How to Protect Your Privacy as a Content Creator
Ephyra Collective introduces creators to independent management agencies, so we have an interest in applications. This guide is general information, not legal or financial advice.
How can you protect your privacy as a content creator?
Share the minimum, as late as possible, through channels you chose. A detail you hold back can’t be passed around, posted or used against you.
“The minimum” is what the other person needs for their part of the job right now. “As late as possible” means after you have checked them and, for anything sensitive, after a written contract. “Channels you chose” are an email, a number and accounts set up for this work. This guide is for models and creators, new or established, dealing with agencies, managers or anyone offering to represent them.
| What | Who can ask for it | When to share it |
|---|---|---|
| Working name | Anyone you talk to about the work | From the first message. |
| Legal name | An agency you have checked | On the contract, when you sign. |
| Phone number | Someone you have checked | Your work number, once you decide to talk. Keep your personal one back. |
| Location | Nobody needs your address to talk to you | Country or time zone if useful. A full address only if something must be posted to you. |
| ID | The company that pays you, named in the contract | After a written contract, by the channel it names. Never in a chat. |
| Bank details | The company that pays you, named in the contract | After a written contract, the same way. Never in a chat. |
| Accounts | Nobody | Never your password or a login code. If someone needs access, ask for a login of their own. |
Which everyday habits keep my details private?
Keep everything about this work apart from your personal life.
- Use a working name that doesn’t contain your real name or birth year, on every profile and in every message. Don’t reuse a photo or username from your personal profiles.
- Make a separate email address for this work, so a leak never reaches your personal inbox or your bank and shopping accounts.
- Get a separate phone number. A second SIM or a calling-app number works.
- Tighten your settings. The US Federal Trade Commission (FTC), the government body that handles consumer fraud, advises using privacy settings to control who sees your posts and location, and switching off app access to location, contacts and photos where it isn’t needed.
- Test yourself. Now and then, search your working name and work email. If your real name shows up beside either, fix that link first.
What can my photos and videos give away?
More than you would think. A photo can carry its location inside the file, and the background can show where you live even without it.
Apple’s support guide says that when location is on for the camera, each photo or video can store where it was taken, and anyone you send the file to may see it. On an iPhone:
- Stop saving it: Settings, Privacy & Security, Location Services, Camera, Never.
- Remove it from an existing photo: open it, tap More, then Adjust Info, Adjust Location, No Location.
- Remove it as you send: in the share sheet, tap Options and turn off Location.
Other phones have a similar setting; search your phone’s name and “turn off location in photos”. Then check the picture itself: a window view someone could recognise, a street sign, a house number, a parcel label, a work badge. Mirrors, glasses and screens can reflect the room. Post after you have left a place, not while you are there.
How do I keep my accounts from being taken over?
Use long, unique passwords, keep them in a password manager and turn on two-factor sign-in. The FTC says a password should be at least 12 characters, and a passphrase of random words can be easier to remember.
A password manager (or your browser) does the remembering. Aim for one password per account, so a single leak doesn’t open the rest. Guard your work email most of all: the FTC calls it critical, because reset links often go to your inbox, so whoever gets in can take over your other accounts.
Two-factor sign-in asks for a second proof besides your password, so a thief with the password still can’t get in. The FTC says codes sent by text or email are the least secure kind and recommends an authenticator app or a security key. Start with email, then social media and anything holding payment details.
Two things to refuse
Never share a login code with anyone, including someone claiming to be from support or an agency. And don’t log in through a link in a message: the FTC’s phishing advice is to contact the company through a website or number you already know. Our guide to Instagram scout and agency messages shows what a real approach looks like.
What should an agency ask for, and what should it never ask for?
A real agency asks for what it needs, in the order it needs it. Early on, that is a way to reach you and examples of your work. Your legal name, ID and bank details come once there is a written contract. It should never ask for passwords, login codes or a link to log in.
Before you hand anything over, ask four questions and get the answers in writing:
- Who will see my details?
- Where are they kept, and how are they protected?
- Will you share them with anyone, and will you ask me first?
- What happens when I leave? How long do you keep them, and how do I ask for deletion?
An honest company answers without fuss. If it gets annoyed or vague, take that as the answer. Our guides to modeling contract red flags and models agency red flags cover what else to check before you sign.
Can I ask a company to show me or delete my data?
You can always ask. Whether a company has to say yes varies by country.
In a 2024 consumer alert, the FTC says some US states have laws that give you the right to tell a company to delete your data. If you live elsewhere, look at what your country’s consumer protection or data protection service says.
Either way, a clear written request is a good start. Say what you want (a copy of what they hold, or deletion), ask for a written reply and keep a copy with the date. Leaving an agency? Ask what will be kept, and why. Our guide on how to leave a models agency covers the rest.
How private can I really be?
Private from the public, yes. Invisible to everyone, no. Anonymity works against strangers who want to link your work to your real name, not against everyone you deal with.
- Platforms and payment providers usually need your legal name and ID to pay you. That is normal, and their privacy policy says what they do with it.
- The tax office works with real names too. Rules differ by country, so ask a local adviser.
- People who know you can recognise your voice, face or surroundings, and you can’t fully control that.
The FTC is direct about posts: privacy settings can’t fully control who sees them, anyone who sees one can save a copy, and deleted or disappearing posts can still be saved.
Be wary of promises
Anyone who promises complete anonymity is promising something nobody can deliver. Make it harder for a stranger to find you, and have a plan for the day someone does.
What do I do if my details or a private image are shared?
Stay calm and don’t pay. Keep screenshots, report it to the app, and tell someone you trust. If your real name or address has been posted, the steps are the same.
- Stop talking to the person. If someone threatens to share private images unless you pay, the FTC advises not paying and not giving them access to your devices or financial accounts. Ignore their messages.
- Keep the evidence. Screenshot the post, the account and any messages, with the date and link showing. Don’t delete your own chats yet.
- Report it to the app. Meta’s help page says you can report private images without giving your name, and a friend can report for you if you have no account. Blocking the poster only hides the post from you; it stays up until it is removed.
- Ask for removal in writing. In the US, the FTC says a law requires online platforms to remove private images within 48 hours of your request, free of charge, and you can tell the FTC if one doesn’t. Rules elsewhere differ.
- Be careful with paid “removal” services. The FTC says to check any company that charges a fee: search its name with “scam”, “review” and “complaint”, and skip the paid results.
- Lock your accounts and get help. Change passwords, turn on two-factor sign-in and check where you are logged in. If you feel unsafe or are being blackmailed, contact your local police.
Common questions
Should I use my real name as a content creator?
You don’t have to. A working name keeps your public profile apart from your legal name. You will still need your legal name for contracts and payments, and you can share it then.
Can I stay completely anonymous?
Nobody can promise that. A working name, a separate email and number and clean photos keep you anonymous to the public, but platforms, payment providers and tax offices may still need your real details.
When should an agency get my ID and bank details?
After a written contract, through a channel the contract names, not in a chat. Ask who sees them, where they are kept and how long they are kept after you leave.
What should I do first if someone threatens to share a private photo?
Don’t pay, and stop replying. Screenshot the messages and the account, report the account to the app, and tell someone you trust. If you feel unsafe, contact your local police.
Do I have a right to have my data deleted?
It depends on the country. The FTC says some US states give people the right to tell a company to delete their data. Elsewhere, ask your consumer protection or data protection service, and send a written request.