Federal enforcement of the Take It Down Act reaches its first operational milestone today, May 19, 2026 — exactly one year after President Donald Trump signed the law — transforming the statute from a criminal prohibition into a full compliance regime with measurable deadlines, mandatory removal procedures, and civil penalties of $53,088 per violation for platforms that fail to act. Any person depicted in a nonconsensual intimate image, including an AI-generated deepfake, can now file a removal request with any covered social media service, messaging app, image host, or gaming platform, and that platform is legally required to remove the content and its known copies within 48 hours. No account is required to file. The Federal Trade Commission has authority to investigate and fine companies that ignore the obligation.
For the tens of millions of users of services including Amazon, Alphabet, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok, and X — all of which received formal compliance letters from FTC Chairman Andrew Ferguson on May 11 — today's date functions as both a protection and a warning. The protection is the new federal right. The warning is that the penalty is per violation, meaning a platform hosting multiple copies of a single flagged image faces that fine multiplied by each uncleaned instance.
What the Law Requires of Every Covered Platform
Section 3 of the Take It Down Act, the provision the FTC enforces, applies to any platform that primarily hosts user-generated content or that regularly publishes, curates, hosts, or distributes nonconsensual intimate visual depictions in the course of business. That scope captures social media services, video and image hosts, messaging apps, and gaming platforms. Covered platforms must now:
Establish a removal request mechanism accessible without a platform account. Any person — or an authorized representative acting on their behalf — must be able to submit a written notice identifying the content and stating in good faith that it was published without consent.
Remove the reported image or video, and all known identical copies, within 48 hours of receiving a valid request. The 48-hour window applies across all of a platform's storage infrastructure — mirrored servers, CDN caches, backup systems — not just the originally reported instance.
Display clear and conspicuous notice to users explaining how the removal process works and how requests can be tracked.
Provide each request with an identifying number so the victim, the platform, and law enforcement can reference the same matter consistently.
The FTC has published compliance guidance specifying these obligations and encouraging platforms to use hashing technology to prevent re-uploads, with a recommendation to share hash values with the National Center for Missing and Exploited Children's Take It Down service for content involving minors, and with StopNCII.org for content involving adults 18 and older.
The Scale of the Harm the Law Is Targeting
Between 96 and 98 percent of all deepfake content online consists of nonconsensual intimate imagery, and 99 to 100 percent of victims in deepfake pornography are female. Deepfake image files are projected to reach approximately 8 million in 2025, up from 500,000 in 2023. The Internet Watch Foundation documented a 260-fold increase in AI-generated child sexual abuse videos between 2024 and 2025 alone. In South Korea, a single 2024 wave of school-based deepfake incidents affected more than 500 schools and thousands of victims.
The case of Elliston Berry — a 14-year-old whose classmate used AI to generate nude images of her — provided one of the central witness accounts that helped drive the bill's passage. Her testimony before Congress was among the factors that produced a House floor vote of 409 to 2 on April 28, 2025, and a Senate vote of unanimous consent.
The first federal conviction under the criminal provision of the Take It Down Act, which took effect immediately upon signing in May 2025, was handed down in April 2026, against an Ohio man who used AI to create nonconsensual intimate imagery of neighbors — including children — and shared it on a child sexual abuse material website.
Enforcement begins as the platform landscape is already under pressure. Earlier this year, Grok, the AI service built into X, was used to flood the platform with nonconsensual, sexualized deepfakes of real people. That incident prompted multiple criminal and civil investigations of X and its parent company, xAI, and demonstrated in real time why platform-level liability is now the central battleground in deepfake regulation.
The Engineering Demand Behind a 48-Hour Window
The compliance requirement is operationally harder than it may appear. Large platforms distribute content across geographically dispersed infrastructure — primary databases, content delivery networks, thumbnail caches, backup snapshots. A compliant takedown does not mean flagging a record in one database; it requires propagation across all storage layers within the two-day window.
Content-level hashing systems, which have historically been used to block re-uploads of known harmful imagery by generating digital fingerprints of flagged files, must now be adapted to handle AI-generated synthetic media. Unlike photographs, which produce consistent hashes when the same file is uploaded multiple times, AI-generated images may never exist as a stored file until they are produced on demand, making perceptual similarity matching — which recognizes near-identical images rather than byte-identical files — a necessary technical component.
For platforms without dedicated trust-and-safety engineering teams — smaller video hosts, community image boards, gaming services — the compliance infrastructure represents a significant new build obligation. The law does not distinguish between large platforms and small ones; the 48-hour requirement applies equally.
The Conflict the Law Has Not Resolved
The Take It Down Act passed with near-unanimous bipartisan support, but its notice-and-removal mechanism has drawn sustained criticism from civil liberties organizations who argue that the law creates a censorship infrastructure with fewer safeguards than the Digital Millennium Copyright Act, the 1998 law that governs the existing framework for copyright takedowns.
The Electronic Frontier Foundation has argued that the TIDA takedown provision applies to a broader category of content than the law's own narrower NCII definitions, and that — unlike the DMCA — it requires no statement under penalty of perjury from the person filing a request, contains no penalty for false or bad-faith claims, and provides no counter-notice mechanism through which a person whose content was removed can challenge the decision. "The law contains no protections against frivolous or bad-faith takedown requests," EFF staff attorneys India McKinney and Joe Mullin wrote. "Lawful content — including satire, journalism, and political speech — could be wrongly censored."
The Center for Democracy and Technology's Becca Branum, director of the organization's Free Expression Project, told CyberScoop that the financial incentives created by $53,088 per-violation penalties push platforms toward removing anything that arrives through the complaint pipeline, regardless of whether it is genuine NCII. "If you think there's any given post where if you ask an attorney, 'Is it worth $53,000 for me to keep this post up,' the answer is always going to be take it down," Branum said. "I can't imagine any service wanting to risk that type of fine on edge cases or anything they can't verify or account for within 48 hours."
The law also leaves unresolved a structural tension with Section 230 of the Communications Decency Act, which has historically shielded platforms from liability for user-generated content. TIDA does not amend Section 230, and legal scholars expect courts to face contested questions about whether FTC enforcement actions under the new law can survive Section 230 defenses. First Amendment challenges to the law's provisions are also anticipated, given that the law regulates speech on the basis of content.
Whether the enforcement regime will prove effective at the target harm is also unresolved. Research published this month by TechPolicy.Press found that, across two major platforms with millions of registered users each, the supply of and demand for deepfake pornography actually increased after the Take It Down Act's passage — the opposite of the deterrent effect its architects intended. The study's authors note that the law's publicity may have introduced new users to deepfake communities, and that meaningful takedown requests on the monitored platforms were rare.
What Victims Can Do Starting Today
Any person who believes nonconsensual intimate imagery depicting them has been published on a covered platform — whether authentic or AI-generated — can now invoke their rights under the Take It Down Act. The request must be in writing, identify the content, include contact information, and contain a good-faith statement that the depiction was published without consent. A signature, physical or digital, is required. No platform account is needed to file.
The platform must respond within 48 hours. Victims can request an identifying number for their submission to track its status. Parents and authorized representatives may file on behalf of minors.
The FTC's compliance guidance directs victims and platforms alike on how the process should operate. The law contains no private right of action: victims cannot sue platforms directly for failure to comply. Enforcement is the FTC's responsibility alone. Victims who believe a platform has not met the 48-hour requirement can report that failure to the FTC for investigation.
For victims in states that have enacted their own deepfake laws — including California, Illinois, Texas, Virginia, and Georgia — federal compliance is the floor, not the ceiling. At least 46 states now have laws specifically addressing deepfakes, and many impose obligations that go beyond what the federal statute requires.
ⓒ 2026 TECHTIMES.com All rights reserved. Do not reproduce without permission.
