Want your leaked content removed automatically? Privly runs a fully-managed automated DMCA takedown service: automated scanning, DMCA filing across 500+ leak sites, and escalation until content is removed or de-listed, flat $49/month.
Privly publishes a periodic snapshot of copyright takedown activity against the sites where creators' content most often ends up, using public data from Google's Transparency Report. This is the Q2 2026 edition, the first public report. Across the 50 sites we track, over 77 million URLs have been submitted to Google for delisting. 4.9 million of those were submitted in the four weeks before publication. This report is written for creators and the people who help them: what the data says about removal, and where effort is best spent.
A note on how we present this. The goal is to help creators get content removed, not to point anyone towards places to find it. So in this article we describe sites by category and rank rather than by name. Creators who need site-specific help can use our removal guides, linked at the end.
The headline numbers
77,071,655 URLs have been submitted to Google for delisting across our 50-site cohort, all-time. 4,906,829 were submitted in the last four weeks: roughly 1.2 million new takedown URLs every week against this one slice of the problem. The cohort spans aggregators, tube sites, file hosts, forums, and deepfake-specific sites. Of the 50, 45 had Google data; five returned no records at all, mostly newer or smaller domains.
These numbers come from a public source: Google's Transparency Report publishes copyright removal request counts for each domain. We pulled the per-domain data, aggregated it, and publish the synthesis. Our methodology is documented on the Observatory page.
Finding 1: aggregators dominate, not tube sites
The biggest surprise is how far the aggregator sites outweigh the well-known tube sites. A lot of creator-protection writing focuses on the household-name tube sites, as if that's where most leaked content lives. The takedown data says otherwise.
Our cohort includes eight large tube sites owned by or associated with the major tube operators. Combined, they account for around 10 million all-time URL takedown requests. The aggregator category, sites that collect and organise creators' paywalled content by name, accounts for over 65 million. That's roughly six times the volume, from a category with fewer sites. The single largest aggregator alone has more than 24 million URL requests, more than all eight tube sites combined.
The ten largest sites in the cohort by all-time requests, by category:
What this means for creators: the major tube sites are usually the easier part of removal. They have working DMCA processes and generally respond to properly formatted notices. Aggregators are more numerous, harder to deal with, and where much of creators' content actually ends up. If you're deciding where to focus, don't assume the big names are the whole problem.
Finding 2: recent activity matters more than lifetime totals
Lifetime takedown counts mix content leaked ten years ago with content that appeared last week. The last-four-weeks figure is a better guide to where content is landing now.
The pattern is sharply split. Several sites with large lifetime totals are close to dormant: one file host with more than 24,000 lifetime requests had just 10 in the last four weeks, most likely because its operator moved to a different domain. The largest dedicated deepfake site in the cohort, which shut down permanently in May 2025, shows almost no recent activity. Meanwhile, the most active sites are receiving enormous volumes: the single most-targeted aggregator saw 2.35 million URL requests in four weeks, roughly 587,000 a week, and the second saw 1.97 million.
What this means for creators: when you're checking where your content is and prioritising removal, recent activity tells you more than a site's history. Sites go quiet and new ones appear, so monitoring needs to keep up.
Finding 3: mirror domains split takedown effort
This is the most practically important pattern, and it's invisible if you look at one domain at a time. Some operators run the same site under several domain endings, so takedown requests get split across them. We identified eight pairs of domains that appear to be run by the same operator. In some pairs the original domain carries almost all the volume. In others, the "mirror" is much larger than the domain most people associate with the site: in one pair the secondary domain had around 50 times the volume of the primary.
What this means for creators: filing only against one domain can leave the same content live on another. A removal workflow has to check for every active version of a site and file against each separately. It's also a reason to look closely at any "removal success rate" a service quotes: removing a URL from one domain while the same content stays up on its mirror isn't really a removal.
Removing a URL from one domain while the same content stays up on its mirror accomplishes very little, but a workflow that only checks the primary will count it as a success.
Finding 4: tube sites have a long tail, aggregators have a peak
Tube sites show steady, slow takedown volume going back to 2011. Aggregators have shorter histories, most appearing between 2018 and 2022, but their weekly volume is far higher while they're active.
What this means for creators: a removal process built for tube sites can keep working for years, because those sites are established and their processes are stable. Aggregators need continuous adaptation as new domains and new sites appear. A once-a-quarter sweep won't keep up with them.
What the data doesn't tell us
These are takedown requests, not confirmed removals. Google acts on most valid requests, but some are rejected or partially actioned. The figures measure what rights holders asked Google to remove, no more.
Google groups data by exact domain. Subdomains and alternate domain endings are counted separately, which is why the mirror-domain pattern matters.
The data covers Google only. Notices sent directly to a site, its host, or its infrastructure providers aren't included, and that's where much of the actual removal work happens.
The data doesn't capture Telegram channels, Discord servers, or search engines other than Google. All of these matter for creators and none are in the Transparency Report.
What this means if you're a creator
Three practical takeaways. First, de-indexing works at scale: the volume of requests reflects how much effort rights holders put into cutting off search traffic, and you can use the same tool yourself through Google's copyright removal form (see our Google removal guide). Second, file against every version of a site, not just the one you found first. Third, keep monitoring, because the sites where content lands change over time.
If you need help with a specific site, our removal guides cover the process step by step, for example Erome, Coomer, and Bunkr. For the full process, see our guide to removing leaked OnlyFans content and the DMCA takedown master guide.
Sourcing and replication
Every figure in this report can be checked against Google's Transparency Report, which publishes copyright removal request counts per domain. Our methodology is documented on the Observatory page. The dataset is available under Creative Commons Attribution 4.0; cite "Privly Observatory" and link back if you use it.
For journalists, researchers, and other content-protection services: we built this because conversations about creator content protection deserve sourced numbers. If you spot an error or have a question we didn't address, get in touch.
