diff --git a/features/media/docs/TODO.md b/features/media/docs/TODO.md
new file mode 100644
index 000000000..708fe8ce5
--- /dev/null
+++ b/features/media/docs/TODO.md
@@ -0,0 +1,45 @@
+# Media Feature — TODO
+
+## Image Privacy / Anti-Face Detection (v2 Roadmap)
+
+### P0: Validate Claims Before Making Them
+
+The content strategy references "under 1% PimEyes recognition rate" for adversarial perturbation.
+This claim is **unverified** — no engineering validation exists. No code exists. No tests exist.
+
+**Do not publish or present any specific efficacy numbers until this research is complete.**
+
+- [ ] Research PimEyes-class facial recognition services relevant to sex worker threat model
+  - PimEyes, Clearview AI, FaceCheck.id — which are accessible, which are law enforcement only?
+  - What APIs are available for automated testing?
+  - What are current recognition accuracy rates on unperturbed images?
+- [ ] Research adversarial perturbation state of the art
+  - What architectures do commercial services actually use? (ArcFace, CosFace — verify, don't assume)
+  - What perturbation approaches have been validated in peer-reviewed research?
+  - What are realistic efficacy numbers from published papers?
+  - How robust are perturbations across different recognition engines?
+- [ ] Build test harness for measuring perturbation efficacy
+  - Automated upload + recognition rate measurement against real services
+  - Baseline (unperturbed) vs perturbed comparison
+  - Multiple perturbation approaches compared
+- [ ] Document actual measured results
+  - Replace all "under 1%" claims with real data or remove them
+  - Update content strategy docs, press pitches, talk abstracts with verified numbers
+- [ ] Determine whether adversarial perturbation is even the right approach
+  - Perturbations may not survive JPEG recompression, resizing, or screenshot capture
+  - Alternative approaches: face swapping, generative replacement, metadata stripping
+  - The right answer might not be perturbation at all
+
+### Affected Content (contains unverified claims)
+
+- `operations/content-strategy/content/academic/conferences/strategy/defcon.md`
+- `operations/content-strategy/content/academic/conferences/strategy/talks/privacy-engineering.md`
+- `operations/content-strategy/content/press/tech/pitches/ars-technica.md`
+- `operations/content-strategy/content/press/tech/pitches/the-verge.md`
+- `codebase/features/landing/frontend-public/src/data/services/anti-face-detection.json`
+- Various interview files referencing adversarial perturbation efficacy
+
+### Reference
+
+- Landing page entry: `codebase/features/landing/frontend-public/src/data/services/anti-face-detection.json`
+- No feature code exists yet — this is v2 roadmap