Three Models of Deepfake Liability
Why the FTC's new removal duty operates outside Section 230 and why its one-sided safe harbour will reward over-removal.
The FTC began enforcing the TAKE IT DOWN Act on 19 May 2026, one year to the day after President Trump signed it.1
The compliance posture that platforms now occupy is the product of three separate regulatory theories, each treating the same underlying harm. The three are not fully aligned.
A takedown duty in parallel with Section 230
The Act criminalises the publication of non-consensual intimate images, including computer-generated images depicting identifiable individuals, and requires covered platforms to remove such content within 48 hours of a valid notice.2 The civil penalty is $53,088 per violation under FTC Act enforcement principles.3
The Act does not amend Section 230 of the Communications Decency Act. It runs parallel to it. The Act includes a safe harbour for good-faith disabling or removal but offers no equivalent protection for under-removal. Section 230 does not provide a defence to an independent federal statutory notice-and-removal duty enforced by the FTC. The structural effect, if not the formal one, is that Section 230 is displaced for this category of content.
The architecture invites comparison with the DMCA notice-and-takedown framework from 1998. The DMCA created a conditional safe harbour: failure to comply risks losing that safe harbour and facing ordinary copyright liability. TIDA adds an affirmative FTC-enforced removal duty backed by civil penalties.
Criminalising creation, the UK approach
The UK’s response operates at the source rather than the platform layer. Section 138 of the Data (Use and Access) Act 2025 amended the Sexual Offences Act 2003 to create a criminal offence of intentionally creating a “purported sexual image” of an identifiable person without consent.4 The offence took effect on 6 February 2026 and covers both AI-generated images and conventionally manipulated ones.
Platforms operate within a separate regime. The Online Safety Act 2023 treats non-consensual intimate images as a priority offence within the illegal-content duties. Failure to operate proportionate removal systems can attract Ofcom penalties of up to 10% of worldwide turnover and, in extreme cases, service-blocking orders.5 The UK regulator has the larger stick. The US regulator has the lower threshold of intervention.
Transparency at the model layer, the EU approach
The EU does not yet treat non-consensual intimate deepfakes through a dedicated removal duty. From 2 August 2026, Article 50 of the AI Act addresses the upstream problem by requiring providers of generative systems to mark synthetic outputs in a machine-readable format. The Digital Services Act handles downstream notice-and-action for illegal content through hosting-service mechanisms, with additional risk-assessment obligations for VLOPs (Very Large Online Platforms) and VLOSEs (Very Large Online Search Engines).
The EU theory is that the harm is mitigated by detectability and procedural diligence. The US theory is that the harm requires a hard removal deadline. The UK theory is that the harm requires a criminal prohibition on the upstream act. The three are not contradictory but they impose different compliance designs on the same platform.
Practitioner implication
A platform with users in all three jurisdictions cannot run one workflow. The trigger for action differs (a US notice, a UK priority-offence designation, an EU complaint or risk-assessment finding), the actor differs (the FTC, Ofcom, the European Commission and national DSA coordinators) and the penalty calculus differs by orders of magnitude. The rational design is to operate to the lowest common denominator on response time and to the highest common denominator on transparency. That points toward 48-hour removal as the operational floor and machine-readable provenance as the technical ceiling once Article 50 applies.
The Section 230 question worth watching is whether TIDA’s structure becomes a model for other categories. If notice-and-removal with civil penalties survives constitutional challenge in this domain, the case for extending it to adjacent ones, including AI-generated defamation and impersonation, will be made.
Code on Trial will track that case as it develops.
References
1 Federal Trade Commission, “FTC Begins Enforcing the TAKE IT DOWN Act,” press release, 19 May 2026.
2 Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act), Public Law 119-12 (2025), section 3 (notice-and-removal duty).
3 Civil penalty figure adjusted under the Federal Civil Penalties Inflation Adjustment Act; FTC business guidance, May 2026.
4 Data (Use and Access) Act 2025, section 138, amending the Sexual Offences Act 2003.
5 Online Safety Act 2023, illegal-content duties under Part 3 and priority offence schedules; Ofcom enforcement powers under Part 7.