The Take It Down Act is Only the Beginning

The Take It Down Act becomes federal law today. Platforms covered by the statute have 48 hours to remove non-consensual intimate imagery, including AI-generated deepfakes, upon receipt of a valid request. The Federal Trade Commission sent compliance reminders about this law's effective date last week to more than a dozen major platforms, including Meta, Microsoft, Snapchat, TikTok, X, Reddit, Discord, and Match Group.

The legislators who passed the Take It Down Act deserve credit. As does the First Lady, whose advocacy carried this bill through a Congress that rarely moves quickly on technology policy. Survivors now have a federal removal mechanism that platforms can't ignore.

It's also not enough.

What does the Take It Down Act actually do?

The Take It Down Act creates a notice-and-takedown regime for non-consensual intimate imagery. A survivor who finds an image or video of themselves on a covered platform can submit a request. The platform has 48 hours to remove the content and any identical copies. The FTC has the authority to enforce non-compliance.

Covered platforms include social media, messaging apps, image- and video-sharing services, and gaming platforms. The statute names AI-generated synthetic intimate imagery alongside authentic non-consensual content. This differentiation matters because it establishes in federal law that a deepfake of a person is treated as a form of harm to that person, regardless of whether the underlying imagery is "real."

What does this new federal law leave unaddressed?

The Take It Down Act is a reactive piece of legislation. It activates after the harm has already occurred. A deepfake of a survivor has to exist on a platform, then be found by the survivor or someone who tells them about it. From there, survivors can report it through the platform's removal process. Only then does the 48-hour clock start.

By the time the Take It Down Act’s protections kick in, the survivor has already seen the media in question. Other people have already seen it. Screenshots were taken of the image or video, which also saw downloads, mirrored versions, or reposts to platforms outside the covered list. None of that is reachable by a takedown request to the original platform.

The law also asks for compliance, but doesn't specify the technical architecture platforms must build to detect or prevent the upload of synthetic intimate imagery in the first place. A platform meets its Take It Down Act obligations by responding fast enough to requests. It doesn't have to stop the upload at the door.

Why does the burden fall on survivors?

The architecture the Take It Down Act assumes is the architecture of the early Internet. Content gets uploaded. Someone reports it. The platform reviews it. The platform removes it. The cycle repeats every time the content reappears.

For non-consensual intimate imagery, that cycle is the source of the harm. Once a deepfake of a survivor finds its way onto one platform, copies spread to others within minutes. Each new platform requires a new removal request. Each removed copy can be re-uploaded by a different account on the same platform an hour later. The survivor becomes a permanent moderator of their own image, filing reports against an attack surface that never closes.

Advocates and survivors have been saying the same thing for years: the take-down regimen becomes a never-ending treadmill of trauma.

What would upstream legislation require?

The technology to detect synthetic intimate imagery at the time of upload exists today and is already in production. Detection that verifies authenticity at the input level turns the deepfake-NCII problem from a permanent treadmill into a closed door.

Federal legislation must require this as the bare minimum because, as it stands, the Take It Down Act is the floor. It establishes the minimum protection survivors should have when harmful content reaches a platform. The ceiling is a law that requires covered platforms to detect synthetic intimate imagery at the point of upload, with the same urgency as the current statute applies to removal. The policy template already exists in adjacent domains. CSAM detection is required of platforms by federal law and then operationalized through hash-matching and content-scanning systems that run at upload time.

What does the law going into effect mean?

The Take It Down Act, going into effect today, is a real step forward. This first-of-its-kind move from Congress establishes in statute that synthetic intimate imagery is harmful. It gives survivors a remedy and puts the FTC in the enforcement chair. None of that existed in federal law a year ago.

It also shows that Congress can act on AI harms when the political coalition assembles. The next bill needs to be the proactive one, forcing covered platforms to detect synthetic intimate imagery at the point of upload, not the point of report. The bill that closes the door instead of dragging survivors back through it every time it opens.

The threat is here, not coming. The technology to detect it is here. Legislation simply needs to catch up.

Four things to know about the Take It Down Act

What does the Take It Down Act require platforms to do? Covered platforms must establish a clear removal process for non-consensual intimate imagery, including AI-generated deepfakes. Once a valid removal request is received, the platform must remove the content and any identical copies within 48 hours.

Which platforms are covered? The Take It Down Act applies to social media platforms, messaging apps, image- and video-sharing services, and gaming platforms. The Federal Trade Commission sent compliance reminders to Amazon, Alphabet, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok, and X.

Does the Take It Down Act require platforms to detect deepfakes before they're uploaded? No. The Take It Down Act is a notice-and-takedown statute. It requires platforms to respond to removal requests after harmful content has been uploaded and reported. It doesn't require detection or prevention at the point of upload.

Who enforces the Take It Down Act? The Federal Trade Commission has enforcement authority. FTC Chairman Andrew Ferguson sent compliance letters to major platforms on May 11, 2026, indicating that the agency intends to actively monitor and enforce.