The TAKE IT DOWN Act's 48-hour takedown duty is now FTC-enforced. See what's required, the penalties, and how to build compliant removal flows.
Photo via Unsplash
Three months ago, the TAKE IT DOWN Act was still the kind of law that compliance teams filed under "eventually." On the 19th of May 2026, that changed. The Federal Trade Commission announced it was enforcing the Act's civil provisions immediately, and Chairman Andrew Ferguson had already sent personal letters to fifteen of the largest platforms in the country — Alphabet, Amazon, Apple, Meta, Microsoft, TikTok, Snapchat, Reddit, Discord and others — reminding each one, by name, that the obligation was no longer theoretical.
If your product lets a stranger upload a photo, a video, a voice clip or even a game asset that another person might appear in, this law almost certainly reaches you. And the honest version of TAKE IT DOWN Act compliance is harder to build than it sounds on first read.
Key takeaways
- The civil duty has been enforceable since 19 May 2026. The FTC is not waiting.
- Remove reported imagery and known identical copies within 48 hours of a valid request.
- "Covered platform" is broad — messaging apps, forums, marketplaces and games all qualify.
- Issue a tracking number on submission. The FTC named this specifically.
- Post-hoc moderation is the wrong shape. Build the authorisation record before the report lands.
The TAKE IT DOWN Act was signed into law on 19 May 2025. Its criminal provisions — making it a federal offence to knowingly publish nonconsensual intimate imagery, including AI-generated deepfakes — took effect immediately. Its civil provisions, the ones that create an operational duty for platforms, had a one-year runway before they became enforceable. That runway ended on 19 May 2026, and the FTC wasted no time making its intentions public.
The civil duty itself is deceptively short to state: a covered platform must provide a way for a person to report nonconsensual intimate imagery of themselves, and must remove that imagery — along with any known identical copies — within 48 hours of receiving a valid request.
Two words in that sentence carry most of the weight, and they're the two that trip platforms up.
"Covered platform" is broader than most product teams assume. It's any website, online service or app that primarily provides a forum for user-generated content — messages, images, video, audio, games — plus any service that routinely publishes, curates or hosts such content even if that isn't its stated purpose. Nonprofits are included regardless of whether they turn a profit. The two clean exclusions are broadband internet access providers and email services. Everything in between is a judgement call, and the FTC's letters made clear it intends to make that call generously against platforms.
"Known identical copies" means the 48-hour duty isn't satisfied by deleting the one URL a victim happened to find and report. If the same file has been re-uploaded, mirrored or cached elsewhere on your own service, a platform is expected to make reasonable efforts to find and remove those too. A takedown system built around single-URL deletion — which is how most legacy DMCA tooling works — quietly fails this requirement the first time an image goes viral internally.
FTC Chairman Ferguson has been direct about what "reasonable" looks like in practice. Platforms, he said, "must make it easy for people to submit a removal request," and should "provide an identifying number for each take down request" — a specific, checkable instruction, not a vague standard a legal team can argue about after the fact. An intake form that swallows a report into a generic support queue, with no reference number and no confirmation, does not meet that bar even if the image eventually comes down.
The financial exposure is concrete too: civil penalties of up to $53,088 per violation, assessed per instance of non-compliance rather than as a single capped fine. For a platform handling meaningful volume, that scales fast. Legal commentary since the deadline has described this as the first comprehensive federal enforcement scheme aimed squarely at nonconsensual intimate imagery on platforms — not a symbolic gesture, but a live enforcement priority tied to a named White House-level push.
"Platforms must make it easy for people to submit a removal request," and should "provide an identifying number for each take down request." — FTC Chairman Andrew Ferguson, on the Commission's enforcement expectations for the TAKE IT DOWN Act
The TAKE IT DOWN Act didn't arrive in isolation. Any platform hosting AI-generated or user-submitted imagery of real people is now navigating at least three overlapping regimes, and they don't ask for exactly the same thing.
| Regime | Trigger | Response window | Who enforces it | Maximum exposure |
|---|---|---|---|---|
| US TAKE IT DOWN Act 2025 | Report of nonconsensual intimate imagery | 48 hours to remove reported image + known copies | Federal Trade Commission | $53,088 per violation |
| UK Online Safety Act 2023 | Content harmful to children reaches a user without age assurance | No fixed hour count; duty is continuous risk mitigation | Ofcom | Up to 10% of global turnover |
| Card-network consent rules | Chargeback or compliance audit on adult/likeness content | Consent record producible "on request" | Visa/Mastercard via acquiring bank | Loss of processing privileges |
Read across the row, and a pattern emerges: every regime eventually asks the same underlying question — can you prove, on demand, what was authorised and by whom? The TAKE IT DOWN Act asks it retrospectively, after a report. The Online Safety Act asks it structurally, before content is ever served to an unverified user. Card networks ask it contractually, whenever an auditor or a disputed charge forces the question. A platform that only builds for one of these ends up rebuilding the same evidence trail three times.
Most platforms' instinct, faced with a 48-hour deadline, is to speed up moderation review. That's necessary but not sufficient, and it misses the harder problem: by the time a reviewer sees a report, the image already exists, and someone already has it. The 48-hour clock is a race against distribution that the platform starts several steps behind.
The more durable fix — and the one the FTC's own guidance gestures toward with its "identifying number" instruction — is to generate the evidence trail before the report ever lands, not scramble to reconstruct it afterward. That means: every piece of AI-generated imagery on your platform should already carry a record of who authorised its creation, under what terms, and when. When a takedown request arrives, the question stops being "did we produce this, and did we have permission?" and becomes a lookup against a record that already exists.
This is the exact mechanism behind LikeWard's provenance manifest: every output signed by our licensed-likeness API records the creator, the boundary-set version that authorised it, the requester and the timestamp, at the moment of generation rather than reconstructed later. When a takedown report lands — and reports need no account to file, which matters given the 48-hour clock starts on receipt, not on sign-in — the manifest is what turns "we'll investigate" into "revoked, timestamped, actionable within the window."
If you're assessing your own platform against the 19 May 2026 deadline, here's the shape a working pipeline actually takes, in the order it needs to be built:
None of these steps is exotic engineering. What's easy to underestimate is how much of the 48-hour budget gets consumed by steps that happen before deletion — matching, verifying, propagating the revocation — if none of that infrastructure existed beforehand.
It's worth being clear-eyed about why the FTC moved as fast as it did once the deadline arrived. Independent research into non-consensual synthetic intimate imagery, drawing on a survey of over 16,000 respondents across ten countries, found that 2.2% of respondents reported personal victimisation by deepfake pornography, with the overwhelming majority of targets — by most published estimates in the 99–100% range — being women. Reported deepfake volume overall has climbed roughly 550% since 2019, and legislative tracking shows 48 of 50 US states now address sexually explicit deepfakes in some form, with 58 new deepfake-related bills enacted in 2026 alone as of early August.
That legislative pace is the tell. State and federal lawmakers aren't converging on this because it's an easy box to tick — they're converging because the underlying harm scaled faster than the tooling built to answer it. A platform treating the TAKE IT DOWN Act as one more compliance checkbox, rather than as the leading edge of a regulatory direction that isn't reversing, is going to be rebuilding this pipeline again for the next law within a year.
If you run or advise a platform that touches user-generated imagery, video or audio of real people, the honest self-audit is short:
A "no" to any of those is a gap the FTC's letters have already told fifteen major platforms, by name, that it intends to look for. For everyone else, the letters are the preview of where enforcement attention goes next.
This guide anchors LikeWard's compliance cluster. The rest of it:
This article summarises publicly available information about the TAKE IT DOWN Act and related enforcement activity. It is not legal advice — if you're assessing your platform's specific exposure, talk to counsel who can review your product against the current text of the statute and FTC guidance.
Sources: FTC — Take It Down Act enforcement starts now · Wiley Law — May 19 Deadline for TAKE IT DOWN Act Compliance · IAPP — TAKE IT DOWN Act: How to comply as the FTC begins enforcement · StackCyber — Deepfake Legislation Tracker