How to Protect Your Photos Online — and Find Stolen Copies

You can't stop a determined person from copying a photo you've posted publicly, but you can control who sees it, make copies less useful, and catch reuse early. This guide walks through privacy settings, watermarks, resolution, metadata and Content Credentials, then shows how to monitor for stolen copies and what to do when you find one.

Disclosure: this page contains an affiliate link. If you sign up through it, we may earn a commission at no extra cost to you. How we work.

Who copies photos, and why it matters

Photo theft takes two forms. Commercial reuse is when your landscape ends up in a hotel ad or your product shot appears on a dropshipping store. That's a copyright problem, solved with license fees and takedowns. Personal misuse is when selfies and family photos are lifted for fake dating profiles, scams or impersonation, or, as the FBI has warned, edited into fake explicit images for sextortion. That's a safety problem, and you fight it mostly by limiting who can see your photos and by reporting fakes to the platform. The steps below go from prevention to response.

Lock down privacy settings on the platforms you use

A photo that only approved followers can see is much harder for a scammer to find. It also won't be indexed by search engines. Menu names change often, but these paths matched each platform's help pages at the time of writing:

Notice the pattern: the profile photo is almost always public, and that's the image impersonators want most. For your profile picture, use one you wouldn't mind seeing on a fake account, and keep your clearest portraits behind the private setting. Also review old public albums, which are a common source of stolen photos. Facebook's Limit past posts changes them to Friends-only in one step, and you can't undo it in bulk. Finally, prune followers you don't know, because a private account doesn't help if you've accepted a fake account's follow request.

Watermarks: visible and invisible

Visible watermarks

A visible watermark is text or a logo placed over the image. Its job is to make reuse inconvenient and to tell people who made the photo. To make it work:

• Place it over the subject, not in a corner. A corner mark can be cropped out in seconds. A semi-transparent mark across the middle takes real effort to remove.
• Include something people can find. Your website or handle is more useful than a © symbol alone, because it tells honest people how to license or credit you.
• Keep the opacity low enough to preserve the photo. About 20–40% is a common range for portfolio work. Run a test export at full size.

Be realistic about what a watermark can do. AI "object removal" tools can erase many visible watermarks cleanly. A watermark stops casual reuse and makes the copier's intent obvious. In the US, deliberately removing copyright management information such as a watermark or a credit line can create separate liability under 17 U.S.C. § 1202. That gives you more leverage if the case ever becomes a legal claim.

Invisible watermarks

Invisible (forensic) watermarks hide an identifier in the pixel data. Commercial services such as IMATAG embed the mark and then scan the web for it, which can catch copies that have been cropped or recompressed. They're mostly sold to businesses and agencies. Content Credentials, covered below, now offer individuals a free alternative.

Resolution and metadata

Post smaller files, keep the originals

A web-sized image, around 1,200–2,048 pixels on the long edge, looks sharp on screens but is too small for a quality print, which limits its commercial value to a thief. Keep the full-resolution originals and RAW files offline or in private storage. A full-resolution original with its camera data intact is strong evidence that the photo is yours.

Strip location, keep authorship

Photo files carry EXIF metadata. That can include the camera model, the date, and on most phones the exact GPS coordinates where the photo was taken. For a picture of your house or your child's school, that's information you don't want to share. Large platforms like Facebook and Instagram remove most of it from the public copy, but email attachments, cloud share links, messaging apps that send "original quality" files, and some forums and websites may not.

• iPhone: In Photos, select the image, tap Share, then tap Options at the top of the share sheet and turn off Location. The sheet then shows "Location Not Included." To stop the camera from recording location at all, go to Settings → Privacy & Security → Location Services → Camera → Never.
• Android: Turn off location tags in your camera app's settings (the label varies by manufacturer).
• Desktop: Lightroom and most editors can remove location on export while keeping copyright fields.

Do add your name, a copyright notice and a contact URL to the IPTC fields. It costs nothing and helps in a dispute. See our guide to photo metadata and EXIF for a full walkthrough.

Content Credentials (C2PA): provenance you can attach

Content Credentials are an open standard from the Coalition for Content Provenance and Authenticity (C2PA). They attach a tamper-evident record to an image that says who made it, with what device or software, and what edits were applied. Think of them as a signed nutrition label for a photo. Some major tools now support them:

• Adobe Content Authenticity is a free web app, launched in public beta in April 2025. It lets you attach credentials to batches of images, including photos not edited in Adobe software. You can add your name and social accounts, verify your identity through LinkedIn, and set a "generative AI training and usage preference" that asks AI developers not to train on your work. Adobe says the credentials combine metadata with invisible watermarking and fingerprinting, so they can be recovered even after the metadata is stripped or someone takes a screenshot.
• Google Pixel 10 phones attach Content Credentials to every photo taken with the Pixel Camera, and Google Photos can display them.
• Anyone can inspect a file's credentials with the Content Authenticity Initiative's free Verify tool or Adobe's Chrome extension.

Content Credentials have limits. They don't stop copying, many websites still strip them, and the AI-training preference is a request that only cooperating companies honor. What they give you is a durable, timestamped claim of authorship.

Monitor for stolen copies

No amount of prevention stops every copy. The other half of protection is using reverse image search to check where your images have turned up.

Manual checks with free tools

1. Pick a watchlist: your profile photos, your most valuable images, and anything ever shared publicly.
2. Search each image on more than one engine. Google Lens has the broadest coverage. TinEye finds exact and modified copies, and its Oldest sort shows the earliest copies it crawled. Bing Visual Search and Yandex sometimes surface pages the others miss.
3. Log what you find in a spreadsheet with the image, URL, date found, a screenshot and the type of use.
4. Re-check on a schedule. Search indexes keep changing, so an image that returned nothing in March might show up in June.

Automated alerts: what actually exists

Unlike keyword alerts, image alerts are rarely free.

For most people, a quarterly manual check plus Google Alerts on your name is enough. Photographers with large portfolios may want a monitoring service, but read its terms first, especially the commission on recovered fees.

What to do when you find a copy

Before you contact anyone, save the evidence: full-page screenshots showing the URL and date, an archived copy of the page if possible, and the account name. Copies and fake profiles often vanish once confronted, taking your proof with them.

1. Contact the user or site owner. A short, factual message often works. Identify the image and where it appears, say you're the copyright holder, and ask for removal, credit or a license fee by a specific date.
2. Use the platform's copyright or impersonation form. Every major platform has dedicated forms. Impersonation reports usually need a photo of your ID, and copyright reports need the original and infringing URLs.
3. Send a DMCA notice to the host. If the site ignores you, find its hosting provider and send a formal takedown notice. You can also ask Google to remove infringing pages from its search results through its legal removals tool. Our step-by-step DMCA takedown guide includes what a valid notice must contain.
4. Escalate if the stakes justify it. In the US, the Copyright Claims Board is a voluntary, online small-claims option for disputes up to $30,000, where the other side can opt out. Larger commercial infringements may justify a copyright lawyer.

If your photos are being used to impersonate you

Report the fake profile with the platform's impersonation option rather than as a general complaint. Instagram, for example, has a form that people without an account can use. Ask friends to report it too, and post a short notice on your real accounts so your contacts ignore the fake. If someone tells you a profile using your face asked them for money, point them to our romance scam help guide. To check whether other fake profiles use your photos, run the same searches from our catfish check guide on yourself.

Protecting children's photos

In a June 2023 public service announcement, the FBI warned that criminals were using AI tools to turn ordinary photos, including photos of minors taken from social media, into explicit images used for harassment and sextortion. The FBI's advice is practical rather than alarmist:

• Be selective about what you post, and keep accounts that show your children private, with friend lists hidden.
• Remove identifying details such as school uniforms, house numbers and location tags. Share family photos through private shared albums instead of public posts.
• Ask schools, clubs and other parents about their photo policies, since many children's photos are posted by someone else.
• Search occasionally for your children's names, and run reverse image searches on photos you've shared publicly.

Removal tools exist if something goes wrong:

• Google accepts requests to remove non-explicit images of people under 18 from its search results. The minor or a parent or guardian can file the request. It removes the image from Google Search only, not from the website that hosts it.
• Take It Down, run by the National Center for Missing & Exploited Children (NCMEC), helps remove nude or sexually explicit images taken when someone was under 18. It creates a digital fingerprint (hash) on your device, so the image itself is never uploaded, and participating platforms use the hash to find and remove copies. Adults can use the similar service StopNCII.org.

If a child is being threatened or extorted, don't pay. Keep the evidence and report it to the FBI at ic3.gov, your local FBI field office, or NCMEC's CyberTipline.

Frequently asked questions

Sources & further reading

• U.S. Copyright Office: What photographers should know about copyright
• FBI IC3 PSA: Malicious actors manipulating photos and videos to create explicit content (June 2023)
• Apple Personal Safety User Guide: Manage location metadata in Photos
• Adobe: Introducing the Adobe Content Authenticity app
• Google Search Help: Remove non-explicit images of minors from Google search results
• NCMEC: Take It Down

Spotted an error or something out of date? Tell us — we review corrections promptly. Read how we research and update guides in our editorial policy.