TAKE IT DOWN Act: Coverage, 48-Hour Removal, and Penalties

The TAKE IT DOWN Act is a federal law, signed on May 19, 2025, that makes it a crime to knowingly publish nonconsensual intimate images or AI-generated sexual deepfakes of a real, identifiable person, and requires websites and apps hosting user-generated content to remove such material within 48 hours of a valid request.¹ The full name is the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act. The criminal provisions took effect the day the President signed the bill. Platforms have until May 19, 2026, to build the systems needed to handle takedown requests, with the Federal Trade Commission enforcing that side of the law.

What Content the Law Covers

The statute targets two categories. The first is authentic intimate imagery: real photographs or videos showing a person’s private body parts or sexual activity, shared online without that person’s consent. The second is what the law calls “digital forgeries,” better known as deepfakes. A digital forgery is any AI-generated or computer-created intimate image of a real, identifiable person that a reasonable viewer would mistake for authentic.²

Covering deepfakes is a meaningful change. Many earlier state revenge-porn statutes reached only real images, and defendants could argue their way out by claiming the content was fabricated. Under this law, it does not matter whether the image was secretly recorded or manufactured by software. If a reasonable person would think it is real and it depicts someone identifiably, publishing it without consent is a federal offense.

Criminal Penalties for Publishing or Threatening

The law creates several offenses aimed at individuals who publish the material or threaten to do so. Each has its own penalty range.

Knowingly publishing a nonconsensual intimate image or digital forgery of an adult: fines, up to two years in prison, or both.
The same offense involving a minor: fines, up to three years in prison, or both. For minors, prosecutors do not have to prove the image was shared without consent. They must show the defendant intended to humiliate, harass, or degrade the minor, or intended to gratify someone’s sexual desire.
Threatening to release authentic intimate images of an adult: fines, up to two years in prison, or both. If the threat involves a digital forgery of an adult, the maximum is 18 months.
Threatening to release authentic intimate images of a minor: fines, up to three years in prison, or both. If the threat involves a digital forgery of a minor, the maximum is 30 months.

These provisions amend the Communications Act of 1934 and became enforceable on the day the law was signed. Section 230 of the Communications Decency Act does not shield anyone from federal criminal liability, so platforms cannot invoke it against criminal charges either.²

Exceptions to Criminal Liability

Not every disclosure of intimate imagery is a crime under this statute. The law carves out good-faith disclosures to law enforcement and material shared for a legitimate medical, scientific, or educational purpose. A person cannot be prosecuted for publishing or possessing an intimate image of themselves.²

Content that falls under existing federal child sexual exploitation statutes is excluded from this law’s criminal prohibition. Those images are already covered by harsher federal laws and are handled through established channels.

The statute does not include explicit exceptions for news reporting, political speech, or satire. Critics have raised concerns that the omission could sweep legitimate journalism into takedown requests, especially given platforms’ incentives to remove content quickly.

Which Platforms Have to Comply

The removal obligations apply to any website, app, or online service that is open to the public and primarily serves as a forum for user-generated content, including posts, videos, images, and audio. They also cover services that regularly publish or host nonconsensual intimate imagery as part of their operations.³

There is no revenue threshold and no minimum user count. A small community forum with user-uploaded images faces the same duties as a major social network. The law explicitly excludes broadband internet providers, email services, and sites where the content is primarily produced by the operator rather than users. A news outlet’s own reporting page or a company’s marketing site would not qualify; any platform where the public posts content likely does.

The absence of a small-business carve-out has drawn criticism. Smaller platforms with limited staff and no automated moderation tools face the same 48-hour deadline as companies with thousands of engineers.

The 48-Hour Removal Requirement

Once a covered platform receives a valid request, it must take down the reported material as soon as possible, and no later than 48 hours after receiving the request. The platform must also make reasonable efforts to find and remove any known identical copies of that image or video on its service.⁴

The “known identical copies” language points toward digital hashing, where a platform generates a unique mathematical fingerprint of a flagged file so future uploads matching that fingerprint are blocked. The law does not name a specific technology, but the deadline and the duty to catch re-uploads make some form of automated detection practically unavoidable for larger services.

Platforms that remove content in good faith based on a takedown request receive liability protection for that removal. An uploader cannot sue a platform simply for complying with a request it reasonably believed was valid.⁴

These platform obligations do not take effect until May 19, 2026.

How to Submit a Removal Request

The request must come from the person depicted, or from someone authorized to act on their behalf, such as a parent filing for a minor. It must be in writing and include four elements:

A physical or electronic signature of the person depicted, or their authorized representative.
Enough information to locate the specific image or video. A direct URL works, but is not required; any description reasonably sufficient for the platform to find the material qualifies.
A brief good-faith statement that the person genuinely believes the imagery was published without their consent, with any relevant supporting information.
Contact information sufficient for the platform to reach the person filing the request.

The good-faith standard is worth flagging. Unlike some earlier drafts, the enacted law does not require the statement to be made under penalty of perjury. A good-faith belief that the imagery is nonconsensual is the standard.⁴

Each covered platform must also post a clear, conspicuous, plain-language notice explaining how users can submit requests. Burying the process behind settings pages would not satisfy this requirement.

No Counter-Notice or Appeal

The law includes no counter-notice mechanism. Unlike the Digital Millennium Copyright Act, which lets someone whose content was removed contest the takedown and potentially get the material restored, the TAKE IT DOWN Act gives the uploader no formal way to challenge a removal through the platform.²

Critics say this creates an obvious vector for abuse. Someone with a grudge could file a false request against lawfully posted content, and the platform has strong incentives to remove it rather than risk FTC action for missing the 48-hour deadline. The law contains no penalties for filing a fraudulent removal request.

FTC Enforcement Against Platforms

The Federal Trade Commission is the primary enforcement body for platform obligations. A platform’s failure to reasonably comply with the removal requirements is treated as a violation of a rule defining an unfair or deceptive act or practice under the FTC Act. That gives the agency authority to investigate and impose the range of remedies it uses for other consumer protection violations, including cease-and-desist orders and civil penalties.²

In an unusual step, the law extends FTC enforcement powers to nonprofit organizations. The FTC Act normally exempts nonprofits, but this statute overrides that exemption for these removal duties. A nonprofit running a user-generated content platform faces the same compliance obligations as a for-profit company.

The law does not create a private right of action. Victims cannot sue a platform directly for failing to remove content. Their options are to report noncompliance to the FTC or file a criminal complaint against the person who published the imagery.

Open Questions: Section 230 and Encryption

The Act does not explicitly amend or override Section 230 of the Communications Decency Act, which broadly shields platforms from liability for user-posted content. If the FTC brings a civil enforcement action, a platform could argue Section 230 immunizes it, and the FTC would likely counter that the newer law implicitly overrides that shield for these violations. No court has resolved the tension.² The ambiguity does not affect criminal enforcement, since Section 230 already excludes federal criminal law from its protections.

The statute exempts email but does not clearly exempt private messaging apps, cloud storage services, or other platforms using end-to-end encryption. Services that encrypt messages so the operator cannot read them have no technical means of scanning for or removing specific images. Complying with a takedown would require either breaking the encryption or abandoning it. Privacy advocates note that victims often rely on encrypted communication to contact support organizations, store evidence, or leave abusive situations, so weakening encryption could undercut the safety of the people the law is meant to protect. How regulators and courts will treat encrypted services remains unresolved as the May 2026 compliance deadline approaches.

1
Federal Trade Commission. Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act)
2
Congress.gov. The TAKE IT DOWN Act – A Federal Law Prohibiting Nonconsensual Intimate Visual Depictions
3
United States Senate Committee on Commerce, Science, and Transportation. TAKE IT DOWN Act (S. 119th Congress)
4
Congress.gov. Text – S.146 – 119th Congress (2025-2026) TAKE IT DOWN Act