The Take It Down Act: Platform Compliance Requirements for AI-Generated Deepfake Intimate Imagery

The internet has made it devastatingly easy to publish intimate images of another person without their consent. AI has made it even easier to create those images from scratch — no real photograph required. A convincingly realistic deepfake of a real, identifiable person in a sexual situation can now be generated in minutes, uploaded in seconds, and seen by thousands before the target even knows it exists.

Congress responded by passing the first federal law specifically targeting this conduct: the TAKE IT DOWN Act, signed by President Trump on May 19, 2025. The criminal prohibition took effect immediately. The platform notice-and-removal obligations — the part that affects businesses — took effect May 19, 2026. The Federal Trade Commission began enforcement the same day. If your company operates any platform where users can share content, this law creates real compliance obligations and real enforcement exposure right now.

What the Law Is and Why It Matters

The TAKE IT DOWN Act stands for “Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act.” It does two things: (1) it creates a federal criminal offense for publishing nonconsensual intimate imagery, including AI-generated deepfakes; and (2) it requires covered online platforms to establish a notice-and-removal process and act on valid notices within 48 hours.

The criminal side matters because it gives federal prosecutors a tool that previously did not exist at the federal level. The platform compliance side matters to your business, because failure to comply is enforced by the FTC as an unfair or deceptive act or practice — with civil penalties of up to $53,088 per violation.

Before this law, victims had to rely on a patchwork of state statutes, none of which required platforms to act quickly. Now there is a federal floor with a hard deadline and a federal regulator waiting to enforce it.

Who Is a “Covered Platform”

The Act covers a broad set of online businesses. A platform is covered if it:

• Provides a social media service, electronic communications service, or other digital content hosting service;
• Allows users to create accounts or profiles;
• Allows the sharing of user-generated content; and
• Has a significant nexus to interstate or foreign commerce.

This is deliberately broad. Social media platforms are covered. Image and video hosting sites are covered. Gaming platforms with user-generated content are covered. General-purpose messaging apps are covered. If your platform regularly hosts or transmits content that users upload to share with others, you need to treat yourself as a covered platform and comply accordingly.

The Act does not establish a size threshold. A startup with 5,000 active users is just as legally obligated as a platform with 500 million users. The FTC has not published a de minimis safe harbor.

The Two Categories of Covered Content

The Act covers two distinct types of intimate imagery:

1. Real nonconsensual intimate imagery (NCII). Actual photographs or videos depicting identifiable individuals in a sexual manner that were published without the subject’s consent.

2. Digital forgeries. Intimate visual depictions of identifiable real individuals that were created or substantially altered using software, an application, or artificial intelligence. These are what most people call deepfakes. The critical point: the image does not need to be based on any real photograph of the subject. A purely synthetic AI-generated image depicting an identifiable real person as if in a sexual situation qualifies as a digital forgery under the Act.

Both categories trigger the same platform obligations. The practical difference is that AI-generated deepfakes are easier to produce in volume, harder to verify as fake, and increasingly indistinguishable from authentic images — which is precisely why they are treated the same.

What Constitutes a Valid Notice

The notice-and-removal clock — 48 hours — does not start running until a platform receives a notice that is legally valid under the Act. This is a critical compliance detail. A vague complaint or a simple report-abuse button click does not necessarily start the clock.

Under the Act, a valid notice must include, in writing:

1. The identifiable individual’s physical or electronic signature. The person whose image appears — or in the case of a minor, the parent or guardian — must sign the notice. An electronic signature satisfies this requirement.

2. Identification of the intimate visual depiction. The notice must identify the specific content at issue, including information reasonably sufficient for the platform to locate it. A URL, screenshot, or description of where the content appears will typically satisfy this.

3. A good faith belief statement. The person submitting the notice must state, briefly, that they have a good faith belief that the depiction was published without their consent.

4. Contact information for the individual. The notice must include information sufficient to enable the platform to contact the person who submitted it.

False notices — submitting a notice knowing the depiction was actually consensually published — expose the filer to potential liability. The law is designed to prevent weaponization of the notice system.

A platform must provide plain-language information about how to submit a notice. The submission process must be clear and conspicuous. Burying a contact email in a footer or requiring the victim to navigate through six menus will likely be treated as a compliance failure.

The 48-Hour Removal Window: What It Actually Requires

Once a valid notice is received, covered platforms must:

1. Remove the specific content identified in the notice within 48 hours.
2. Make reasonable efforts to identify and remove known identical copies of the reported depiction within the same 48-hour window.

That second obligation is the more operationally demanding one. A platform cannot simply delete the specific URL identified in the notice and call it done. It must take reasonable steps to find duplicates — the same image or video re-uploaded by other users, cross-posted to different parts of the platform, or shared in private groups or direct messages.

What “reasonable efforts” means in practice will evolve through FTC enforcement actions and, eventually, litigation. Platforms should document their deduplication processes carefully. Perceptual hashing technology — which generates a digital fingerprint of an image and can match visually identical copies even if the file has been renamed or re-encoded — is the current industry standard for this kind of detection. The major platforms use it. Smaller platforms will need to implement it or contract with a vendor who provides it.

The 48-hour deadline does not pause on weekends or holidays. This is a continuous operational obligation, not a business-hours rule. Platforms that lack weekend moderation staff, or that route content reports through a queue that is only processed Monday through Friday, have a structural compliance gap they need to address.

FTC Enforcement: What the Exposure Looks Like

The FTC enforces the platform provisions of the TAKE IT DOWN Act under the same authority it uses to enforce Section 5 of the FTC Act — prohibiting unfair or deceptive acts or practices. That means:

Civil penalties. Violations carry civil penalties of up to $53,088 per violation. In practice, each piece of content that remained up longer than 48 hours after a valid notice could be treated as a separate violation. A platform that received 200 valid notices and failed to act on any of them faces potential exposure in the millions.

FTC investigations. The FTC has authority to investigate complaints, issue civil investigative demands (essentially administrative subpoenas), and bring enforcement actions in federal court. Even if a violation does not result in penalties, an FTC investigation is expensive and time-consuming.

Consent orders. Companies that settle FTC enforcement actions typically enter consent orders requiring them to implement specific compliance programs, submit to third-party audits, and report to the FTC for 10 to 20 years. FTC consent orders for data security and content violations routinely include decade-long monitoring requirements.

The FTC has already signaled aggressive enforcement posture. It launched a dedicated enforcement program the same day the platform obligations took effect and published business guidance on the same date.

Building a Compliant Notice-and-Removal Program

For most small and mid-sized platforms, building a compliant program requires attention to five areas:

1. Intake and notice validation. Build a submission form that collects all required elements — signature, content identification, good faith statement, and contact information. The form should include a clear explanation of what each field requires and why. Consider implementing email confirmation that the notice was received and is being reviewed.

2. Intake triage and response workflow. Someone needs to review incoming notices promptly enough that removal can happen within 48 hours even accounting for review time. For a platform with meaningful content volume, this likely requires dedicated staffing or a contracted moderation service with clear SLAs.

3. Deduplication process. Implement or contract for perceptual hashing or equivalent technology. Document the methodology. Keep records of what was searched, what was found, and what was removed in connection with each notice.

4. Records and documentation. Maintain records of all received notices, actions taken, and timestamps. If the FTC investigates, you will need to demonstrate that you acted within 48 hours. Records should be retained for at least four to six years given FTC enforcement timelines.

5. Transparency and user communication. The Act requires platforms to provide users with clear information about the notice-and-removal process. Your privacy policy, terms of service, or a dedicated help page should explain how victims can submit a valid notice and what happens after they do.

How the Take It Down Act Interacts with State Deepfake Laws

The Take It Down Act does not preempt state law. It establishes a federal floor; state laws can go further and often do.

As of early 2026, 46 states have enacted laws specifically addressing sexually explicit deepfakes, and all 50 states and the District of Columbia have some form of nonconsensual intimate imagery protection. State laws vary significantly in the additional protections they provide:

Civil liability. Many state statutes provide victims with a private right of action — the ability to sue the person who published the content for damages. The TAKE IT DOWN Act creates platform obligations enforced by the FTC; it does not itself give victims a private lawsuit against platforms. But state laws in California, Texas, Georgia, and more than a dozen other states provide civil remedies against individual publishers.

Extended removal timelines. Some state laws require faster removal than 48 hours, or set different standards for what constitutes sufficient notice.

Broader content coverage. Some states cover non-intimate deepfakes used in other contexts — defamation, election interference, fraud — that the TAKE IT DOWN Act does not address.

Mandatory age verification. Several states require platforms to verify user ages before permitting access to adult content. These obligations interact with — but are separate from — the deepfake removal requirements.

For companies operating nationally, compliance with the TAKE IT DOWN Act is the minimum. You need to evaluate which state laws apply to your users and your business and ensure your compliance program addresses the full landscape.

Practical Steps for Businesses Right Now

If you operate any platform where users can share content, these are the immediate action items:

Assess your coverage. Determine whether your platform meets the definition of a “covered platform” under the Act. If there is ambiguity, treat yourself as covered. The cost of a compliance program is far lower than FTC enforcement.

Audit your current content moderation capabilities. Can your team receive and process a notice within 48 hours, including weekends? Do you have any deduplication capability? What records do you currently keep?

Build or upgrade your intake process. If you do not have a dedicated, compliant notice submission process, build one. The form must be accessible, clear, and collect all required information.

Implement perceptual hashing or equivalent technology. If you are a smaller platform that has not deployed image-matching technology, this is now a compliance necessity, not an optional enhancement.

Review your terms of service and privacy policy. Both documents should address NCII and digital forgeries, explain your notice-and-removal process, and describe consequences for users who post prohibited content.

Train your team. Whoever handles content moderation needs to understand the Act, what constitutes a valid notice, and what the 48-hour clock requires.

The Bigger Picture

The TAKE IT DOWN Act is part of a broader legislative and regulatory trend in which Congress and state legislatures are treating AI-generated harmful content as a distinct category requiring distinct rules. The synthetic nature of deepfakes — the fact that no real intimate image of the victim ever existed — does not reduce the harm. In many cases it amplifies it, because the victim has no way to prove the image is fake, and the volume of AI-generated imagery means the problem can scale faster than any individual takedown system.

For businesses operating online platforms, the lesson is clear: AI-generated content is now a legal compliance category, not just a content policy question. The platform obligations under the TAKE IT DOWN Act went into effect on May 19, 2026. The FTC is enforcing. If your compliance program is not in place, that is an immediate priority.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.