Hash Matching

Hash matching is a way of recognizing an image without looking at it. Software turns a picture into a short code, a hash, that works like a fingerprint. When someone uploads a file, the platform computes its hash and compares it with a list of hashes of images already known to be abusive. With so-called perceptual hashes, the match still works if the image has been resized, cropped slightly or recompressed. The technique is a standard tool against child sexual abuse material and, increasingly, against non-consensual intimate images, real or synthetic.

Why it matters

For victims of intimate image abuse, the worst part is often the repetition: an image removed in one place reappears in ten others. Hash matching attacks that cycle. Microsoft’s PhotoDNA made the approach common for child abuse imagery. StopNCII, run by the UK charity SWGfL, lets adults create hashes of their own intimate images on their own device and share only the hashes with participating platforms, so the pictures themselves never leave the phone.

Regulators are now making the technique an expectation. In June 2026 the UK regulator Ofcom recommended that certain platforms use hash matching to detect intimate image abuse. In its October 2026 bulletin it described an enforcement program focused on exactly that.

The limits are real. Hash matching only finds images that are already known. A newly generated deepfake has no fingerprint on any list until someone reports it. Perceptual hashes can also produce false matches, and critics worry that infrastructure built to scan for one kind of content can be widened to others.

Example

A woman discovers that a nudified image of her, made from a holiday photo, is circulating in a forum. She cannot stop the first copy from having been seen. But after reporting it and submitting its hash to a matching service, she can make it much harder for participating platforms to accept the same file again.

The AIrotic angle

Generative AI has made intimate images cheap to fabricate and endlessly reproducible. Hash matching is the counter-move of the same digital logic: if an image can be copied infinitely, it can also be recognized infinitely. The body becomes a fingerprint in a database, this time to protect it.

There is an irony here. The defense against synthetic intimacy is itself a machine that never sees the image, only its trace. Consent, in this system, is enforced by mathematics after the fact, which is better than nothing and far less than prevention.