Case study: OnlyFans copyright takedowns for a creator with 820,000 subscribers

01The case: an agent and 820,000 subscribers

The request came from the creator's agent, not from the creator. The creator runs an OnlyFans account with about 820,000 subscribers, and the brief was short: photos and videos sold behind the paywall were appearing in places the creator had never authorised, and they had to come down.

A paying subscriber downloads the content and re-posts it on a free tube site, a leak forum or a messenger channel. Once those pages are indexed, anyone can watch for free. For the creator that is two losses at once: the work is copied without permission, and subscription income leaks out through every free copy.

Three things set this apart from a typical leak. The content was made and sold by the creator. The legal basis was copyright, not privacy. And the work did not end with one clean-up: the agent proposed a five-year contract from the start, and SARAZIM LLC is still managing it.

02Not a leak case: why copyright applies

The first question at intake is nearly always the same: the creator filmed it and sold it, so can it still be removed? It can. The door is different, and so is the paperwork.

Leaked video removal deals with material recorded without consent, or recorded with consent but shared without it. The argument is about privacy and consent, and the core of the file is proof of identity and of the harm done.

Here the material is the creator's own work, sold on one platform to paying subscribers only. Selling access is not a licence to repost. The OnlyFans fan contract says the licence a creator grants lets a fan access content for the fan's own private, personal, non-promotional and non-commercial use, and gives the fan no ownership of it. A subscriber who uploads it elsewhere is reproducing and distributing a work without permission, and that is what the notices rely on.

A copyright notice has to show three things: who owns the original, that the posted file is the same work, and that the owner never authorised this use. The harm needs little explanation; the ownership chain must be exact.

03Five places paid content ends up

Copies of subscription content travel along a few routes, each with its own door. Sorting what sits where at the start sets the pace for everything after it.

The five are linked. Delete a forum post and leave the file on the host, and it returns under a new link. Take a video off a site and leave the search result, and the result points people to the next copy. Clearing one route only is why clients often see no change after a first round.

Messengers have their own limits. The Telegram FAQ says copyright complaints about public channels, bots and sticker sets go to dmca@telegram.org, and that private groups and chats are private among their participants and Telegram does not process requests about them.

04Who files, and what proves the rights

Not anyone can send a copyright notice. Under the US copyright takedown system, a notice must carry the signature of the owner or of a person authorised to act for the owner. With an agent involved, that chain is set out first: the creator owns the rights, the agent manages the creator's business, and SARAZIM LLC is the authorised agent for filing. Without that authority in writing, a challenge to the sender's standing has no answer.

The notice itself must be written, sent to the provider's designated agent, and contain the signature; identification of the work and of the infringing material in enough detail to locate it; contact details; a statement of good-faith belief that the use is not authorised; and a statement that the notice is accurate and, under penalty of perjury, that the sender is authorised. A notice that does not substantially comply generally does not count as giving the provider knowledge.

Registration is not a precondition. The US Copyright Office states that protection exists from the moment a work is fixed and that registering is not mandatory, while registration, or a refusal, is needed before suing over a US work. A takedown notice can go out without it.

Matching is done by people. Reporting someone else's similar content by mistake is a problem in itself. SARAZIM LLC does not keep the content; it compares against metadata and hash values, and only items that pass that check go on the notice list.

05What OnlyFans will and will not do

Creators often assume the platform deals with this. The OnlyFans Terms of Service say OnlyFans does not own the creator's content, that the creator grants it the right to send infringement notices on the creator's behalf to third parties infringing that content, and that OnlyFans is under no obligation to send such notices or to police infringements.

Its DMCA takedown policy covers reports of infringing content published on OnlyFans itself, and a separate complaints policy explains how to complain about infringement on other platforms. Neither puts a duty on OnlyFans to chase copies across the web. In practice, once content has left the platform, protecting it falls to the rights holder.

The fan licence still matters. It is non-transferable, revocable and limited, and it expires automatically in set cases, for example when a subscription period ends and is not renewed. That is the text to quote when an uploader replies that the file was paid for.

06The order: site, host, CDN, search

Requests work down the chain, starting with the site operator. The US system protects a provider that, on receiving a proper notice, responds expeditiously to remove or disable access to the material, which is why most overseas sites keep a copyright channel. The Copyright Office keeps a public directory of designated agents.

If the operator stays silent, the next door is the hosting company whose servers hold the site. It is in the same position once it receives a valid notice about material stored on its systems, and its protection depends on acting on it.

Many sites sit behind a CDN, so the real host is hidden. Then the notice goes to the CDN. Cloudflare states that it does not host content through those services and cannot remove what it does not store, but that it forwards the complaint to the website operator and the hosting provider and gives the host the origin IP address so it can locate the content.

Last comes Google Search. Even if a page refuses to come down, a copyright removal request can take it out of results. Google says it complies with copyright notices under US law, and requests start from its legal removal troubleshooter, which asks whether you are the owner or authorised to act for one. Out of results, a copy loses its easiest audience.

07Keeping the creator's name out of it

A notice carries the sender's name and contact details, and some sites pass them to the uploader. Google states that it may try to notify the alleged infringer or the site operator, and may forward the content of a notice to Lumen, a nonprofit that publishes notices after removing certain personal information.

Google's own list is precise. For copyright requests it generally shares with Lumen the type of request, the name of the person who made it, the rights holder's name, the URLs, the country, the date, attachments, the explanation and a quote of the content. It never shares what is entered in the contact information fields. Where a results page is affected, a notice at the bottom can link to the request published at Lumen.

So the agent filed, not the creator, with the agent's contact details on every notice. Telegram accepts complaints from the owner or an authorised agent, so this works there too.

For a creator who earns under a stage name, a legal name in circulation can do more damage than the leak. That is why filing goes to an agent.

08Counter-notices and the cost of a bad notice

The uploader can push back. Under the US system a counter-notice must be signed, contain a statement under penalty of perjury that the material was removed by mistake or misidentification, and consent to federal court jurisdiction. The provider then restores the material within 10 to 14 business days unless the original sender reports that it has filed a court action.

The other edge is liability. Anyone who knowingly and materially misrepresents that material is infringing can be liable for the resulting damages, including costs and attorneys' fees. Bundling unchecked look-alikes invites a dispute that stalls the items that matter.

In this case only matched items went into notices, and for each one the basis for treating it as the same work was recorded.

09Why the agent asked for five years

What stood out most was the term. Removal work usually starts with what is out there now, plus monitoring for a set period. This agent proposed a five-year contract before anything else.

The first reason is the content model. A subscription creator posts new material continually, and every release produces new copies. Clear the backlog once and next month's copies pile up again. The agent knew from experience that removing what has already spread does not close the revenue leak.

The second is continuity. The same sites, forums and uploaders keep returning. Which operator answers which notice format, which host moves fast, which uploader returns under a new account: that knowledge builds up over time and resets whenever the provider changes. US law requires providers to terminate repeat infringers in appropriate circumstances, and a long record is what makes that usable.

The agent asked about price before asking how the work is done, weighing the cost against the income to be protected. The scale of the contract discussed for that term and scope surprised SARAZIM LLC. For a creator selling to paying subscribers, unauthorised copies are a revenue problem, and the agent treated protection as a business cost.

What sets the price of copyright management

• Volume: number of creators, number of platforms, and how much new content appears each month.
• Scope: tube sites, forums, file hosts, messengers, search results, or a subset.
• Frequency and reporting: how often the search runs and how each round is reported.
• Term: a one-off clean-up, or long-term management.

10The monthly cycle, still running

After signing, the work is unglamorous, and it repeats every month.

1. Register each new release by recording its metadata and hash values.
2. Search the agreed scope: sites, forums, messengers and search results.
3. Confirm rights, match each find against the original, and record it.
4. Send takedown notices to the site operator, the host and the CDN.
5. Request removal from search results, so a surviving page loses its traffic.
6. Report the round: what was checked, requested and removed. Then start again.

That repetition is why leak removal and copyright management are separate categories. Leak removal finds what spread, removes it and watches for re-uploads; the goal is for the material to disappear. Copyright management keeps a catalogue still on sale from staying anywhere unauthorised; the goal is to protect the sales channel. The tools overlap, the endpoint does not.

SARAZIM LLC handles 52,142+ removals a month on average across 914+ platforms, with a 98.2% removal rate, and runs leak removal and copyright management as separate procedures. Its founder is a security professional, formerly at Palo Alto Networks, holding CISSP, CISM, CEH, OSCP and GIAC GASAE.