’24, person 19
Which is the reason for the five steps above. If the site only gives you one blunt tool, the gentler steps have to come from your own settings and your own prices.
Why we do not simply tell you to go to the police
Nine out of ten people this happens to do not go to the police. In 2024, when sex workers reported violence to a support service, only 9 % agreed to have their details passed to the police. In 2012 it was 28 %. Even when the report had their name removed, only 35 % agreed, against 95 % back in 2012.
So advice that boils down to “report it if it gets bad” is only any use to one reader in ten. We list the laws below as tools you can pick up. We are not pretending they will make you feel safe:
A US law against sharing intimate images — it lets you sue the person who passed your private pictures around, and you are allowed to bring the case under a false name so your real one stays out of the court record. (15 U.S.C. § 6851) The law is real; the payout figure people quote is one we could not confirm
A US law that forces sites to take the pictures down — from 19 May 2026 a site has to remove them within 48 hours of you asking, and it covers AI-made fakes as well. This one helps in the two cases where copyright claims fail: photos somebody else took, and fakes that were never yours to own. (TAKE IT DOWN Act, Public Law 119-12, in force 19.05.2025) Checked
StopNCII.org — this one turns your picture into a short code on your own computer. The picture never leaves your device; only the code is sent. Sites then use the code to spot the same image. It still matches after someone resizes it, crops it, stamps it or saves it at lower quality.
The court case everyone quotes, and what it really decided
N.Z. et al. v. Fenix International Limited et al., No. 8:24-cv-01655-FWS-SSC (C.D. Cal.), Judge Fred W. Slaughter, Dkt. 251 of 19.05.2026.
The case was brought against two sets of people at once, and it ended differently for each. The version passed around online gets this wrong. The law at the centre of it is a US privacy law about who is allowed to see what you watch (its short name is the VPPA):
• Against the agencies that ran the accounts, that privacy claim was allowed to go ahead — the only part of the case that survived. (VPPA, 18 U.S.C. § 2710)
• The same claim against Fenix, the company behind OnlyFans: thrown out, with no chance to rewrite it.
• Every other claim against Fenix — organised crime, breach of contract, fraud, unfair business practices: thrown out, with no chance to rewrite them.
• The wiretapping claims had already failed in December 2025, because nothing was caught “in transit” the way those laws require. (CIPA, Federal Wiretap Act)
So this is a case about who may see what you watch, not about wiretapping, and it was heard in a federal court in California. The judge pointed straight at the customer-tracking software the agencies used — the kind of tool that keeps notes on every buyer — and said that passing data through it was not covered by the “this is just normal business” excuse.
What this means for the notes you keep on buyers: the trouble came from tying a name to what that person watched. It did not come from recording how much they spent. So a note about how much someone spends is far safer to write down than a note about what they are into. In Europe the rules are stricter still: notes about someone’s sexual tastes count as especially protected data, so a “what they are into” field is the risky one there.
One warning about all of this. At this stage the judge was only asking whether the claims were worth hearing at all. Nobody has decided yet what actually happened. No fact has been proven, other courts do not have to follow this, and none of it is legal advice for your own situation.
Tool · free, nothing leaves your computer
Strip the hidden data out of a photo
“Does this photo show where I live?” The tool works inside your own browser. Your picture is never sent anywhere — which is exactly why you can trust it with the picture.
This hidden data is one of only two things on this page you can take back. If you would rather do it on your own machine: exiftool -all= image.jpg. Checked
A rule, not a product
Never use the same username twice
Reusing a name is the easiest way to be found. Free tools take one username and check it against hundreds or thousands of websites in one go, then hand over every account that matches. Your work name and your own name must never share a username.
Sherlock checks 400+ sites, WhatsMyName 669, Maigret over 3,000 and it reads the profile pages too. Checked
What this page cannot do for you
Staying hidden and earning more pull against each other
The research on this market is blunt about it: buyers want to feel a connection, and sellers who show their faces earn more. Every step on this page costs you something, in customers or in money. We are not going to tell you which trade to make. What we can tell you is which of these things you can never take back — so that what you give away is what you decided to give away, and not something you did not know you were handing over.
Interview-based field research; and the trade-off Fansly spells out in its own settings screen. Checked
Where next
The same things, looked at five ways
Everything people sell here turns up on all five pages, each time with a different question asked of it.
Start
All 19 things people sell
How much one body can make, the one flat postage price, and all 19 things people sell
Hub 1
What pays best
Which work pays best for the hours you put in — and which kinds make you show your face or your voice
Hub 2 · you are here
Who can find you
You are reading it. Who can work out who you are.
Hub 3
Getting paid
Where the money disappears on the way to you — and whose name shows up on the buyer’s bank statement
Hub 4
Sending it
What gets there and what gets stopped — the address on the back of the parcel is covered here
Hub 5
Regular buyers
How one buyer becomes ten sales — and when your notes about buyers turn into a legal problem