Sharing an Unreleased File? 9 Checks Before, During and After
Before you share an unreleased file, decide three things: who gets which copy, what each recipient can keep, and what you will do if it leaks. Nine checks cover those three stages. The one that matters most is recording which copy went to whom at the moment you send it, because without that record a leaked copy is hard to connect to a recipient and hard to act on.
This guide is for the person at a studio, publisher or label who sends unreleased artwork, episodes or tracks to outside partners.
Why does the moment of sending matter so much?
Most unreleased files leave the company through normal work: coloring vendors, translators, review partners, marketing agencies. When the same file goes to everyone, a copy that turns up online could have come from any of them.
That is why this checklist puts more weight on records than on locks. Locks can fail. A record of who received which copy is what lets you respond after a leak.
What should you decide before you send?
1. Who gets it. Write down every recipient first. Separate your own team, outside studios and personal email addresses, and treat personal email as a no by default.
2. Preview, not master. Send a review cut and keep the master in-house. Most reviews do not need the full-resolution file.
3. Rights info. Put author, date, rights holder and allowed use in the file. Standards such as C2PA Content Credentials record this kind of provenance in a cryptographically bound structure, though the C2PA explainer notes that this metadata can be removed.
What should you limit while the file is out?
4. One copy each. Give each recipient a separate copy with its own file name and link, and log who got which.
5. Link expiry. Set a date for every link to stop working. Avoid links with no end date.
6. Download rights. Decide up front whether recipients can save the file. View-only by default, download if approved.
What should you do if it leaks?
7. Find it. Note the site or channel, the date you found it, and take a screenshot.
8. Match the copy. Compare it with your log from check 4. If it matches a recipient, follow up with them. If nothing matches, widen your search.
9. Ask for removal. Send a takedown request with your rights info. Under US law (17 U.S.C. § 512(c)(3)(A)), an effective notice must include substantially the following, among other elements: identification of the copyrighted work and "information reasonably sufficient to permit the service provider to locate the material." The rights details from check 3 and the location from check 7 cover those two items. The notice also needs a signature, your contact details, a good-faith statement, and a statement, made under penalty of perjury, that the notice is accurate.
Stage | Checks | Record to keep |
|---|---|---|
Before you send | Recipients, review cut, rights info | Recipient list, rights holder and allowed use |
While it's out | One copy each, link expiry, download rights | Which copy went to whom |
If it leaks | Find, match, ask for removal | Site, date, screenshot, request sent |
Where should you start if you can only do one?
Our view: start with check 4. Without separate copies and a log, check 8 has nothing to compare against.
One way to make each copy different is to hide a recipient-specific mark inside the file. MuseBlossom's Contents Defence lets you embed an invisible watermark in a file and later verify it in a copy you find. Embedding and verification are currently offered as a PoC test bed. It also issues and validates C2PA Content Credentials. Contents Defence is on the C2PA Conforming Products List for image, audio and video; a listing confirms conformance to the specification, not leak protection.
What can't this checklist do?
It does not prevent leaks. A recipient can still photograph a screen or redraw the work, and a copy changed that way may be hard to match against your log. Takedown rules also differ by country and by platform, so check the service's own process before you send a notice.
FAQ
Isn't an NDA with the vendor enough?
An NDA sets responsibility. It does not tell you which copy leaked. Use both.
Does renaming files per recipient help?
It is a minimum step for your own records, but file names are easy to change. Information stored inside the file lasts longer.
Who do I send a takedown request to?
To the service where the copy appeared, through its designated notice channel.
Want to try an invisible watermark on your own files? See how Image Defence works: go.contentsdefence.com/image-guide