How to stop reverse image search finding my face

Removal, not cloaking, is what pulls you out of a face search

Reverse image face search (PimEyes, FaceCheck.id, Clearview, Yandex in its face mode) works by matching a new query photo against an index that already holds pictures of you. That mechanism decides your defense. Because the index is already built, cloaking your next upload will not remove you from it: the match comes from photos already stored, not the one you are about to post. The lever that actually works is opt out and per-service removal, backed by cutting your new exposure. Cloaking future photos matters, but here it is secondary.

This is the reverse of the before-you-upload cloak routine, and it is a narrower job than the overall cloak-vs-opt-out strategy. It is also not deepfake defense: a face search identifies or tracks you, it does not fabricate you, which is the separate problem in how to protect your likeness from deepfakes.

Why you cannot cloak your way out of an existing index

A cloak protects a photo before it is posted, so it can only help images you have not uploaded yet. The photos a face search already matched on were never treated. Even the cloaking research says so implicitly: Fawkes (Shan, Wenger, Zhang, Li, Zheng, Zhao, USENIX Security 2020) reports that once clean images leak, protection falls to an “80+% protection success rate,” and an index that already holds your clean face is the extreme case of a leak that no future cloak can walk back. The scale of these indexes is the reason it stings: Chow, Hu, Huang, Liu (ECCV 2024) note that “companies like Clearview and PimEyes have collected billions of online images and can recognize millions of citizens without their consent,” and Kim, Jain, Liu (2025) describe NIST results with an “FNIR of 0.15 percent at FPIR of 0.001 on a gallery of over 10 million identities.” A search that accurate over that many identities does not care about your next upload; it already has an entry for you.

Step 1: opt out and request removal, service by service

This is the lever that touches the photos already indexed. Submit each service’s own removal:

Service	Removal route	Limit
PimEyes	Opt-out request form, excluding your face from results	Covers PimEyes results only
Clearview AI	Access and deletion request, strongest under EU, UK, and state law	Availability depends on your jurisdiction
Yandex, FaceCheck.id, others	Per-service removal or takedown where offered	No single request covers them all

The caveat is baked into that table. Removal is per-service, so clearing PimEyes does nothing about Clearview or Yandex. It is incomplete, acting only on what each service admits to holding. And it is reversible: a fresh public photo of you can put you straight back in. Remove photos from face-recognition sites on our sister site works through these opt-outs and data-deletion requests in detail.

Step 2: cut the new exposure that refills the index

Removal is wasted if new photos re-index you the next week. Reduce the supply of fresh, uncloaked images: set social accounts private, ask others not to tag or post untreated pictures of you, and strip or lock down old public galleries. This is the maintenance half of removal, and without it every opt-out is temporary.

Step 3: cloak future posts as a secondary measure

Once you have opted out and cut exposure, cloaking the photos you do post keeps a re-built index from relearning you. LowKey (Cherepanova, Goldblum, Foley, Duan, Dickerson, Taylor, Goldstein, ICLR 2021) was built for exactly the commercial systems behind these searches, dropping Amazon Rekognition from 93.7% to 0.6% in the authors’ tests, and Ulixes (Cilloni, Wang, Walter, Fleming, PoPETs 2022) applies “visually non-invasive facial noise masks” that work “even when a user is unmasked and labeled images are available online.” Useful, but remember the ordering: cloaking guards the future, removal handles the past.

The research-grade angle: crowd out the index

One line of research tries to defeat the index itself rather than any single photo. FoggySight (Evtimov, Sturmfels, Kohno, PETS 2021) proposes “a community protection strategy where users acting as protectors of privacy for others upload decoy photos generated by adversarial machine learning algorithms,” flooding a lookup with false matches so a real one is hard to trust. It is a prototype, not a service you can sign up for, but it names the right target: the database, not your camera roll.

What removal realistically achieves

Stopping a reverse image face search is ongoing, not a one-time fix. Opt out of each service, request deletion where the law backs you, cut the flow of new photos, and cloak what you do post so a cleared index does not simply refill. None of it is permanent, because a single new public photo can re-index you and every removal is per-service. Realistically, the goal is not to vanish but to keep your findable footprint small and keep it that way. For how far these defenses hold under real pressure, see do AI poisoning tools actually work.

Sources

• PimEyes, Opt-Out Request Form (service under review; claims are the company’s own).
• Clearview AI, Privacy and Requests (service under review; claims are the company’s own).
• Shan, Wenger, Zhang, Li, Zheng, Zhao (2020). Fawkes: Protecting Privacy against Unauthorized Deep Learning Models. USENIX Security 2020.
• Cherepanova, Goldblum, Foley, Duan, Dickerson, Taylor, Goldstein (2021). LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition. ICLR 2021.
• Evtimov, Sturmfels, Kohno (2021). FoggySight: A Scheme for Facial Lookup Privacy. PETS 2021.
• Cilloni, Wang, Walter, Fleming (2022). Ulixes: Facial Recognition Privacy with Adversarial Machine Learning. PoPETs 2022.
• Chow, Hu, Huang, Liu (2024). Personalized Privacy Protection Mask Against Unauthorized Facial Recognition. ECCV 2024.
• Kim, Jain, Liu (2025). 50 Years of Automated Face Recognition.