StopNCII vs Take It Down: Picking the Right Hash Tool
StopNCII and NCMEC Take It Down both block intimate images with on-device hashing, but they serve different people: StopNCII for adults (18+), Take It Down when the image was taken under 18. How each works, their limits, and how they fit the TAKE IT DOWN Act.
StopNCII is for adults: you must have been 18 or over when the image was taken. NCMEC's Take It Down is for images taken when you were under 18, even if you are an adult now. Both work the same protective way: the image never leaves your device, only a digital fingerprint (hash) is shared, and participating platforms block matching uploads. Neither covers the whole internet, and knowing that honestly is part of using them well.
The one question that decides it
How old were you when the image or video was made? That single fact routes you:
| StopNCII.org | NCMEC Take It Down | |
|---|---|---|
| Who it serves | 18 or over in the image | Under 18 when the image was taken (any age now) |
| Run by | Revenge Porn Helpline (SWGfL) | NCMEC (National Center for Missing & Exploited Children) |
| How it works | Hash created on your device; image never uploaded | Same on-device hashing; image never uploaded |
| Where it reaches | Participating platforms (partners include Meta, Microsoft, Discord) | Participating public, unencrypted platforms |
| Cost / account | Free, no name required, case number for follow-up | Free, no name required |
If you start the wrong one, nothing breaks: Take It Down itself redirects people who were 18+ in the image to StopNCII. But starting in the right place saves a step at a moment when every step costs energy.
What "hashing" means, in plain words
Both tools create a digital fingerprint of the image on your own device. The picture itself is never uploaded, never seen by a human reviewer at StopNCII or NCMEC, and never stored on their servers. Only the fingerprint travels. Participating platforms compare uploads against the fingerprint list and act on matches under their own intimate-image policies. This design exists precisely so that using the tool cannot itself spread the image, and it means you can act before anything is posted, on the strength of a threat alone.
The honest limits
- Participating platforms only. A hash does nothing on a site that does not check the list. Dedicated leak sites and many fringe forums do not participate; those need direct takedown requests, Google de-indexing, and the legal levers in the removal plan.
- Already-posted content is harder. These systems are strongest at blocking re-uploads. For content already live, pair the hash case with direct platform reports, where the TAKE IT DOWN Act now gives US victims a 48-hour removal right against covered platforms.
- Deepfakes of minors need one more step. Take It Down's public materials speak in terms of real photos and videos, and its AI coverage is not spelled out. A sexualised AI image of someone under 18 is unambiguously illegal under the TAKE IT DOWN Act, with enhanced penalties, so alongside the hash tool, report it to NCMEC's CyberTipline and directly to the platform. Our guide for parents, finding a deepfake of your child, walks that path step by step.
Using them well: the order of operations
- Preserve evidence first: URLs, usernames, dates, screenshots of the posts and threats (of the surrounding context; for under-18 imagery, record locations and URLs rather than saving the material itself).
- Run the right hash tool: StopNCII (18+ in the image) or Take It Down (under 18 when taken). Note your case number where given.
- Report directly on each platform where the content appears, citing its intimate-image policy and, in the US, the TAKE IT DOWN Act's 48-hour duty. Routes per platform are in the social-media guide.
- De-index from search with Google's removal process, which works with StopNCII through hash partnerships.
- Escalate legally if needed: criminal report, civil action, or counsel, covered in suing for a deepfake.
The Takedown Action Plan on our homepage builds this sequence for your exact situation, platform, age and jurisdiction, entirely in your browser, with nothing about you sent anywhere. Rules current as of June 2026; this is general information, not legal advice.