AI Regulation Tracker  /  Regulation in force

The TAKE IT DOWN Act Is Live: Any Site With User Content Now Owes a 48-Hour Takedown

Federal enforcement of the TAKE IT DOWN Act began May 19, 2026. Covered platforms, defined broadly enough to reach far past social media, must run a notice-and-removal process and pull nonconsensual intimate images, including AI deepfakes, within 48 hours. Here is who is covered and what compliance requires.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published June 28, 2026  ·  Last updated June 28, 2026

Federal enforcement of the TAKE IT DOWN Act began May 19, 2026. Any public website or app that hosts user content, a "covered platform" the FTC reads broadly, must run a notice-and-removal process and take down reported nonconsensual intimate images, including AI deepfakes, within 48 hours, or face civil penalties of $53,088 per violation. Primary source: Public Law 119-12 and the FTC's May 2026 compliance guidance.

The grace period is over

For a year the TAKE IT DOWN Act was a future problem. As of May 19, 2026 it is a present one. That was the compliance deadline for covered platforms, and the federal government marked it by moving on every front at once. The Department of Justice announced its first conviction under the law and a separate new criminal case, and, with the Department of Homeland Security, secured a warrant to seize two domains used to publish digitally forged intimate images. The Federal Trade Commission announced it had begun enforcing the law's platform obligations (WilmerHale, "The TAKE IT DOWN Act Goes Live," June 15, 2026). The message was deliberate. Compliance is no longer theoretical.

What the law actually requires

The TAKE IT DOWN Act, signed in May 2025 as Public Law 119-12, targets nonconsensual intimate imagery in two ways. It criminalizes knowingly publishing or threatening to publish such images, and it imposes notice-and-removal duties on covered platforms. The detail that pulls AI squarely into the law is its definition of the harm. The prohibition reaches not only real photos and videos and also "digital forgeries," meaning images created through software, machine learning, artificial intelligence, or any other computer-generated means.

For platforms, the operational core is a 48-hour clock. A covered platform must establish a process through which a person can report and request removal of nonconsensual intimate images of themselves, post a clear and conspicuous notice describing that process, remove valid reports within 48 hours, and make reasonable efforts to find and remove identical copies. The law includes a good-faith safe harbor that protects a platform that removes material it reasonably believes is covered, even if the content later turns out to be lawful.

"Covered platform" is broader than you think

The most common compliance mistake will be assuming this is a social media law. It is not. A covered platform is any website, online service, online application, or mobile application that serves the public and either primarily provides a forum for user-generated content or, in the regular course of business, publishes or hosts nonconsensual intimate depictions. The FTC's May 2026 guidance reads that definition broadly, reaching companies that host or make available user-generated content of almost any kind, including message forums, video sites, and other services where users can post.

WilmerHale put the practical test plainly: a business need not look like a social media company to face risk. If a company runs a public-facing site or app where users can post content, including comments, uploads, or messages, it should assume it must analyze whether the Act applies.

The cost of getting it wrong

The penalties run on two tracks. Individuals who knowingly publish covered imagery face tiered criminal penalties, with heightened exposure where minors are involved. For platforms, a violation of the Act's notice-and-removal duties is treated as a violation of an FTC rule and can carry civil penalties of $53,088 per violation. The FTC also launched a public complaint site, TakeItDown.ftc.gov, where individuals can report platforms that fail to act, which means the regulator has a direct pipeline of leads.

Building for a 48-hour clock

The compliance work is not exotic, but it cannot be improvised after a request lands. The reporting process has to be easy to find and open to people who do not have an account, because victims are often not users. The 48-hour deadline means the response path has to run continuously, with clear ownership shared across legal, trust and safety, product, and support. Duplicate detection, through hashing or image matching, becomes a core capability rather than a nice-to-have, since the law requires reasonable efforts to catch reposts in the same window. And because moderation rules tuned for authentic images can miss synthetic ones, the classifiers and escalation criteria have to account for AI-generated forgeries. Through all of it, recordkeeping is what proves compliance if the FTC asks, so intake, removal timing, and copy-removal efforts should be logged from day one.

Why this belongs on a professional's desk

This is a content-platform law, but its reach makes it a quiet problem for businesses that never thought of themselves as platforms. A firm that runs a client portal with uploads, a community forum, or a review section now has a fact-specific question to answer about whether it is covered. The good-faith safe harbor rewards prompt action in close calls, which argues for a bias toward removal and a documented standard for making the call fast.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.