On May 19, President Trump signed the TAKE IT DOWN ACT into law, making it the first national framework to combat deepfake pornography, including NCII, and revenge porn. As the first national law of its kind, it will operate with (rather than supersede) the existing state laws and regulations that target various aspects of online abuse and AI.
The TAKE IT DOWN ACT bans the publication of non-consensual intimate imagery ("NCII") and realistic, computer-generated intimate images depicting identifiable individuals without consent. It requires user-generated content providers such as social media platforms to remove such material within 48 hours of a valid request. The Federal Trade Commission will enforce these requirements, treating non-compliance as deceptive or unfair practices under federal consumer protection law. Digital platforms have until May 19, 2026 to be compliant.
What are the key Federal Provisions?
- Knowingly publishing NCII without consent becomes a federal offense, with penalties of up to two years imprisonment for crimes against adults and up to three years for crimes against minors.
- Platforms must remove reported content within 48 hours of verified requests and take reasonable steps to prevent reposting, including removal of identical copies.
- The Act includes exceptions for good faith or legitimate disclosures made for law enforcement investigations, legal proceedings, medical treatment, and reporting unlawful conduct.
- The FTC will enforce compliance and treat violations as deceptive or unfair practies
What is the impact on State regulations?
As this law is the floor and not the ceiling, it has important implications to the current patchwork of state laws:
- States will retain their powers to enforce their own NCII laws, which could create multiple options for victims to enforce their rights. Like many other areas of the law, one incident could trigger both federal and state criminal or other charges.
- Those states that have more stringent regulations or penalties than the TAKE IT DOWN ACT will still be able to maintain those strict standards. California for example requires a 24 hour takedown time period rather than TAKE IT DOWN's 48 hour threshold. Platforms will likely adopt the most restrictive standards to ensure compliance across all markets, which could potentially create some uniformity and standardization among platforms.
- Several states have announced they will mirror the 48-hour federal rule to ease compliance, but California, Illinois and New York signaled they will keep stricter timelines for now.
- State law civil remedies will still allow for private rights of action outside of the federal law's criminal penalties and platform obligations.
What is the Impact on Platforms?
- Platforms may bear the most substantial legal burden especially those that host user generated content ("UGC").
- Platforms must establish clear, accessible systems for reporting NCII, requesting removal, and allowing secure identity verification for complainants.
- Platforms must make "reasonable efforts" to identify and remove identical copies of reported imagery. The ambiguity around "reasonable efforts" suggests platforms should consider implementing duplicate detection and image hashing technologies.
- The TAKE IT DOWN ACT keeps most of the Communications Decency Act of 1996 Section 230 protections in place. Section 230 protects online platforms from liability for content posted by their users. FTC enforcement is more focused on notice-and-takedown compliance rather than the content itself, but platforms' good faith compliance efforts may be relevant in enforcement proceedings.
Getting Ready.
The compliance deadline is May 19, 2026. While it may seem burdensome, the law presents an opportunity to all parties to implement comprehensive protections and updated policies and procedures. The success of the law will depend largely on the coordination between agencies and platforms to reach a common goal.
Consult with your lawyers to understand the required notice language, record-keeping and detection practices. Make sure you review your current policies and procedures both in how they are communicated to users and how they are implemented. Remember that non- compliance is a federal crime with significant penalties. For AI developers, building in safeguards at the beginning will be far less damaging than a federal charge for digital forgery.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
