US Take It Down Act: What Platforms Must Do by May 2026 — and What It Signals for Global Regulation

A Federal Law, A One-Year Clock, and a First Conviction Already on the Books

The TAKE IT DOWN Act — Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks — is the United States’ first federal statute criminalizing the nonconsensual publication of intimate images, including AI-generated deepfakes. President Biden’s successor signed it on May 19, 2025, closing a regulatory gap that had existed since generative AI made photorealistic intimate deepfakes trivially accessible to anyone with a laptop and a diffusion model.

The law is structured in two distinct parts. The criminal prohibition — making it a federal crime to knowingly publish NCII — took effect immediately upon signing. The platform compliance requirement — mandating that covered platforms build takedown systems — took effect one year after enactment, creating a May 19, 2026 deadline that is now days away.

Before that deadline, in April 2026, the Department of Justice announced the first conviction under the Act: an Ohio man who used AI to generate NCII of neighbors, including minors, and distributed the material on an abuse-related website. The case is significant not only as a legal precedent but as a signal about the DOJ’s enforcement posture: federal prosecutors did not wait for the platform compliance deadline to pass before pursuing criminal cases under the new framework.

For platform operators, legal teams, and product leaders, the approaching May 2026 deadline is the operational priority. This article explains exactly what the law requires, who it covers, and what a compliant platform architecture looks like.

What the Law Actually Requires

Who Qualifies as a “Covered Platform”

The TAKE IT DOWN Act defines covered platforms as public websites, online services, and applications — including mobile applications — that either primarily host user-generated content or specifically feature content that depicts NCII. Email services, broadband internet providers, and platforms that curate rather than host content are explicitly excluded.

In practice, this covers social media platforms, video-sharing services, image hosting platforms, adult content sites, messaging apps with public or semi-public features, and general-purpose content platforms that permit user uploads. The definition is broad enough that platforms whose primary purpose is not adult content but that allow user image uploads — forums, community platforms, creative tools with sharing features — should assume they are covered absent a specific legal opinion confirming exclusion.

The 48-Hour Removal Clock

Once a covered platform receives a takedown request from the person depicted in the intimate image — supported by an electronic signature and a good-faith statement that the image is NCII — the platform has 48 hours to investigate the request and remove the material. The law additionally requires platforms to make “reasonable efforts” to eliminate duplicates and reposts of flagged content — not just the originally reported instance.

The 48-hour window is substantially tighter than the DMCA’s “expeditious” removal standard, which in practice has allowed platforms weeks or months to act. For large platforms handling millions of uploads daily, 48-hour compliance requires automated detection pipelines, not purely manual review queues.

The FTC Enforcement Mechanism

Failure to comply with takedown obligations constitutes a violation of the Federal Trade Commission Act. This allows the FTC to pursue civil fines, injunctive relief, and consumer redress against non-compliant platforms. The FTC’s enforcement toolkit under FTCA Section 5 — “unfair or deceptive acts or practices” — gives it broad authority to define what adequate takedown infrastructure looks like, meaning that platforms that receive takedown requests and fail to act within 48 hours are exposed to regulatory action independent of any specific criminal prosecution.

Criminal Penalties — Two Tiers by Victim Age

For NCII involving non-consenting adults: up to 2 years imprisonment for knowingly publishing intimate images or deepfakes; up to 18 months for threatening deepfakes (sending intimate content as a threat without publishing). For NCII involving minors: up to 3 years imprisonment for intimate images or deepfakes; up to 30 months for threatening deepfakes. These are federal criminal penalties, meaning they run separately from any applicable state-level NCII laws, of which more than 40 US states had enacted their own by the time the federal law passed.

What This Means for Platform Operators and Content Leaders

1. Build the Takedown Pipeline Before May 19, 2026 — Not After

The compliance deadline is fixed. Platforms that do not have a functional notice-and-removal process in place by May 19, 2026 are exposed to FTC enforcement from day one of non-compliance. The system must include: a publicly accessible, clear reporting mechanism; an intake process that accepts electronic signatures; a triage workflow that reaches removal within 48 hours of a valid request; and a duplicate-detection step that surfaces reposts and variants of flagged content. Platforms that have invested in CSAM detection infrastructure — hashing-based image matching, perceptual hash databases — have the closest analogous capability and should assess how quickly it can be adapted for NCII.

2. Implement Perceptual Hashing for Duplicate Detection

The “reasonable efforts” standard for eliminating duplicates requires more than removing the specific reported URL. An image that has been shared 200 times across a platform cannot be taken down in 48 hours through manual URL-by-URL review. Perceptual hashing — technologies like PhotoDNA, PDQ (Meta’s open-source hashing tool), or similar — allow platforms to generate a hash of the reported image and scan for perceptual matches across their content corpus automatically. For AI-generated deepfakes, which may exist as multiple slightly-variant outputs of the same generation prompt, near-duplicate detection (fuzzy matching) provides more comprehensive coverage than exact-hash matching.

3. Assess Whether Your Appeal-Based Moderation Model Survives a 48-Hour Deadline

Many platforms’ content moderation models involve a staged process: report received → initial assessment → counter-notice period → final removal decision. This model was designed for copyright disputes where good-faith counter-claims are common. Under the TAKE IT DOWN Act, the 48-hour window begins at receipt of the victim’s request — there is no explicit provision for a counter-notice pause that extends the removal deadline. Platforms should assess whether their existing appeals infrastructure creates a 48-hour compliance gap and adjust the sequencing accordingly: remove within 48 hours, allow counter-appeal after removal if applicable.

4. Train Trust & Safety Teams on the Good-Faith Statement Standard

The law requires a “good-faith statement” from the depicted individual along with an electronic signature. Trust & Safety teams need clarity on what constitutes a sufficient good-faith statement, how to handle requests where identity cannot be immediately verified, and how to document the intake process to demonstrate compliance in the event of an FTC inquiry. The law includes a safe harbor for good-faith removal efforts, meaning platforms that build a clear, documented process and act on it within 48 hours have substantial protection against liability for removing content that later turns out not to be NCII.

5. Prepare for State-Federal Overlap — 40+ State Laws Also Apply

The TAKE IT DOWN Act is a federal floor, not a ceiling. More than 40 US states have enacted their own NCII statutes with varying definitions, timeframes, and liability rules. A platform that meets federal compliance standards may still face state-level claims in California, New York, Texas, or any other state with more stringent requirements. Legal teams should map the platform’s exposure across the states where it has significant user bases and build compliance to the most stringent applicable standard, not just the federal baseline.

The Global Regulatory Ripple: Where This Law Fits

The TAKE IT DOWN Act is part of a rapidly expanding global regulatory response to AI-generated harmful content. The UK’s Online Safety Act 2023 established a “legal but harmful” content framework with mandatory duties on platforms, including requirements to protect users from NCII. Australia’s Online Safety Act and its eSafety Commissioner’s enforcement powers provide another model. The EU’s Digital Services Act imposes risk assessment and mitigation obligations on Very Large Online Platforms (VLOPs) that would encompass NCII as a category of illegal content.

The common architecture emerging from these frameworks — notice-and-takedown within tight timeframes, platform accountability, criminal penalties for individual publishers — suggests that any platform operating globally should build its takedown infrastructure to satisfy the most demanding applicable standard. Singapore’s Media Development Authority has similarly strengthened its online content framework to address deepfake intimate imagery, framing its approach as protecting digital trust in addition to individual victims.

For compliance teams, the lesson from the April 2026 Ohio conviction is that law enforcement at the federal level is not waiting for the platform compliance deadline before pursuing cases. The criminal side of the TAKE IT DOWN Act was active from May 19, 2025. Platforms that host NCII and delay building their removal infrastructure are not just operationally non-compliant — they may be contributing to a pattern of harm that prosecutors are already treating as a priority.

Frequently Asked Questions

Sources & Further Reading

• TAKE IT DOWN Act — Congress.gov Text
• The TAKE IT DOWN Act: Targets AI-Generated and Authentic NCII — Nelson Mullins
• TAKE IT DOWN Act Signed Into Law — National Association of Counties
• The TAKE IT DOWN Act — Skadden Analysis
• First Person Convicted Under Federal Deepfake Intimate Image Law — NBC News
• TAKE IT DOWN Act — RAINN
• —