The TAKE IT DOWN Act Becomes a Compliance Statute
On 19 May 2026 the federal regime against non-consensual intimate imagery in the United States stopped being a piece of legislation and started being a compliance statute. The Federal Trade Commission published guidance and opened the enforcement window, after Chairman Ferguson had sent compliance letters to fifteen named platforms on 11 May.1 A second round of warning letters followed on 20 May, addressed to twelve operators of generative ‘nudify’ tools.2 The criminal limb of the TAKE IT DOWN Act has been in force since the President signed Public Law 119-12 on 19 May 2025. The new development is that the civil and platform-side regime now bites.
The Statutory Architecture in Two Parts
Public Law 119-12 splits cleanly. The criminal limb amends 47 U.S.C. section 223 to make the knowing publication of a non-consensual intimate visual depiction a federal offence punishable by up to two years’ imprisonment for adult publication offences and up to three years where the depicted individual is a minor.3 The platform limb sits at a new section, 47 U.S.C. section 223a, which creates the notice-and-removal duty and the procedural skeleton around it.4 Both limbs use the same definitional spine. ‘Intimate visual depiction’ is borrowed from 15 U.S.C. section 6851, the civil cause of action created by the 2022 reauthorisation of the Violence Against Women Act. The TAKE IT DOWN Act then adds the separate concept of a ‘digital forgery’, covering intimate depictions created or altered using software, machine learning, artificial intelligence or other computer-generated or technological means.5
That structure is important. The Act does not police platform conduct through the criminal limb. It polices it through the civil notice-and-removal duty enforced by the FTC. A platform is not a perpetrator. A platform is a recipient of valid removal requests with a 48-hour clock attached.
The FTC’s enforcement guidance reads the platform duty as applying to both authentic intimate depictions and AI-generated digital forgeries. CRS has identified a possible interpretive point in the statutory drafting, because section 223a’s notice-and-removal language is framed around ‘intimate visual depictions’ rather than separately repeating ‘digital forgeries’. That issue has not yet been litigated.
What the FTC Actually Did on 19 May
On the day enforcement opened, the Commission issued a press release confirming that Section 3 of the Act was now enforceable and published its own compliance guidance for businesses.6 Chairman Andrew Ferguson framed the regime in personal terms: ‘We stand ready to monitor compliance, investigate violations and enforce the Take It Down Act.’ He added that ‘in the age of AI, anyone can be targeted, and that becomes even more appalling if children are involved.’7
Before the enforcement date, Chairman Ferguson had sent compliance letters to fifteen major US consumer-facing platforms: Alphabet, Amazon, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok and X.8 A second round of letters on 20 May went to twelve operators of generative tools that produce non-consensual intimate imagery from clothed photographs. The Commission did not name those twelve in its release.9
The civil penalty mechanism follows the FTC Act. A violation of the platform duty is treated as an unfair or deceptive act or practice. The current per-violation civil penalty maximum, after the FTC’s annual inflation adjustment under 15 U.S.C. section 45(m), is USD 53,088. The Commission has confirmed that figure in its own enforcement guidance.
What the Removal Duty Looks Like in Practice
Section 223a sets out what makes a request valid and what the platform must then do. A valid request is in writing. It carries a physical or electronic signature of the depicted individual. It identifies the depiction and supplies sufficient information for the platform to locate it. It states a good-faith belief that the depiction is not consensual. It provides the platform with sufficient information to contact the requester.
From receipt of a valid request, the platform has 48 hours to remove the depiction. Within the same 48-hour window, the platform must also make reasonable efforts to identify and remove known identical copies. The statute does not impose a general duty to monitor proactively. It imposes a duty to act on what it has been told and what it can readily find.
The statute also confers a substantial safe harbour. A platform that disables or removes material in good faith based on facts from which non-consensual publication is apparent is not liable, regardless of whether the depiction is ultimately found to be unlawful.10 The architecture rewards conservative compliance. Faced with a request that looks credible, the rational economic choice is removal first and adjudication later.
Why Section 230 Is Not the Shield Here
TAKE IT DOWN does not amend 47 U.S.C. section 230. It does not need to. The platform exposure created by section 223a does not rely on treating the platform as the publisher or speaker of user content. It treats the platform as the operator of a regulated takedown system. Whether a platform owes a private-law duty to an aggrieved third party still runs through Section 230 in the usual way. Whether a platform has discharged its federal notice-and-removal duty under section 223a is now a separate question. It is enforceable by the federal regulator and not insulated by Section 230.
That is the practical engineering of the regime. Section 230 still does what it has always done in this area, which is to bar a great many private-law claims arising out of platform hosting decisions. The TAKE IT DOWN Act runs alongside it on a different track, with a different enforcer, a different standard and a 48-hour clock.
The State Overlay
The federal regime is a floor. As at early 2026, state-law trackers put the number of US states addressing sexually explicit deepfakes at roughly 45 to 46, depending on classification. All 50 states and the District of Columbia had some form of non-consensual intimate imagery protection in place.11 Several of the state regimes reach further than TAKE IT DOWN and several attach sharper remedies.
Texas is illustrative. The first iteration of section 21.165 of the Texas Penal Code reached only deepfake videos. 2025 legislation, enacted through SB 441, closed that loophole and extended the prohibition to sexually explicit deepfake media, including still images as well as video.12
California is the other obvious comparator. California’s civil route began with AB 602, which created Civil Code section 1708.86, and has since been expanded, most recently by AB 621, effective 1 January 2026. SB 926, in force from 1 January 2025, criminalises the intentional creation and distribution of AI-generated sexually explicit deepfakes where the distributor knows or should know the content will cause serious emotional distress. SB 981 imposes a parallel platform mechanism, requiring social media platforms to provide a reporting route, temporarily block reported content while it is assessed and remove it from public view if it qualifies as sexually explicit digital identity theft.13
The federal-state interaction will matter for compliance design. A platform that builds a TIDA-compliant intake will satisfy the federal duty but may not, on its own, satisfy the additional state duties on response time, private rights of action or scope. The forward planning question for general counsel is no longer whether to build a takedown system. It is whether to build one system that satisfies the strictest applicable state regime or to layer the federal floor with jurisdiction-specific overlays.
The First Amendment Question
Whether the Act survives first contact with the First Amendment is the most consequential open question hanging over the regime. The Congressional Research Service noted, before the Act was even passed, that because it regulates speech on the basis of its content, it could attract strict scrutiny if challenged. That formulation is conditional for a reason. A court may instead conclude that some or all of the regulated material sits inside an unprotected category, or sufficiently close to one, that a less demanding standard applies.
The opposition is well-marshalled. The Electronic Frontier Foundation argues that the notice-and-removal regime is overbroad. Its definitions reach beyond the clearest category of non-consensual intimate imagery. The 48-hour clock incentivises platforms to remove first and assess later. The absence of a counter-notice mechanism or meaningful anti-abuse process will, on the EFF’s reading, produce over-removal in practice.14 The Center for Democracy and Technology, the Authors Guild, Freedom of the Press Foundation and others have aligned with the EFF on the censorship and due-process concerns.
The counter-argument has force. Non-consensual intimate imagery has been treated for two decades by US criminal and civil law as material in which the depicted individual retains a recognisable privacy and dignitary interest sufficient to defeat a general free-speech objection. The notice-and-removal regime also tracks the architecture of existing takedown systems. But the safe harbour reduces the platform’s legal risk from good-faith removal, which is exactly why critics say the statute will favour over-removal.
The realistic prediction is not that strict scrutiny will or will not apply. It is that the first facial challenge is a matter of when, not whether. The standard a court applies will be the heart of the case.
What to Watch in the Next Ninety Days
Four developments will shape the regime through the second half of 2026.
First, the FTC’s first enforcement action. The Commission has chosen warning letters in the first instance rather than an immediate sweep. The platform that becomes the test case for a 48-hour-clock missed deadline will set the early posture of the regime.
Second, the first facial challenge. The civil liberties coalition has been organised on this point since before the Act was passed. A likely doctrinal challenge would be brought by a platform with standing, on overbreadth and prior-restraint grounds. It would put the strict-scrutiny question to a federal court squarely.
Third, state attorneys general. The state-law regimes are now layered over a federal floor. State AGs will continue to bring criminal and civil actions against perpetrators and, in California, to test SB 981’s platform reporting duties. The resulting body of decisional law will give platforms more concrete operational guidance than the FTC’s compliance blog.
Fourth, the smaller-platform problem. The fifteen named platforms can build dedicated trust-and-safety operations. The longer tail of forums, image-sharing services, messaging apps and adult-content platforms cannot. The TAKE IT DOWN Act applies to them on the same terms. The realistic compliance burden will fall disproportionately on the operators least equipped to bear it.
TAKE IT DOWN does not amend Section 230. It creates a parallel FTC-enforced notice-and-removal duty at 47 U.S.C. section 223a, backed by civil penalties and reinforced by a widening state-law deepfake overlay. The duty has moved upstream from litigation defence to compliance operations. The 48-hour clock is now a feature of every covered platform’s intake. The question is whether, when the first First Amendment challenge arrives, that 48-hour clock survives in its current form.
Notes
1 Federal Trade Commission, ‘FTC Chairman Ferguson Advises Companies to Comply with the Take It Down Act’, press release, 11 May 2026; Federal Trade Commission, ‘FTC Begins Enforcing the TAKE IT DOWN Act’, press release, 19 May 2026; Federal Trade Commission, ‘Take It Down Act enforcement starts now: What to know about the FTC and TIDA’, business guidance blog, 19 May 2026.
2 Federal Trade Commission, ‘FTC Sends Warning Letters to Companies About Compliance with the TAKE IT DOWN Act’, press release, 20 May 2026.
3 TAKE IT DOWN Act, Public Law 119-12 (signed 19 May 2025), section 2, amending 47 U.S.C. section 223.
4 TAKE IT DOWN Act, section 3, adding 47 U.S.C. section 223a ‘Notice and removal of nonconsensual intimate visual depictions’.
5 15 U.S.C. section 6851 (Violence Against Women Act Reauthorization Act of 2022, definition of ‘intimate visual depiction’), as incorporated by reference in 47 U.S.C. section 223a. ‘Digital forgery’ is separately defined in the TAKE IT DOWN Act and codified in 47 U.S.C. section 223(h).
6 Federal Trade Commission, ‘FTC Begins Enforcing the TAKE IT DOWN Act’, press release, 19 May 2026.
7 Federal Trade Commission, ‘FTC Chairman Ferguson Advises Companies to Comply with the Take It Down Act’, press release, 11 May 2026; Federal Trade Commission, ‘FTC Begins Enforcing the TAKE IT DOWN Act’, press release, 19 May 2026.
8 Federal Trade Commission, ‘FTC Chairman Ferguson Advises Companies to Comply with the Take It Down Act’, press release, 11 May 2026; addressees listed in alphabetical order by corporate name.
9 Federal Trade Commission, press release of 20 May 2026. The Commission referred to the addressees only as ‘twelve operators of online services that offer artificial-intelligence-powered nudification tools’.
10 47 U.S.C. section 223a (safe harbour for good-faith disabling or removal).
11 StackCyber, ‘Deepfake Legislation Tracker: Federal and State Laws’, updated spring 2026; supplementary review of state legislative trackers as at March 2026.
12 Texas Penal Code section 21.165, as amended by SB 441, 89th Texas Legislature, signed 20 June 2025 and effective 1 September 2025.
13 California Civil Code section 1708.86 (AB 602, 2019), as expanded by AB 621 (effective 1 January 2026); California Penal Code section 647(j) as amended by SB 926 (2024, effective 1 January 2025); California Business and Professions Code as amended by SB 981 (2024).
14 Electronic Frontier Foundation, ‘The TAKE IT DOWN Act: A Flawed Attempt to Protect Victims That Will Lead to Censorship’, 5 February 2025; Center for Democracy and Technology and others, joint letter to the United States Senate, February 2025.