Image-based abuse is the Australian statutory name for a specific wrong: sharing an intimate image of a person online, or threatening to share one, without that person’s consent. It is not a synonym for a photograph you dislike, a tagged holiday snap, or a news picture from a court steps. The Online Safety Act 2021 gives the eSafety Commissioner a scheme built for this file, and the platforms have victim flows that, for once, often work. The playbook is about order and restraint. The image itself should travel as little as possible.
If you remember one rule from this guide, make it this one: do not send the image to a journalist, a “reputation agency”, a friend who “knows someone at Facebook”, or this desk. Identify it. Report it. Let the service and the regulator pull it. Every extra copy is a failure of the method. That rule is also in our editorial standards. We describe categories. We do not take receipt of the harm.
This is not legal advice. It is the operational sequence we recommend as of 2025–26. The companion pieces are what eSafety can actually order and the platform-level non-consensual intimate image tools.
What the Act means by an intimate image
The definition is visual, not poetic. An intimate image is a still or a video that shows a person:
- nude, or without clothing on the breasts, genital or anal region; or
- engaged in a sexual act of a kind the Act covers; or
- in a state of undress in circumstances where the person would reasonably expect to be afforded privacy; or
- without attire of religious or cultural significance that the person consistently wears in public, in circumstances of a reasonable expectation of privacy.
Digitally altered images count: a photoshopped nude, a face put on a body, a synthetic clip that will make people think it shows you. So does a nude that is not of you but is tagged as you. A blurred frame can still qualify once the circumstances are taken into account. Drawn comics and cartoons usually do not.
A reasonable expectation of privacy is about the making and the sharing. An image made in a relationship, on the understanding it would stay there, is the central case. A stage photograph published by the performer is not.
Either the person shown or the end-user who shared (or threatened to share) the image must be ordinarily resident in Australia, and the service must be a social media service, relevant electronic service or designated internet service. State and Territory criminal offences sit beside the federal scheme. eSafety is the removal regulator. Police are the crime investigators. In an extortion or a child file, use both.
Consent is not a vibe
Consent, for this Act, is express, voluntary and informed. A person under 18 cannot consent to an intimate image being shared, and neither can a person whose mental or physical condition means they cannot give that consent.
Consent to make an image is not consent to upload it. Consent to send it to one person is not consent to post it to a group. Consent given in 2019 is not, without more, consent in 2026. Even where the person shown originally agreed to the image being provided on a service, they can give eSafety an objection notice and ask that it come down. You do not need to win a debate with the poster about a kitchen conversation five years ago. Identify the URL and object. Do not delay the report.
Threats to share are the scheme
The Act prohibits the posting or the threatened posting of an intimate image without consent. Sexual extortion — pay, or this goes to your employer — is image-based abuse from the first message. You do not wait for the upload.
Preserve the threat: chat, username, time, platform. Do not open attachments you have not already seen. Do not pay on the theory that payment ends it. Report to the platform, report to eSafety, and if money is being demanded, report to police. A threat delivered by SMS still counts if it is a threat to share on a covered service.
Order of operations
Speed matters more than a tidy paper trail. Tidy is still useful.
1. Stop the spread you control. Do not forward the image to “check if it’s you”. Do not post a warning that contains the image. Do not upload the file to a random “takedown” vendor. Lock down the accounts that are about to be impersonated with fresh passwords and two-factor authentication that does not use the compromised phone number.
2. Capture identifiers, not a gallery. URL. Username. Date and time. A screenshot of the page that shows the image in place, cropped so that you are not manufacturing a new full-resolution copy to email around.
3. Report to the platform through the victim or intimate-image flow. Use that path, not the generic “I don’t like this post” button. The NCII tools piece is the button-by-button companion. Report from a surviving account. Keep a second, locked-down account that holds the evidence so a ban does not take the archive with it.
4. Report to eSafety the same day. You do not have to wait for the platform to finish — that is the difference from adult cyber-abuse, where a prior platform complaint is a condition of a removal notice. Say whether you are complaining or objecting, and whether a child is shown. Identify the material.
5. If there is extortion, violence, a child, or a school involved, report to police. eSafety can order a takedown. It cannot raid a bedroom in another suburb.
6. After the image is gone, do the leftovers. Search, caches, mirrors, Telegram forwards, broker pages. That is a different week of work. It is not a reason to delay steps 3 and 4.
Deepfakes and other synthetic intimate images follow the same order. They are intimate images. The deepfakes guide covers the extra problem of a file that was never a camera in a room. The reporting path is not a different statute.
What you send, and what you never send
eSafety and the major platforms are set up to receive a URL, a hash, or a limited screenshot. They are not set up to receive a zip of every nude you have ever taken. Do not send the original-resolution file “so they can match it”. Matching is their problem.
Do not send the image to this journal or any other newsroom; to a friend of a friend who “works in tech”; or to a reputation firm that asks for the file as a condition of a quote. A solicitor you have actually engaged may need to see enough of the material to advise you. A journalist does not have that relationship, and our editorial standards say we will not take the file. If a reporter asks you to forward the image “to verify”, the answer is no. Support that spreads the image in a group chat is not support.
What this playbook will not do
It will not make a news photograph of you on the street into image-based abuse, or take down a clothed wedding picture you posed for. It will not police a partner who still has a copy on a phone they have not uploaded; the Act is about provision on a covered service. A threat to upload that holding is another matter.
It will not replace defamation if the harm is a false caption on a clothed photograph. Get the category right before you pick the form. It will not, by itself, empty Telegram or a host that has never heard of eSafety. Those files become blocking-notice territory or a long programme of mirror-chasing. Start anyway. The first URL is the one that is ranking.
A working sequence we recommend
- Lock the accounts. Capture the URL and the threat. Do not circulate the image.
- Report to the platform’s intimate-image flow.
- Report to eSafety the same day. Object if you once consented and now do not.
- Report to police where extortion, a child, or a violent threat is in the file.
- Diary a check of the URL at 24 hours and at seven days.
- When it is down, move to search and to any mirror you can identify without opening new copies.
- Do not reward the inbox that asked you to pay.
If you want the desk to look at a general question about the process, use contact. Do not send the image, the dump, or the child’s name. We publish method. We do not run your case.