TAKE IT DOWN Act 2026: The 48-Hour Deepfake Takedown Rule Explained

The TAKE IT DOWN Act is now live. The FTC started enforcement on May 19, 2026, and warning letters have already gone to Meta, Apple, Microsoft, TikTok, Reddit, Snapchat, and X. The Columbus, Ohio criminal conviction in April was the first conviction under the new statute, and the penalty math is brutal: up to $53,088 per violation.

If you create AI content, run a platform that hosts user uploads, or you’ve been the target of a deepfake, this law affects you. Here’s what it actually does, what the 48-hour rule means in practice, and how the takedown process works.

What the TAKE IT DOWN Act Actually Does

The full name is the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes On Websites and Networks Act. Signed into federal law in early 2026, it has two operating parts that work together.

Criminal provision: Knowingly publishing non-consensual intimate imagery (NCII), including AI-generated or computer-altered material, is a federal crime. Maximum penalty is three years in prison if the victim is an adult, with longer terms when the imagery depicts a minor.

Platform provision: Covered platforms that host user-generated content must remove reported NCII within 48 hours of a verified request and make a good-faith effort to remove identical copies. Failing to do that triggers FTC enforcement under Section 5 of the FTC Act.

The two halves are separate. A person who posts a deepfake gets prosecuted criminally. A platform that ignores a takedown request gets fined civilly. Both can happen for the same image.

The 48-Hour Rule, in Plain Language

A covered platform has two business days from receiving a complete takedown request to:

1. Remove the reported image or video from public access
2. Take reasonable steps to identify and remove copies of the same content

The clock starts when the request is received, not when it’s reviewed. Platforms can’t run the request through a multi-week appeals process and then claim the timer didn’t start until day twelve. The FTC’s enforcement guidance is explicit on that point.

What counts as a complete request:

• Identification of the image or video (URL or hash)
• A statement that the imagery depicts the reporter (or someone they have authority to act for)
• A statement that publication was without consent
• Reporter’s signature and contact information

Platforms can ask for additional verification, but only if doing so doesn’t extend total response time past 48 hours. A few platforms tried to require notarized documents in their first compliance drafts. The FTC pushed back, and most have since dropped that requirement.

Who Has to Comply

This is where it gets layered. The law applies to “covered platforms,” defined as any website, app, or online service that “primarily provides a forum for user-generated content” or hosts a “significant amount” of it.

In practice that covers:

• Social platforms (Meta properties, X, TikTok, Snapchat, Reddit)
• Image hosts and gallery sites
• Cloud storage services with public sharing
• Chat platforms with public channels
• Adult content platforms and tube sites
• AI image generators that publish gallery feeds

What’s outside the law’s direct scope:

• Encrypted private messaging without public components
• Pure email providers (though attachments delivered publicly may trigger it)
• Personal cloud backups without sharing
• Local AI tools that don’t host anything online

The warning letters sent in late May targeted exactly the high-traffic platforms most likely to host NCII — Meta, Microsoft, Apple, TikTok, Reddit, Snapchat, and X. The FTC’s signal is that big platforms got first scrutiny but smaller hosts shouldn’t assume they’re invisible.

If you run nudify or undressing tools, the platform side of the law matters even if you don’t host galleries. Any system where users can share outputs publicly puts you in scope.

How a Takedown Request Works

The reporter (the person depicted, or someone with authority to act for them) submits a request to the platform. Most covered platforms now have a dedicated TAKE IT DOWN portal at /takedown or /report-ncii or similar paths. Some bury it inside their general DMCA tools, which the FTC has flagged as a compliance problem.

A workable request looks like this:

• Subject: TAKE IT DOWN Act Removal Request
• Content identification: Direct URL(s), screenshots with visible URLs, or content hashes
• Statement of identity: “I am the person depicted in this content” or “I am authorized to act on behalf of [name]”
• Statement of non-consent: “This material was created and/or published without my consent”
• Contact info: Email and phone for follow-up
• Signature: Electronic signature accepted under the Act

The platform must acknowledge receipt and act within 48 hours. If they refuse, they have to provide a specific reason that fits one of the law’s narrow exceptions (most commonly: the imagery is verifiably consensual, or the reporter can’t be authenticated).

If they don’t act, the next step is reporting the platform to the FTC. The FTC has set up a dedicated intake at reportfraud.ftc.gov with a TAKE IT DOWN category. State attorneys general can also bring parallel actions in most states.

What Happens If a Platform Ignores a Request

Penalties scale with violation count. The FTC’s published maximum is $53,088 per violation, per day. A single image left up for ten days past the deadline can stack to over half a million dollars in exposure for one piece of content. Multiple complaints on the same platform compound fast.

That’s the math behind why every major social platform pushed out updated reporting flows in the first quarter of 2026. The cost of not complying outpaces the cost of building takedown infrastructure within weeks of the first complaint.

The Columbus, Ohio criminal case in April is worth noting separately. That defendant wasn’t a platform — he was an individual who distributed AI-generated nudes of women he knew. He pled guilty under the publishing provision and got a 27-month sentence. The conviction settled an early question about whether the criminal half of the Act could be used against private individuals or only against operators. Answer: both.

What This Means for Creators of AI Content

If you generate AI imagery of real, identifiable people without their consent and share it anywhere accessible to others, you’re now in the criminal scope of the Act. That includes:

• Posting to public forums, Discord servers, Reddit threads
• Sharing via direct message in some circumstances
• Uploading to image hosts, even with restricted access
• Selling the imagery in any context

What’s not currently in criminal scope:

• Generation for purely private use on your own device
• Imagery of fully fictional characters not based on a real person
• Self-generated content where you’re the subject

The distinction between “private” and “shared” is fuzzy. Federal prosecutors have indicated they’ll treat any transmission to a third party as publication. A single share to one friend who later distributes it can pull the original creator into liability under accomplice doctrines.

For users who want the AI-generated imagery experience without any of this risk, the practical answer is sticking to fully synthetic characters from tools that don’t accept real-person photos as input:

The line between “consensual character generation” and “non-consensual likeness alteration” is the thing the Act is built around. Tools that only generate from prompts (no source photos) sit on the safe side of that line.

Practical Takeaways

If you’re a victim of NCII: You have a 48-hour federal pathway now. Document the URL. File the takedown request with the platform. If they don’t act, file with the FTC. You can pursue criminal complaints in parallel — the FBI’s IC3 portal accepts TAKE IT DOWN reports and routes to local field offices.

If you create AI content: Sharing AI-generated intimate imagery of any identifiable real person without explicit consent is now criminally prosecutable at the federal level. The “I didn’t think anyone would care” defense doesn’t survive contact with a federal subpoena. Stick to synthetic characters or get verifiable consent in writing.

If you operate a platform: The compliance bar is dedicated intake, automated hash matching for re-uploads, and 48-hour response from receipt. Anything less puts you in FTC enforcement range. The fines stack daily.

If you’re just a user worried about exposure: You’re not liable for what other users post. But if someone uses your photo to generate AI nudes and posts them, you have a working federal tool to get them removed quickly. Earlier versions of this process took weeks or months. The 48-hour rule is real, and platforms are responding to it.

For broader context on how this law fits with the rest of the 2026 deepfake legal landscape — including the DEFIANCE Act civil pathway, the EU’s pending nudifier ban, and the UK’s separate creation offense — see our AI nudify laws guide. For users worried about their own data exposure on AI platforms, the AI girlfriend privacy guide covers what these companies actually do with uploaded photos. And if you’re trying to figure out which AI image generators operate within the consent boundaries the Act establishes, that roundup separates the synthetic-only tools from the photo-input ones.

Frequently Asked Questions

What does the TAKE IT DOWN Act actually require platforms to do?

Remove reported non-consensual intimate imagery within 48 hours of a verified takedown request, and make reasonable efforts to prevent re-uploads of the same content. Failing to comply triggers FTC enforcement with civil penalties up to $53,088 per violation.

When did FTC enforcement begin?

May 19, 2026. The FTC issued warning letters to Meta, Apple, Microsoft, TikTok, Reddit, Snapchat, and X around the same date, signaling enforcement is active.

Can I get prosecuted for creating an AI nude image of a real person if I never share it?

The criminal provision is built around publication. Pure private creation on your own device isn’t directly criminalized by the TAKE IT DOWN Act federally. But several state laws criminalize creation itself, and any transmission to a third party generally counts as publication.

How do I file a TAKE IT DOWN request?

Find the platform’s dedicated NCII or TAKE IT DOWN reporting tool, usually linked in their help center or safety pages. Submit the URL, a statement of identity and non-consent, and your contact info. The platform has 48 hours to act. If they don’t, report to the FTC at reportfraud.ftc.gov.

Does this apply to AI-generated characters that aren’t based on real people?

No. The Act targets imagery of identifiable real people. Fully synthetic characters generated from text prompts aren’t covered, though imagery depicting minors remains illegal under existing CSAM statutes regardless of how it was generated.

What was the first criminal conviction under the Act?

A Columbus, Ohio man pled guilty in April 2026 to distributing AI-generated nudes of women he knew personally. He received a 27-month federal sentence. The case settled that individual users — not just platforms — can be charged under the publishing provision.

Are encrypted messaging apps covered?

Private encrypted messaging without public components is generally outside the platform provision. But group chats with broadcast functions, and any messaging tied to public profiles, may fall within scope. The FTC has signaled it will issue clarifying guidance on encrypted services later in 2026.

How does this interact with the DEFIANCE Act?

TAKE IT DOWN is criminal plus platform takedown. DEFIANCE is civil — it gives victims a private right of action with statutory damages up to $150,000 per image. They’re separate tools and can be used together. A single deepfake incident can trigger criminal prosecution, civil suit, and platform takedown obligations simultaneously.

What about deepfakes that aren’t sexual?

The TAKE IT DOWN Act covers intimate imagery specifically — nudity, sexual content, or similar. Non-sexual deepfakes (impersonation videos, voice clones for fraud) fall under different statutes like the DEFIANCE Act’s broader provisions or state-level deepfake laws.

The TAKE IT DOWN Act is one of the fastest-moving pieces of internet regulation the US has produced in years. Compliance flows are still being refined. Enforcement priorities will sharpen through the rest of 2026. But the 48-hour rule is operational now, the criminal cases are landing, and the penalty math means platforms are taking this seriously for the first time.