On May 19, 2026, the TAKE IT DOWN Act’s platform compliance window closed. Every “covered platform” in the United States is now required to have a working notice-and-removal system for nonconsensual intimate imagery, including AI deepfakes — and to act on a valid takedown notice within 48 hours. The law was signed by President Trump on May 19, 2025, and platforms had exactly one year to build the system.
For adult creators, this is not a small change. The law makes nonconsensual intimate imagery (NCII) — including digital forgeries — a federal crime. The 48-hour platform takedown obligation is now active across major US platforms. That includes deepfakes that use your face on someone else’s body.
This article explains, in plain English, what the law does, what it does not do, and how to use a takedown notice now that the system is live.
Related on AIU: AI Nudes and the Law · What to Do If You Get Doxxed · Age Verification Laws by State
Educational use only — not legal advice. This guide is for general information. It is not legal advice and does not create an attorney-client relationship. Laws change, and how a law applies to your situation depends on facts that only your own lawyer can evaluate. If you are dealing with NCII, harassment, or a takedown that affects your livelihood, please talk to a licensed attorney in your jurisdiction. For free crisis support, the Cyber Civil Rights Initiative Image Abuse Helpline is open 24/7 at 1-844-878-2274.
What the TAKE IT DOWN Act actually does
The full name of the law is “Tools to Address Known Exploitation by Immobilizing Technological Deepfakes On Websites and Networks Act,” which is why everyone calls it TAKE IT DOWN. It became Public Law 119-12 on May 19, 2025, after passing the Senate unanimously and the House 409–2.
The Act has two main parts.
Part one: federal crime for publishing NCII
It is now a federal crime to knowingly publish a nonconsensual intimate visual depiction of an identifiable adult, including a “digital forgery” (a deepfake or other AI-generated image). The criminal piece amends Section 223 of the Communications Act of 1934 (47 U.S.C. § 223), the same statute that already covered other forms of harmful online communication.
Penalty ranges, as reported by major law firm analyses of the final bill:
| Victim | Maximum prison term |
|---|---|
| Adult | Up to 2 years |
| Minor | Up to 3 years |
The law also allows fines and restitution. The criminal provisions took effect immediately when the bill was signed in May 2025.
Part two: 48-hour platform takedown mandate
This is the part that goes live on May 19, 2026.
A “covered platform” — generally a public website, online service, or app that hosts user-generated content — must build a notice-and-removal process. When a depicted person submits a valid notice, the platform has 48 hours from receipt of that valid notice to:
- Remove the intimate visual depiction, and
- Make reasonable efforts to remove identical copies.
The Federal Trade Commission enforces this part. A platform that does not “reasonably comply” with the notice-and-removal duties commits an unfair or deceptive practice under the FTC Act (15 U.S.C. § 57a(a)(1)(B)), which gives the FTC the power to impose civil penalties and seek injunctions.
Good-faith immunity for platforms
The law gives platforms liability protection when they remove content in good faith based on a notice — even if it later turns out the depiction should not have been removed. The trade-off is real: platforms have a legal incentive to err on the side of removal, because removing in good faith is safer than refusing and getting an FTC complaint.
For creators, that’s a double-edged sword. We’ll come back to it in the next section.
Sources for this section: S.146 Bill Text on Congress.gov, Skadden client alert, Orrick analysis, RAINN summary.
What the law does NOT do
This is where honesty matters more than hype. The TAKE IT DOWN Act is real progress, but it is not a silver bullet. Here’s what it leaves on the table.
It does not cover every form of image-based abuse
The criminal definition of NCII in the Act is narrower than the takedown definition. Some forms of revenge porn, harassment, and unauthorized content sharing may fall outside the federal criminal piece, which is one reason state revenge porn laws still matter. Roughly 48 states already had some NCII or revenge porn statute on the books before TAKE IT DOWN passed. Those state laws are not preempted by the new federal law. A state attorney general or local prosecutor may still be your most useful avenue for a particular case.
It does not give you a private right of action against the original poster
This is a big one for creators to understand. The TAKE IT DOWN Act does not create a new federal civil cause of action that lets you sue the person who posted the image. It creates:
- A federal criminal offense (which only a US Attorney can prosecute), and
- A platform takedown duty (which only the FTC can enforce against the platform).
If you want to sue the original poster for damages, you’d typically rely on state revenge porn statutes, copyright (if you took the image), invasion of privacy, intentional infliction of emotional distress, or other state-law claims. Talk to a lawyer about what’s available where you live.
It has limited reach against foreign servers
US criminal law and FTC authority generally stop at the US border. If the image is hosted on a server in a country that does not cooperate, the takedown notice may go nowhere. There are still options — copyright takedowns under the DMCA reach further than people think, and some foreign hosts respond to international NCII reports — but the new federal law itself is not a magic wand outside US jurisdiction.
It has been criticized for being too broad in the takedown half
The Electronic Frontier Foundation and the Center for Democracy & Technology, among others, have argued that the takedown definition in the law is broader than the criminal definition. EFF’s analysis warns that the takedown provision could potentially reach “any images involving intimate or sexual content,” that the 48-hour clock leaves little time to verify whether content is actually nonconsensual, and that platforms will likely lean on automated filters that have a long history of taking down legal content. EFF also flagged real concerns for end-to-end encrypted messaging services.
For adult creators, this means your own legal, consensual content could get caught up in over-removal — especially if a bad actor files a false notice claiming you are the depicted person. There is no specific civil penalty in the statute for filing a knowingly false notice, which the EFF and others identified as a major gap.
This is not an argument against using the law. It is an argument for knowing how it actually works so you can use it correctly and push back when it gets misused against you.
Sources for this section: EFF analysis, TechPolicy.Press, National Association of Attorneys General.
How to send a TAKE IT DOWN notice
Once May 19, 2026 hits, here’s the basic flow if your image (real or deepfaked) is posted somewhere without your consent.
Step 1: Identify the platform
Find the actual URL where the content is hosted. Screenshot it. Save the URL, the date, and any identifying information about the account that posted it. Do this even if the content is deeply upsetting — that documentation is your evidence.
Step 2: Find the platform’s NCII removal contact
After May 19, every covered platform should have a clear process posted. Look for headings like “Report nonconsensual intimate imagery,” “TAKE IT DOWN notice,” or “NCII removal.” This is often inside a Trust & Safety, Help, or Legal page.
Step 3: Submit a valid notice with the required elements
Based on the statute, a valid removal request needs to include:
- An electronic or physical signature of the depicted person (or someone authorized to act for them),
- Information sufficient to identify and locate the content (the URL is the cleanest way),
- A good-faith statement that the depiction was published without your consent, and
- Contact information so the platform can reach you.
A simple template, written in plain language:
To [Platform] Trust & Safety: I am [Full Name], and I am the individual depicted in the content located at [URL]. This content was published without my consent. I am submitting this notice under the TAKE IT DOWN Act and request that the content, and any identical copies, be removed within 48 hours. You can reach me at [email] and [phone]. Signed electronically: [Name], [Date]
The 48-hour clock starts when the platform receives a valid notice, so make sure your submission is complete the first time. An incomplete notice can reset the clock.
Step 4: Save the receipt
Take a screenshot of the submission confirmation. If the platform sends an email acknowledgment, keep it. You will need that paper trail if you ever have to escalate to the FTC.
Deepfakes and AI-generated content under the law
Before TAKE IT DOWN, the federal response to AI-generated NCII was patchy and depended heavily on state law. The new statute closes that gap.
The Act specifically defines “digital forgery” to include depictions created or altered by software, machine learning, AI, or any other “computer-generated or technological means” that, when viewed, are indistinguishable from an authentic image of the actual person and depict them in a way that they did not actually do.
In plain language: if someone takes your face and puts it on someone else’s body using AI, and the result looks real, that image is covered. It does not matter that the body is not yours. It does not matter that no actual sexual act occurred. The law treats AI-generated NCII the same way it treats real NCII for both criminal and takedown purposes.
This is one of the biggest changes for creators. Face-swap and undress apps have made deepfake harassment cheap and fast over the past two years. The federal floor for response is now meaningfully higher.
In November 2025, the Senate Commerce Committee announced the first conviction obtained under the TAKE IT DOWN Act in a case involving AI-generated deepfakes, so this is not theoretical.
What to do if a platform refuses or delays removal
If the 48-hour clock runs out and the content is still up — or the platform stalls, denies your notice, or never responds — you have options. None of them are instant, but all of them matter.
File an FTC complaint
The FTC enforces the takedown half of the law. You can file a complaint at reportfraud.ftc.gov. Reference the TAKE IT DOWN Act, attach your notice and any platform response, and explain how the platform failed to comply.
Contact your state attorney general
State AGs have growing authority over platform conduct, and many have dedicated cybercrime or consumer protection units. State AG offices also enforce state revenge porn laws, which often include both criminal and civil remedies.
Consider a civil suit against the original poster
Under state law (this varies a lot), you may be able to sue the person who posted the content for damages. Common causes of action include:
- State revenge porn statutes (most US states have one)
- Invasion of privacy / publication of private facts
- Intentional infliction of emotional distress
- Copyright infringement (if you took the original photo)
This is a place where having a real attorney matters.
Free help and crisis support
- Cyber Civil Rights Initiative (CCRI) Image Abuse Helpline: 1-844-878-2274, free and 24/7. CCRI also runs a Safety Center with step-by-step removal guides at cybercivilrights.org/ccri-safety-center/.
- CCRI’s website: cybercivilrights.org.
How creators can prepare before May 19
The platform compliance deadline is in less than three weeks. A few things you can do this week to be ready:
- Document your real identity vs. stage name. If you ever need to send a TAKE IT DOWN notice, the platform has to verify that you are the person depicted. Have a clean copy of a government ID and a recent photo ready in a secure folder.
- Build a small content provenance archive. Keep originals, capture dates, and any watermark or metadata for your own content. If you ever have to prove that a deepfake is fake, originals help.
- Bookmark the NCII removal page for every platform you appear on. OnlyFans, Fansly, LoyalFans, X (Twitter), Reddit, Instagram, TikTok, and the major adult tubes — find their reporting pages now, before you need them.
- Save a takedown template in your notes app so you can fill in the URL and send it within minutes when something appears.
- Know your state’s NCII law as a backup. TAKE IT DOWN does not preempt state law, and state remedies (especially civil suits and state criminal charges) often go further.
- Have a lawyer’s contact saved. Even a single attorney consultation gives you a relationship to draw on later. CCRI’s referral list is a good starting point.
The international gap
US law has limited reach over foreign-hosted content. If you operate internationally — or if your content gets reposted to non-US sites — here’s the brief landscape:
- European Union: The Digital Services Act (DSA) requires very large platforms to act on illegal content notices and gives users a structured complaint pathway. The General Data Protection Regulation (GDPR) provides additional rights over your image and personal data, including a right to erasure under certain conditions.
- United Kingdom: The Online Safety Act 2023 includes specific provisions on intimate image abuse and gives Ofcom regulatory authority over user-to-user services.
- Canada and Australia: Both have established eSafety / image-based abuse complaint pathways with statutory takedown powers.
If your content is hosted on a non-US site, US-based notices may not work. Look up the host’s country and that country’s NCII process. Local lawyers with internet law experience are worth their fees here.
Where this fits in a platform-risk strategy
There’s a broader lesson under the legal one. NCII risk is one form of platform risk. Account suspension is another. Sudden policy changes, payment processor pulls, content category bans, and platform shutdowns are others. Operating across multiple platforms reduces single-point-of-failure exposure for all of them — including content removal.
Different platforms also publish their NCII contact pages with different levels of clarity. Before May 19, it is worth knowing which of your platforms make it easy to file a takedown and which make it hard.
Platforms vary in how visibly they publish their NCII response process. Major platforms with public NCII contacts include OnlyFans, Fansly, and LoyalFans. Whichever platforms you use, the takeaway is the same: bookmark the contact page before you need it.
FAQ
When does the TAKE IT DOWN Act take effect?
The criminal provisions took effect on May 19, 2025, when President Trump signed the bill. The platform notice-and-removal requirements take effect on May 19, 2026, one year after signing.
Does TAKE IT DOWN cover deepfakes?
Yes. The law specifically defines “digital forgery” to include AI-generated and software-altered images that are indistinguishable from an authentic image of the depicted person. Deepfake NCII is treated the same as real NCII for both the criminal and takedown halves of the law.
How long do platforms have to remove NCII?
Once a covered platform receives a valid removal notice, it has 48 hours to remove the depiction and make reasonable efforts to remove identical copies.
Can I sue under the TAKE IT DOWN Act?
The TAKE IT DOWN Act does not create a private right of action you can use to sue the original poster. It creates a federal crime (prosecuted by the US government) and a platform takedown duty (enforced by the FTC). To sue the poster directly, you would typically rely on state revenge porn laws, copyright, privacy torts, or other state-law claims. Talk to a lawyer about what’s available where you live.
What if the platform refuses?
You can file a complaint with the FTC at reportfraud.ftc.gov, contact your state attorney general, and consider civil action under state law. The CCRI Helpline (1-844-878-2274) can help you figure out next steps.
Does TAKE IT DOWN apply outside the US?
Generally, no. US criminal law and FTC authority apply within US jurisdiction. For content hosted overseas, look at the EU’s DSA, the UK’s Online Safety Act, or the relevant local NCII process. Cross-border NCII remains a real gap.
What counts as a “covered platform”?
Generally, public websites, online services, and apps that primarily host user-generated content, plus services primarily designed to publish nonconsensual intimate depictions. Major exclusions reported in legal analyses include broadband internet access providers, email services, and curated content platforms. The exact contours will get tested in early FTC enforcement.
