OnlyFans Has a Piracy Problem. Enter This Vigilante Programmer

(Bloomberg Businessweek) -- Dan Purcell’s transformation into a content protection vigilante began several years ago, with a moment of personal reckoning. The Irish computer programmer was living in California when his girlfriend at the time persuaded him to perform live on Chaturbate, a site that hosts adult web shows. He did several webcasts with her before deciding it wasn’t for him. He moved on, went back to Ireland, and never thought about it again—until 2018, when his new girlfriend angrily presented him with the videos. “It was very embarrassing,” he says, “very, very, very humiliating.”

Purcell had thought the videos would be streamed live, then disappear, but people had built programs to automatically record the webcam footage. He started a weekslong hunt for the culprits. Because he’d used his social media handle on Chaturbate—“I still want to beat myself upside the head for this”—he just searched for his own username, along with some obvious keywords. What he discovered was a sprawling online ecosystem of groups dedicated to reselling stolen adult content. And, eventually, a business opportunity.

At first alone, then with a handful of part-time employees, Purcell began hiring himself out as a sleuth and enforcer, helping adult content creators find illegal copies of their photos and videos and get them taken down. Borrowing the Irish word for justice, he named his infant company Ceartas DMCA Ltd., with DMCA referring to the Digital Millennium Copyright Act.

Purcell isn’t alone. As direct-to-consumer adult content has proliferated, an industry has emerged to try to police the piracy of it, including such services as DMCA.com, Rulta.com, and TakeDownPiracy.com. They’re filling a growing void at a moment when individuals have more power to create and post their own content online, but less power to control what happens to it.

Figures like Purcell at times employ controversial methods: He says he once sifted through a 14-year-old’s Xbox Live account for personal details, then used the kid’s real name to pressure him into taking down stolen nudes and writing an apology letter. But his customers see him as their last, best option in an industry where tech platforms and the authorities can be slow to take action.

Ceartas in particular owes its existence to OnlyFans, a platform for creators to charge viewers for photos and videos. The company hosts a variety of people, from chefs to musicians to personal trainers, but its biggest stars are adult performers.

OnlyFans, founded in London in 2016, has seen business explode during the pandemic. Since 2019 the number of “fans” has increased more than tenfold to over 100 million, the company says. Last year, those fans paid about $2 billion for access to photos and videos, meaning OnlyFans took in about $400 million from its 20% cut. All told, creators on the site have made more than $4.5 billion, and more than 500 of them have individually made over $1 million. 

OnlyFans is now said to be in talks to raise funding at a valuation of more than $1 billion. But the skyward trajectory of OnlyFans and the rest of adult self-publishing is hindered by digital pirates, who force performers to compete with their own content elsewhere on the web for free.

Take Joey Fisher. Since she was 19, she’s worked as what the British call a “glamour model”—a genteel term for entertainment that leaves little to the imagination. Fisher, 28, lives in Wales and joined OnlyFans about two years ago. The subscription fee ($15.40 a month for her channel) and tips from fans are generating the best income she’s ever made from modeling. Plus, she’s her own boss.

The one problem, she says, is the piracy. A search for Fisher online produces dozens of porn web pages promoting images and videos ripped from her OnlyFans channel. Links promising stolen photos of her have proliferated on Reddit, and chat platform Discord servers tout access to images of her and other celebrity nudes for $9.99.

Having her work reproduced always came with the territory. “Even when I shot for a magazine, those images would end up on porn websites or random forums,” she says. But because of Fisher’s time and investment in building her OnlyFans channel and expanding her subscriber base, the thefts bothered her that much more.

“It’s your business, so the amount of time and effort that goes into it, and it just gets ripped off and put on the internet for free, it’s really infuriating,” Fisher says. When she would manage to get a photo taken down, it would just reappear elsewhere. “It’s just constantly search it, get it taken down, repeat.”

Earlier this year, Fisher’s best friend recommended she contact Purcell, who, when he’s not pursuing adult content thieves, still works as an engineer at software company ZenDesk Inc. They talked for an hour on the phone about the software Ceartas uses to trawl the web for pirated photos and how he adds some bite to warnings he sends to site hosts by invoking the DMCA. “Dan made me aware of multiple websites I’d never heard of before,” she says. She’s now one of Ceartas’s more than 60 clients, paying about $150 to $230 a month.

Adult performers exist in a cultural and economic gray area. Because Apple Inc. and Google forbid erotic content apps on their platforms, OnlyFans is accessible only through a web browser, not a mobile device. Not having an app means that OnlyFans can’t build in certain protective features—like the tool Netflix Inc. uses to black out a user’s screen when a clipping service is detected. Performers’ lone recourse is often to fill out a form on the company’s site registering their grievances.

Purcell’s first big case after his own was in November 2020, when a sprawling data dump of stolen photos appeared on the servers of Discord. The database leak, which mainly contained intimate pictures of Irish women, was massive and searchable. In a statement about the incident, Discord said it took “immediate action” and “banned every user account involved.” Watching it unfold, though, Purcell saw a need for his skills.

He asked performers he knew for images—“Every third girl I know was probably on OnlyFans,” he says—and posted them to one of the Discord servers. As a contributor, he quickly gained the trust of the people running the server. Then he emailed them a warning, falsely claiming that the police were on to them. It was enough to spook the administrator, who confessed in a message to Purcell that he was a teenager and immediately took down the server. The operation took less than an hour. Purcell had found his calling.

OnlyFans, for its part, has every reason to help creators keep their private images off other sites. In a response to emailed questions, a spokesperson said the company is “firmly in the fight to protect user content.” When it pursues stolen images, the “takedown success rates are extremely high.” The takedown services are free, and the company has “invested significantly” in the team that works on them, the spokesperson said.

Yet the thefts persist, as do independent efforts to stop them. Right now, Ceartas is still a tiny operation. Purcell has been speaking with potential investors to expand his business while working out of the back of his aunt’s house, where he lives. Soon he hopes to focus on the company full time.

As his business has increased, Purcell says he’s automated a lot of the searches and takedown notices, and he only rarely uses the social engineering tricks that got him started. Recently he even hired a lawyer to go with the email address, legal@weareceartas.com, he’s long used to send out his warnings. “Any company can have a legal department,” he says. “Doesn’t mean you’re a practicing attorney.”

©2021 Bloomberg L.P.