TAKE IT DOWN Act: How to comply as the FTC begins enforcement
May 26, 2026
Publications
This article summary is based on insights shared by attorney Kayla Bushey, CIPP/US, published by IAPP (formerly the International Association of Privacy Professionals) on May 21, 2026. IAPP membership is required to view the full article.
Key takeaways:
- The TAKE IT DOWN Act’s scope extends beyond social media platforms to include a wider range of online platforms hosting forums with user-generated content.
- Covered platforms must establish and maintain accessible mechanisms for users to submit removal requests for nonconsensual intimate images.
- Covered platforms must remove real and AI-generated images within 48 hours of receiving a valid takedown request under the Federal Trade Commission (FTC)’s recent guidance.
- The Commission issued warnings to at least 15 companies that the agency is prepared to take action against non-compliant platforms, in letters sent days before enforcement began.
The TAKE IT DOWN Act, signed into law on May 19, 2025, is a bipartisan federal law addressing nonconsensual intimate images, including deepfakes. Its criminal provisions took effect immediately, while its civil provisions, imposing obligations on covered online platforms, became enforceable on May 19, 2026. The FTC has signaled aggressive enforcement, issuing warning letters to at least 15 companies ahead of the compliance deadline.
The law covers any online platform or service that primarily provides a forum for user-generated content, including messaging services, gaming platforms, and video- or image-sharing forums. Nonprofit organizations are not excluded, though email and broadband providers are explicitly exempted. Covered platforms must establish an easily accessible mechanism for affected individuals or their authorized representatives to request the takedown of nonconsensual intimate images. They must remove the identified image and any known copies within 48 hours of a valid request. The law also provides platforms with liability protection when they remove content in good faith, even if it is later found to be lawful.
Violations of an FTC rule carry civil penalties of up to $53,088 per violation. The FTC has adopted a broad interpretation of the law’s scope and recommended that platforms implement tools to track removal requests and measures like hashing technology to prevent reposting. Organizations subject to the law should ensure their takedown mechanisms and compliance frameworks are fully operational.
