Internet Lawyer Blog
The internet has made it easier than ever for private images, videos, and personal information to be copied, posted, shared, and republished across multiple online platforms within minutes. Artificial intelligence has made the problem even more dangerous. Today, a person can be targeted not only by the unlawful posting of real intimate images, but also by AI-generated “deepfake” images or videos that falsely appear to depict that person in an intimate or sexually explicit manner.
This is no longer a fringe problem. Victims of nonconsensual intimate images, revenge porn, sextortion, cyber harassment, and AI-generated deepfakes often face immediate reputational damage, emotional distress, financial harm, employment consequences, family disruption, and personal safety concerns. In many cases, victims also struggle to determine where the content was posted, who posted it, whether copies have been made, and which platform has the legal responsibility to remove it.
The federal TAKE IT DOWN Act is designed to address this problem by creating a clearer legal framework for removing nonconsensual intimate images from covered online platforms. The statute was enacted on May 19, 2025 as Public Law 119-12, and the Federal Trade Commission began enforcing the Act’s platform notice-and-removal obligations on May 19, 2026.
The Federal Act Is Different From NCMEC’s Take It Down Tool
Readers should not confuse the federal TAKE IT DOWN Act with the separate Take It Down service operated by the National Center for Missing & Exploited Children (NCMEC). NCMEC’s Take It Down tool is an operational, voluntary hash-based service designed for people who are under 18, or adults seeking help with images or videos taken when they were minors. The tool creates a digital fingerprint, or hash, of a nude, partially nude, or sexually explicit image or video and shares that hash with participating online platforms so they can help detect and remove matching content.
The federal TAKE IT DOWN Act is different. It is a statute that creates criminal prohibitions and imposes notice-and-removal obligations on covered platforms for qualifying nonconsensual intimate visual depictions, including certain AI-generated digital forgeries. In practice, victims and their counsel may need to consider both resources: the NCMEC service where the image or video was taken when the person was a minor, and the federal statutory removal process for covered platform obligations.
What Is the TAKE IT DOWN Act?
The TAKE IT DOWN Act stands for the “Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act.” The law addresses nonconsensual intimate visual depictions, including certain real intimate images and AI-generated digital forgeries. It has two major components.
First, the law creates federal criminal prohibitions related to knowingly publishing certain nonconsensual intimate visual depictions or digital forgeries through an interactive computer service. The statute addresses both adults and minors, and it includes penalties that may involve fines, imprisonment, forfeiture, and restitution depending on the facts and the category of conduct.
Second, the law imposes notice-and-removal obligations on certain covered platforms. Covered platforms must create a process for an identifiable individual, or an authorized person acting on that individual’s behalf, to request removal of a nonconsensual intimate visual depiction. The law requires the platform to provide a clear and conspicuous notice describing the removal process in plain language.
This is important because victims often face a race against time. Once intimate content is posted online, it can spread through screenshots, reposts, direct messages, archived links, mirror accounts, anonymous profiles, and automated scraping. A takedown process that operates days, weeks, or months later may be too late to prevent serious harm.
The 48-Hour Removal Requirement
One of the most significant provisions of the TAKE IT DOWN Act is the 48-hour removal deadline. After receiving a valid removal request, a covered platform must remove the intimate visual depiction as soon as possible, but no later than 48 hours after receiving the valid request. The platform must also make reasonable efforts to identify and remove known identical copies of the depiction. A valid request is not merely an informal complaint; it must satisfy the statutory requirements, including sufficient information to identify and locate the content, a good-faith statement that publication was nonconsensual, a signature, and contact information for the requester.
This provision is critical because a single removal is often insufficient. In many online abuse cases, the same image or video may be uploaded repeatedly, shared under different usernames, reposted by related accounts, or circulated in private groups. The requirement to address known identical copies helps reduce the burden on victims, who should not be forced to submit a separate takedown request for every duplicate image or video when the platform already knows about identical copies.
The Federal Trade Commission has stated that covered platforms include social media, messaging, image-sharing, and video-sharing apps and websites. The FTC has also explained that the law applies to real images, digitally altered images, and AI-generated deepfakes.
What Is a “Covered Platform”?
The TAKE IT DOWN Act does not apply to every entity on the internet in the same way. The statute defines a “covered platform” as a website, online service, online application, or mobile application that serves the public and primarily provides a forum for user-generated content, including messages, videos, images, games, and audio files. It also covers platforms that, in the regular course of business, publish, curate, host, or make available content involving nonconsensual intimate visual depictions.
This definition may include many social media platforms, video-sharing services, image-hosting platforms, messaging apps with user-generated content features, gaming communities, forums, and other online services where users can upload, post, transmit, or share media.
However, the statute also includes exclusions. For example, it excludes broadband internet access services and electronic mail. It also excludes certain online services that primarily consist of non-user-generated content preselected by the provider, where interactive features are incidental or directly related to that content.
For businesses, this means the first compliance question is whether the service qualifies as a covered platform. The answer may depend on how the service operates, what types of user-generated content it hosts, whether it serves the public, and whether it regularly publishes, curates, hosts, or makes available relevant content.
What Must a Valid Removal Request Include?
The TAKE IT DOWN Act requires a covered platform to establish a process through which an identifiable individual, or an authorized person acting on that individual’s behalf, can submit a removal request. A valid request must generally be in writing and include enough information for the platform to evaluate and locate the content. For publication purposes, the precise formulation is that the 48-hour removal obligation begins after the platform receives a valid removal request, not after every incomplete, informal, or unsupported communication.
The statute requires the request to include a physical or electronic signature, information reasonably sufficient to identify and locate the intimate visual depiction, a brief statement of the requester’s good-faith belief that the depiction was published without consent, and contact information sufficient for the platform to communicate with the requester.
For victims, this means documentation matters. A removal request should be organized, accurate, and complete. It should identify the URLs, usernames, account handles, post dates, screenshots, platform names, and any known duplicate posts. If the content is being reposted through multiple accounts, the request should identify each known location and explain why the content is nonconsensual.
The TAKE IT DOWN Act and AI-Generated Deepfakes
The TAKE IT DOWN Act is especially important because it addresses AI-generated intimate deepfakes. Historically, many legal remedies focused on real photographs or videos. However, modern generative AI tools can create fake intimate images that appear realistic enough to cause serious reputational, emotional, and economic harm.
A victim of an AI-generated intimate deepfake may face the same practical damage as a victim whose real image was posted without consent. Employers, clients, colleagues, family members, and online communities may not immediately know whether the content is authentic. Even after a victim proves the image is fake, the harm may already be done.
The law’s inclusion of “digital forgeries” recognizes that online sexual abuse can occur through fabricated media. The statute defines a digital forgery to include an intimate visual depiction created through software, machine learning, artificial intelligence, or other computer-generated or technological means, where the depiction appears indistinguishable from an authentic depiction when viewed as a whole by a reasonable person.
This is a meaningful development for victims of AI-enabled abuse, including students, professionals, public figures, private individuals, minors, and business owners whose identities are misused in fabricated explicit content.
What Should Victims Do Immediately?
Victims should act quickly, but carefully. The first instinct may be to delete messages, confront the perpetrator, or ask friends to report the content immediately. While some of those steps may be appropriate in certain circumstances, victims should first preserve evidence.
Important evidence may include screenshots, screen recordings, URLs, usernames, profile links, timestamps, direct messages, threats, payment demands, phone numbers, email addresses, cryptocurrency wallet addresses, metadata, and correspondence with the platform. Victims should also preserve copies of all takedown requests and platform responses.
Where the perpetrator is anonymous, evidence preservation becomes even more important. A lawyer may need to send preservation letters, pursue civil subpoenas, request early discovery, or seek court authorization to identify the responsible party. In cases involving threats, extortion, stalking, minors, or immediate safety risks, victims may also need to contact law enforcement.
The FTC has launched a complaint website for people to report covered platforms that fail to create a removal process or fail to act on valid removal requests. The FTC has explained that a person may report a platform that does not remove a nonconsensual intimate image or known identical copies within 48 hours of a request.
How the TAKE IT DOWN Act Interacts With California Law
For California victims, the TAKE IT DOWN Act should be viewed as one part of a broader legal strategy. It may help secure removal from covered platforms, but removal alone may not fully compensate the victim or prevent future harm. California law may provide additional civil remedies depending on the facts.
Potential California claims may include invasion of privacy, public disclosure of private facts, intentional infliction of emotional distress, negligent infliction of emotional distress, cyber harassment, stalking-related claims, civil harassment restraining orders, claims involving nonconsensual distribution of intimate images, claims involving digitized or AI-generated sexually explicit material, and related torts. In some cases, claims may also involve defamation, false light, extortion or sextortion-related facts, copyright issues, unfair competition, or contractual violations.
California Civil Code section 1708.85 provides a private cause of action for intentional distribution of certain intimate images without consent where the statutory elements are met, and it may support equitable relief, attorney’s fees, pseudonym protections, and confidentiality procedures. California Civil Code section 1708.86 addresses digitized sexually explicit material, including AI-generated or deepfake material, and may permit recovery of monetary gain, economic and noneconomic damages, statutory damages, punitive damages, attorney’s fees and costs, injunctive relief, and other available relief where its requirements are satisfied.
The proper legal theory depends on the evidence. For example, a case involving an ex-partner who threatens to publish intimate images for money may require a different strategy than a case involving an anonymous deepfake account, a hacked cloud account, a fake profile, or a platform that refuses to honor a valid removal request.
Platform Compliance and Business Risk
The TAKE IT DOWN Act also creates important compliance obligations for online businesses. Platforms should not wait until a complaint is received to design a policy. Covered platforms should have a clear notice-and-removal workflow, trained personnel, escalation procedures, documentation practices, duplicate-detection procedures, and a process for responding within the statutory deadline.
The FTC has stated that it enforces Section 3 of the TAKE IT DOWN Act and that failure to comply with the notice-and-removal obligations may result in enforcement consequences.
Businesses should evaluate whether they host user-generated content, whether users can post images or videos, whether private messaging or group-sharing features exist, whether reports are reviewed promptly, and whether the company has a defensible record of compliance. Terms of service, community guidelines, privacy policies, trust-and-safety procedures, and content moderation practices should be updated to reflect the new legal environment.
Removal Is Not the End of the Case
The TAKE IT DOWN Act gives victims an important federal tool, but it does not solve every legal problem. A successful takedown may remove content from one platform, but it may not identify the perpetrator, recover damages, stop harassment, prevent reposting on other platforms, or preserve evidence for civil litigation.
Victims often need a multi-step legal response. This may include emergency evidence preservation, platform takedown notices, law enforcement reports, civil subpoenas, restraining orders, demand letters, settlement negotiations, forensic review, and litigation. In cases involving AI-generated deepfakes, counsel may also need to evaluate platform logs, account creation records, IP addresses, device identifiers, payment records, prompt histories, image-generation tools, and social media distribution patterns.
For businesses, compliance also requires more than simply adding a webform. A platform should be able to prove that it maintains a clear process, receives requests, reviews them promptly, removes qualifying content within the required period, addresses known identical copies, and preserves appropriate internal records.
Conclusion
The TAKE IT DOWN Act is a significant federal development in the fight against nonconsensual intimate images, AI-generated deepfakes, revenge porn, and sextortion. It gives victims a clearer path to demand removal from covered platforms and gives regulators a framework to hold noncompliant platforms accountable. However, victims should not rely on platform removal alone. When intimate images or deepfakes are posted or threatened online, evidence can disappear quickly, anonymous wrongdoers can hide behind accounts and devices, and duplicate content can spread across multiple platforms. A prompt, organized, and legally informed response can make a substantial difference.
Our law firm assists clients with internet law, online harassment, cyber abuse, privacy violations, platform takedowns, anonymous user identification, digital evidence preservation, and related civil litigation. Victims, families, and businesses facing TAKE IT DOWN Act issues should evaluate their rights and obligations promptly, preserve all relevant evidence, and seek legal guidance before critical digital evidence is lost.