Study: Cloudflare, Google and Namecheap Keep Deepfake Abuse Sites Online

A peer-reviewed study published in Stanford's Journal of Online Trust and Safety finds that a handful of large internet infrastructure companies keep websites hosting AI-generated non-consensual intimate imagery (NCII) online, though the providers' own terms of service prohibit illegal content.

What the study examined

The authors are Hany Farid, a computer science professor at Dartmouth College, Sophie Nightingale, a senior lecturer in psychology at Lancaster University, and Lancaster project coordinator Sarah Morgan. Over six weeks between February and March, they used keyword searches and Google Alerts to collect 400 URLs, then narrowed them to 88 sites actively hosting such imagery. Using open-source tools such as WHOIS, they mapped which companies supplied each site's hosting, domains, mail, advertising and content management system.

The five dominant providers

The paper states that "five players emerged as dominant infrastructure providers: Cloudflare, Google, Namecheap, WordPress, and Protonmail." Cloudflare supplied what the researchers call the lion's share: website hosting, a content delivery network, domain-name servers and analytics. Google provided SSL certificates and advertising space for most of the sites studied, Namecheap was the dominant domain registrar, WordPress the main provider of content management systems, and Proton the mail server provider. Most of the imagery depicted female celebrities, actresses, pop singers, K-pop idols and women working in politics or activism.

How the companies responded

Cloudflare, Proton and Namecheap did not respond to 404 Media's requests for comment. Google said it has strict policies against non-consensual explicit content and that it demotes sites with many removal requests in search. WordPress said it is "open-source software, not a hosting provider," because WordPress.org does not host websites. Farid disputed that: WordPress.com, run by Automattic, hosts millions of sites, and its Jetpack CDN can serve images from i0.wp.com even when a site is hosted elsewhere, which he called "infrastructure by any definition."

Cloudflare has cut off similar sites before, including Kiwifarms in 2022, but in 2023 it told victims of the Girls Do Porn trafficking ring that it does not control the content of sites using its services.

What the researchers recommend

The authors call on providers to stop supplying services once a site is identified as hosting non-consensual imagery, to improve moderation, and to work with NGOs and governments to verify URLs and share them with platforms so they can be blocked. The study also found that 312 of the 400 URLs initially collected were unrelated to deepfakes: gambling, travel or cooking SEO sites that used NCII keywords only to rank higher in Google search results.