When did FTC enforcement of the TAKE IT DOWN Act start?

The FTC began enforcing the platform rules on May 19, 2026, one year after President Trump signed the Act. Section 3 gave covered platforms that year to set up a removal process. The same day the FTC opened TakeItDown.ftc.gov, where victims can report platforms that ignore valid requests.

What does the TAKE IT DOWN Act require platforms to do?

Section 3 requires a process for people to ask for removal of a nonconsensual intimate image, a clear and conspicuous plain-language notice explaining it, and, after a valid request, removal of the image plus reasonable efforts to remove known identical copies, as soon as possible and within two days.

Who counts as a covered platform?

A website, online service or app that serves the public and mainly provides a forum for user-generated content, or that regularly publishes nonconsensual intimate images. Broadband providers, email, and sites built mostly on their own preselected content are excluded. The Act sets no user-count threshold, and nonprofits are covered too.

Does the TAKE IT DOWN Act cover AI deepfakes?

Yes. It defines a digital forgery as an intimate image of an identifiable person made with software, machine learning or AI that a reasonable person can't tell apart from a real one. Publishing one without consent can be a crime, and platforms must handle removal requests for forgeries the same way as for real images.

Does a removal request have to include ID?

No. The statute lists four written elements, a physical or electronic signature, enough information to find the image, a short good-faith statement that it is nonconsensual, and contact details. Nothing in the text asks for a government ID or a notarized statement.

Can people sue a platform under the TAKE IT DOWN Act?

The Act gives enforcement of the platform duties to the FTC and creates no private lawsuit. Victims report a platform to the FTC at TakeItDown.ftc.gov. State laws can add their own claims; Washington, for example, lets the person depicted sue over fabricated intimate images.

TAKE IT DOWN Act Compliance Checklist for Platforms

Image: Pexels.

If people can post images on your service, the TAKE IT DOWN Act gives you a deadline you can't negotiate. The law, Public Law 119-12, has two halves: a federal crime for people who knowingly publish nonconsensual intimate images, and a notice-and-removal duty for platforms. We reread the enacted text against an earlier version of this checklist and found it asked platforms for things the statute doesn't, like ID checks, re-upload blocking and a confirmation message. Some of those are good FTC advice. This version keeps the law and the advice in separate columns, so you know which items a regulator can cite.

What Section 3 requires of a platform

President Trump signed the Act, in full the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, on May 19, 2025. Section 3 gave covered platforms one year to set up their process, and the FTC started enforcing it on May 19, 2026.

Duty	What the text says	Where
A removal process	Let an identifiable individual, or someone authorized to act for them, notify you of an intimate image published without consent and ask you to remove it	Sec. 3(a)(1)(A)
What a request contains	In writing: a physical or electronic signature; information reasonably sufficient to locate the image; a brief good-faith statement that it is not consensual; contact details	Sec. 3(a)(1)(B)
A public notice	A clear and conspicuous notice of the process, easy to read and in plain language, which may be a clear and conspicuous link	Sec. 3(a)(2)
Removal	As soon as possible, and no later than two days after receiving a valid request	Sec. 3(a)(3)
Copies	Make reasonable efforts to identify and remove any known identical copies	Sec. 3(a)(3)(B)
Protection for good-faith removals	No liability for disabling or removing material in good faith, even if it later turns out not to be unlawful	Sec. 3(a)(4)
Enforcement	A failure to reasonably comply is treated as a violation of an FTC rule on unfair or deceptive practices	Sec. 3(b)(1)

Page 139 Stat. 60 of Public Law 119-12 showing Section 3: the written request elements, the clear and conspicuous notice, the removal deadline and the good-faith liability limit

Screenshot: Public Law 119-12, 139 Stat. 60, Section 3, via congress.gov.

Watch two phrases. The clock starts on a "valid removal request", and the statute defines what goes into one: the four written elements, not an identity check. And the copies duty covers "known identical copies", so the text asks you to find duplicates of the reported image, not to stop every future upload.

What the FTC adds on top

The FTC's business guide, Complying With the Take It Down Act, goes further than the statute. Its own last line says the guidance "does not encompass all requirements", so read it as the regulator's expectations, not as extra law.

FTC advice	Their wording
Put the notice where intimate content can appear	You may need a notice "on your home page and wherever intimate content might appear"
Accept requests from people without an account	The law's protections "are not limited to individuals who hold an account on your platform"
Number each request	Platforms "should provide an identifying number for each take down request"
Tell people the outcome	Let people "know you removed the reported content, or if not, why"
Hash removed images and share the hashes	Consider hashing, and sharing hashes with NCMEC's Take It Down service for minors and StopNCII.org for adults

The FTC business guide Complying With the Take It Down Act, listing covered platforms, the notice and removal process, digital forgeries and duplicate removal

Screenshot: FTC business guidance, Complying With the Take It Down Act, May 2026.

The FTC's consumer protection director, Christopher Mufarrige, put the same expectation in his enforcement-day post: "Platforms should be prepared to demonstrate compliance and make it easy for people to track the status of their removal requests." In our view a request number and an outcome message are cheap to add and are the first things an investigator will ask about, so the checklist below includes them.

Who is a covered platform

Section 4 defines a covered platform as a website, online service, online application or mobile application that serves the public and either primarily provides a forum for user-generated content, "including messages, videos, images, games, and audio files", or regularly publishes, curates or hosts nonconsensual intimate images as part of its business.

Service	Covered?	Why
Social networks, video and image sharing	Yes	A forum for user-generated content
Messaging and gaming platforms	Likely	The definition lists messages and games; the FTC names messaging and gaming platforms as examples
Sites whose business is posting intimate images	Yes	Covered even if the content isn't user-generated
Nonprofit forums and communities	Yes	Section 3 extends FTC jurisdiction to organizations not run for profit
Broadband internet access providers	No	Excluded
Email	No	Excluded
Sites built mostly on their own preselected content, where comments or chat are incidental	No	Excluded, unless they regularly publish nonconsensual intimate images

There is no user-count or revenue threshold. A small forum is covered on the same terms as a large one.

Enforcement since May 19, 2026

The FTC moved in three steps. On May 11, Chairman Andrew Ferguson sent letters to Alphabet, Amazon, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok and X reminding them of the deadline. On May 19 the agency began enforcing the Act and launched TakeItDown.ftc.gov, where victims can report platforms that ignored a valid request or have no way to make one. "In the age of AI, anyone can be targeted," Ferguson said. A day later the FTC sent warning letters to 12 companies offering "nudify" tools, saying they appeared to lack any removal process.

The TakeItDown.ftc.gov home page, headed Report platforms that fail to remove intimate photos or videos posted without your consent, with a Start your report button

Screenshot: TakeItDown.ftc.gov, Federal Trade Commission, checked October 16, 2026.

The FTC also posted a short video in which Ferguson explains the Act and the reporting site:

The penalty is the one in the verdict above, the FTC's figure for a rule violation. The FTC said on September 15, 2026 that its civil penalty amounts "will remain unchanged during 2026". Two parts of the FTC Act shape how it applies. Penalties for a rule violation need "actual knowledge or knowledge fairly implied" that the conduct is prohibited, and in a "continuing failure to comply with a rule", each day counts as a separate violation, so a missing removal process can add up quickly. The court weighs culpability, history and ability to pay when it sets the amount.

The criminal half, briefly

Section 2 applies to any person, not just platforms. It makes it a crime to use an interactive computer service to knowingly publish an intimate image, or a digital forgery, of an identifiable adult without consent where what is shown wasn't voluntarily exposed in a public or commercial setting, isn't a matter of public concern, and the publication is meant to cause harm or causes harm. For minors the test is intent to abuse, humiliate, harass or degrade, or to arouse.

Offense	Maximum prison term
Publishing, adult victim	2 years
Publishing, minor victim	3 years
Threatening to publish a digital forgery, adult	18 months
Threatening to publish a digital forgery, minor	30 months

Courts must also order forfeiture and restitution. Two rules help victims: consent to creating an image isn't consent to publishing it, and sharing an image with one person isn't consent to anyone else publishing it. Images that are child pornography under federal law are carved out of this offense, and the Act says it doesn't limit other laws, naming 18 U.S.C. 2252 as an example.

The platform checklist

1. Decide whether you're covered. Apply the Section 4 test: do you serve the public and mainly host user content? Write the answer and the reason down; if you're unsure, assume yes.
2. Publish the notice. A plain-language page that explains how to ask for removal and what you'll do, linked clearly from your home page and, per the FTC, from wherever intimate content can appear.
3. Build the request form around the four statutory elements. A physical or electronic signature, information to locate the image (a URL or post ID field helps), the good-faith statement, and contact details. Let people without an account submit.
4. Don't add gates the statute doesn't have. The clock runs from a valid request. If you want more information, ask for it while you work on the removal, not before.
5. Staff for the deadline, weekends included. The text counts hours and has no business-day exception. Route these requests to a separate queue with an owner who can remove content without waiting for a general moderation review.
6. Remove the image and search for known identical copies. Hash the removed file and check your service for matches. Sharing hashes with NCMEC's Take It Down (minors) or StopNCII.org (adults) is FTC advice, not a duty.
7. Give every request a number and tell the requester the outcome. That covers the FTC's tracking and "or if not, why" advice.
8. Keep a record of each request. Time received, what was removed, copies found, time removed, and the reason if you declined. It's how you show the "reasonable" compliance Section 3(b) asks about.
9. Brief your trust and safety team and update your content policy. Not a statutory step, but the people handling reports need to know that real and AI-made images get the same treatment.

How it fits with other laws

The Act has no clause preempting state law, and its criminal section says it doesn't limit other federal law. State laws therefore still apply. Washington is one example: its fabricated intimate images law, HB 1999 (Chapter 88, Laws of 2024), effective June 6, 2024, created a state crime and a civil claim for the person depicted. Washington's AI likeness law (SSB 5886) is a separate personality-rights law about ads, products and fundraising.

In the EU, the Digital Omnibus, Regulation (EU) 2026/1744, adds AI Act bans on systems that generate non-consensual intimate content and child sexual abuse material, applying from December 2, 2026. That rule targets AI providers rather than hosts, so a US platform with an image generator may face both. Our EU nudification ban guide covers it.

What we could not confirm

A first FTC case under the Act. As of October 16, 2026 we found warning letters and a consumer alert (September 17) but no announced FTC complaint or settlement under the TAKE IT DOWN Act.
Where messaging stops. Whether a private, one-to-one messaging app "primarily provides a forum for user-generated content" hasn't been tested. The FTC lists messaging platforms as examples, so plan as if you're covered.
How violations are counted. Whether the FTC counts each unremoved image, each request or each day as a violation hasn't been tested under this Act.

Correction (October 16, 2026): An earlier version said a request must be "verified" and that compliant platforms collect a government ID or a sworn declaration; Section 3 requires a written request with a signature, location information, a good-faith statement and contact details, and doesn't mention ID. It said the law requires "reasonable steps" to prevent re-uploads and a removal confirmation to the requester; the statute requires reasonable efforts to remove known identical copies, and hashing and outcome notices are FTC suggestions. It said private messaging isn't covered; the definition lists messages and the FTC names messaging platforms. It said the Act makes publishing AI-generated child sexual abuse material a federal crime; the Act covers intimate images and digital forgeries of identifiable people and leaves child pornography to existing federal law. It described a May 19, 2026 FTC statement on enforcement priorities that we could not find. It dated the EU Digital Omnibus May 7, 2026; the regulation is Regulation (EU) 2026/1744 of July 8, 2026. An earlier version also gave Washington's AI likeness law an effective date of June 10, 2026 (the bill page for SSB 5886 lists June 11, 2026) and listed SSB 5886 as Washington's intimate-image law; that law is HB 1999.