The TAKE IT DOWN Act Is Now in Full Effect: What Platforms Need to Know

On May 19, 2025, the President signed into law the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (the “TAKE IT DOWN Act”). The law targets the growing prevalence of nonconsensual intimate imagery (NCII), including authentic images and content generated or altered using artificial intelligence.

The Act operates on two tracks. Its criminal provisions took effect immediately upon enactment, while its notice-and-removal requirements for online platforms became enforceable one year later, on May 19, 2026. With that deadline now passed, covered platforms face active compliance obligations and enforcement risk.

Legislative Background and Purpose

Congress enacted the TAKE IT DOWN Act to address the rapid spread of NCII online, particularly as advances in synthetic media have made it easier to create and distribute realistic but fabricated content. The law establishes criminal penalties for knowingly publishing NCII and imposes affirmative obligations on platforms that host or distribute user-generated content.

A central feature of the Act is its requirement that covered platforms provide a mechanism for individuals to request removal of NCII. That requirement, now in effect, is designed to provide a consistent, nationwide process for addressing harmful content.

Criminal Prohibitions

The Act imposes criminal penalties for knowingly publishing NCII, whether the content is authentic or computer-generated.

Where the depiction involves an adult, penalties may include fines, forfeiture, restitution, and up to two years’ imprisonment. The statute applies a four-part framework to determine whether a depiction violates the statute, requiring a reasonable expectation of privacy, no voluntary public disclosure, that the content is not of public concern, and that there was intent to cause harm or that actual harm resulted.

For depictions involving minors, the statute adopts a broader standard. Any content published with the intent to abuse, humiliate, harass, or degrade the minor, or to arouse or gratify the sexual desire of any person, is sufficient to establish a violation, and the maximum penalty increases to three years’ imprisonment. The additional elements required for adult content do not apply.

The Act also extends liability to threats to publish NCII when made for purposes such as intimidation, coercion, extortion, or to cause mental distress. Threats to publish authentic NCII carry the same penalties as actual publication, while threats involving digital forgeries carry lower maximums, up to 18 months imprisonment for offenses involving adults and 30 months for those involving minors. Finally, the statute makes clear that conduct already covered under existing federal child exploitation laws is prosecuted under those provisions rather than under the TAKE IT DOWN Act.

Scope of Covered Platforms and Compliance Requirements

The Act applies to a broad category of “covered platforms,” generally defined as websites, online services, and mobile applications that serve the public, primarily as forums for user-generated content or as regular facilitators of the distribution of NCII in its course of business

User-generated content includes images, videos, audio, messages, and similar material. Internet service providers and email providers are expressly carved out, but beyond those exclusions, the FTC has not yet clarified the outer boundaries of coverage. Because the scoping provision applies at the service level rather than the company level, businesses that only incidentally offer a forum for user-generated content should not assume they fall outside the Act's reach. Notably, nonprofit organizations are explicitly included within FTC jurisdiction under this law.

Covered platforms must implement a process that allows identifiable individuals, or authorized representatives acting on their behalf, to report NCII that depicts them and request its removal. An identifiable individual is one whose face or other distinguishing characteristic appears in the content at issue.

Platforms must provide clear and conspicuous notice of the reporting process in plain language. A valid request must be submitted in writing and include a signature, sufficient information to identify and locate the content, contact information, and a statement that the depiction is nonconsensual.

Once a valid request is received, platforms must remove the content as soon as possible, and no later than 48 hours after receipt. The obligation also includes making reasonable efforts to identify and remove duplicate copies of the content. Platforms that act in good faith to remove content are protected from liability if the material is later determined not to qualify as NCII.

FTC Enforcement

The Federal Trade Commission began enforcing the Act’s platform requirements on May 19, 2026.

Noncompliant platforms may face civil penalties of up to $53,088 per violation. The FTC is actively monitoring compliance and has established a public reporting portal, TakeItDown.ftc.gov, through which individuals can submit complaints regarding platforms that fail to meet their obligations under the Act.

Implications for Businesses and Individuals

With the Act now fully in effect, individuals have a formal mechanism to request the removal of NCII from covered platforms. Businesses must ensure they have created a user-friendly reporting system that complies with the Act or face penalties from the FTC.

Platforms should, at a minimum, ensure that reporting mechanisms are accessible and functional, that internal processes support timely review and removal, and that personnel are prepared to handle requests in accordance with the statute’s requirements. Platforms should also consider implementing hashing technology to prevent reported images from being reposted or reuploaded. Notably, nonprofit organizations are not exempt from the Act's requirements. The FTC has signaled it will take an active enforcement posture, issuing warning letters to noncompliant companies on the first day of enforcement, and where compliance processes are incomplete or ineffective, the risk of penalties is immediate.