A peer-reviewed study published in the Journal of Online Trust and Safety examined 88 active websites hosting AI-generated non-consensual intimate imagery, finding that most rely on infrastructure from five major tech companies. Researchers from Dartmouth College and Lancaster University identified Cloudflare as the most prominent provider, supplying hosting, content delivery, domain name services, and analytics for the majority of the sites studied.
Google, Namecheap, WordPress, and Proton also played significant roles, providing SSL certificates, advertising, domain registration, content management systems, and email servers. The study notes that each company's terms of service prohibit illegal content, yet these services continue to support abuse imagery sites. Google said it could not investigate without specific domains, while WordPress argued that it is open-source software, not a hosting provider, and has no control over independently hosted sites.
Researcher Hany Farid disputed WordPress's characterization, pointing out that WordPress.com is a hosting service and that Automattic's infrastructure can serve images for self-hosted sites through Jetpack and its CDN. He also noted that WordPress has shown it can cut off specific operators, as seen in its dispute with WP Engine. The study highlights a persistent gap between the policies of major internet infrastructure providers and the reality of how their services are used.