Since 19 May 2026, any US-facing service that hosts user-generated content must run a notice-and-removal process that takes down non-consensual intimate images, including AI-generated ones, within 48 hours of a valid request, and the Federal Trade Commission is enforcing it. The TAKE IT DOWN Act (Public Law 119-12, approved 19 May 2025) made publishing such images a federal crime and gave covered platforms one year to build the removal process. This guide covers who is covered, what a valid request contains, the 48-hour clock, identical copies, the good-faith liability protection, FTC enforcement, and how to build and evidence the process. It is written for trust and safety, legal, privacy and engineering leads. For the UK regime, see the UK Online Safety Act guide.
Key takeaways
- Coverage is broad. A covered platform is a public website, online service, online application or mobile app that primarily provides a forum for user-generated content, or that regularly publishes, curates, hosts or makes available non-consensual intimate depictions. Broadband providers, email and services built mainly on provider-selected content are excluded.
- The clock is 48 hours. On a valid request, the platform must remove the depiction as soon as possible and no later than 48 hours after receiving it, and make reasonable efforts to remove known identical copies.
- Deepfakes are included. The Act covers "digital forgeries" as well as authentic images, and the FTC's guidance says the process must handle both.
- Non-compliance is an FTC rule violation. Failure to reasonably comply is treated as a violation of a rule on unfair or deceptive acts or practices. The FTC and WilmerHale both state civil penalties of up to $53,088 per violation.
- Good-faith removal is protected. A platform is not liable for removing or disabling material in good faith on the basis that it appears to be a non-consensual intimate depiction, even if it is later found lawful.
What the Act does
The Act has two parts that matter to organisations.
| Part | Who it binds | What it does | Enforced by |
|---|---|---|---|
| Section 2: criminal offences | Individuals who publish | Adds subsection (h) to section 223 of the Communications Act of 1934, making it an offence to knowingly use an interactive computer service to publish authentic intimate depictions or digital forgeries without consent under the harm conditions set out, and to threaten to do so | US Department of Justice |
| Section 3: notice and removal | Covered platforms | Requires a notice-and-removal process within one year of enactment, removal within 48 hours of a valid request, and reasonable efforts on identical copies | Federal Trade Commission |
| Section 4: definitions | All | Defines covered platform and its exclusions | Not applicable |
Section 2 penalties under the Act: up to 2 years' imprisonment for offences involving adults and up to 3 years for offences involving minors; threats involving digital forgeries carry up to 18 months (adults) and 30 months (minors). Courts must also order forfeiture and restitution. These bind individuals, but a platform's records may become evidence in prosecutions, which shapes how you preserve them.
Are you a covered platform?
The FTC's business guidance says the definition spans many kinds of services, including social media, messaging, image or video sharing and gaming platforms. Work through these questions with counsel.
- Does the service serve the public? Purely internal enterprise tools are unlikely to meet the definition, but customer communities, support forums and public file sharing may.
- Is user-generated content the primary function? Messages, videos, images, games or audio uploaded by users point towards coverage.
- Does an exclusion apply? Broadband internet access service, electronic mail, and services that mainly provide content chosen by the provider, where comments or chat are incidental, are excluded.
- Does the business regularly host such imagery? The second limb catches sites whose trade includes making non-consensual intimate depictions available, whatever their main function.
Record the outcome and reasoning. If the answer is "possibly", NHI Mgmt Group recommends building the process anyway: it is cheaper than defending a scoping decision after a complaint to the FTC.
The valid request and the 48-hour clock
Section 3 sets four elements for a valid written request from the depicted individual or someone authorised to act for them:
| Element | What the Act requires | Design note |
|---|---|---|
| Signature | A physical or electronic signature | A typed name with a confirmation checkbox in a web form is the usual electronic approach; confirm with counsel |
| Location | Information reasonably sufficient to locate the depiction | Accept URLs, post or message IDs and a "report this" action on the content itself |
| Good-faith statement | A brief statement of good-faith belief that the depiction was published without consent, with relevant information | Provide the statement text; do not demand proof of identity beyond what the Act asks |
| Contact information | Information so the platform can contact the requester | Email is sufficient; allow requests from people without accounts |
The platform must also publish a clear and conspicuous plain-language notice of the process and its responsibilities. The FTC suggests placing it on the home page and wherever intimate content may appear, letting people report directly from the image or video, accepting requests from non-users, giving each request an identifying number, and telling requesters whether content was removed and, if not, why. The FTC page notes that requesters do not need to report duplicate copies.
Running the clock: start the 48 hours at receipt, not at triage. WilmerHale's analysis recommends a process that runs continuously rather than in an ordinary moderation queue, covering every surface where content appears: posts, messages, comments and uploads.
Identical copies and re-uploads
The Act requires reasonable efforts to identify and remove known identical copies. The FTC suggests, as recommendations rather than mandates, using hashing to stop removed content reappearing and sharing hashes with NCMEC's Take It Down service for images of minors and StopNCII.org for images of adults.
- Exact hashes: cryptographic hashes catch byte-identical files only.
- Perceptual hashes: catch resized or re-encoded versions; set match thresholds with human review to limit false removals.
- Hash lists as sensitive data: restrict who can add, remove or query entries, and log every change, because a poisoned list can remove lawful content at scale.
Store hashes, not the images, wherever the process allows. Reviewers should see the minimum needed to decide, and images of minors must be handled under your child sexual abuse material procedures and legal reporting duties.
Security and abuse of the process
A fast, low-friction takedown channel is also an attack surface. The Act's good-faith protection reduces legal risk from over-removal, but not the business harm of false takedowns.
| Risk | Control |
|---|---|
| Mass false requests to remove lawful content | Rate limiting per requester and per target; pattern detection on request volumes; escalate bursts to senior review |
| Phishing using fake "removal notices" | Send status updates only from a documented domain with SPF, DKIM and DMARC; never ask requesters for passwords |
| Insider misuse of the review queue | Role-based access, quarterly access reviews, full audit logs of who viewed what |
| Leakage of reported images | Encrypted storage, short retention for review copies, no export from the review tool |
| Deepfake requests targeting staff or executives | Route to the same process; link to impersonation response |
For the impersonation side, see the Deepfake and AI Impersonation Guide.
Building the process: a phased approach
This sequence is NHI Mgmt Group's recommendation.
- Assign ownership. Name a cross-functional owner across legal, trust and safety, engineering, privacy and support, including any moderation vendor, who must meet the same 48-hour clock.
- Publish the notice and intake. Plain-language notice, a web form with the four elements, a report action on content, and access for non-users.
- Wire the clock. Assign a request ID at receipt, a timer with escalation at 24 and 40 hours, and out-of-hours cover.
- Add copy detection. Hash on removal, block re-uploads, and decide whether to share hashes with NCMEC Take It Down or StopNCII.
- Test end to end. Submit test requests from accounts and non-users across every content surface; measure time to removal. Roll back a faulty detection rule by switching it to flag-only, never by pausing intake.
- Keep records. Intake time, decision, removal time, copies found and requester updates, retained under a documented schedule.
Decision guidance
- Small versus large platforms: a small forum can meet the Act with a monitored form, a named on-call reviewer and exact hashing. Large platforms need automated routing, perceptual matching and vendor contracts that carry the 48-hour clock.
- Remove first or review first: where review cannot finish inside the window, the good-faith protection supports removing or disabling access first, then reviewing.
- US-only or global process: one process that also meets UK Online Safety Act duties is simpler than two; see the UK Online Safety Act guide and the Age Assurance and Children's Design Codes guide.
Detection and measurement
- Share of valid requests resolved inside 48 hours, and the 95th percentile time to removal.
- Identical copies found per removal, and re-uploads blocked by hash match.
- Requests from non-users as a share of the total (a very low share can mean the channel is hard to find).
- Requests later found invalid, and reinstatement time.
- Complaints received via TakeItDown.ftc.gov or regulators.
Framework mapping
| Act requirement | NIST CSF 2.0 | SP 800-53 Rev. 5 |
|---|---|---|
| Process, ownership and notice | GV.OC-03, GV.RR-02 | PM-26 |
| Access to the review queue | PR.AA-05 | AC-6 |
| Audit trail of decisions | DE.CM-03 | AU-2 |
Mappings are ours and indicative only; the Act does not reference these frameworks.
Common failure patterns
- Account-only reporting: the form requires sign-in, excluding the many victims who are not users.
- Clock starts at triage: requests wait in a general queue over a weekend.
- Messages and comments missed: the process covers public posts only.
- No copy search: the reported item is removed and identical copies stay up.
- Vendor gap: the moderation contractor works to a 72-hour service level.
Practitioner checklist
- Record a covered platform assessment with counsel.
- Publish a clear, plain-language notice of the process.
- Accept requests with the four statutory elements from users and non-users.
- Issue a request ID and run a 48-hour timer from receipt.
- Search for and remove known identical copies; hash to block re-uploads.
- Restrict and log access to reported content and hash lists.
- Align vendor contracts with the 48-hour clock.
- Keep dated records of every request, decision and removal.
Standards and references
- US Government Publishing Office: Public Law 119-12, TAKE IT DOWN Act
- FTC: Complying With the Take It Down Act
- FTC: FTC Begins Enforcing Take It Down Act
- WilmerHale: The TAKE IT DOWN Act Goes Live
This guide summarises the TAKE IT DOWN Act and is not legal advice. Related NHI Mgmt Group resources: UK Online Safety Act · Sextortion · COPPA and Children's Privacy Guide · Deepfake and AI Impersonation Guide