For years, the hardest cases to get offline were the ones where you did not own the picture. A photo someone else took. A video that was never real to begin with, stitched together by an AI tool. Copyright did not help, and most other laws were slow or local. The Take It Down Act changes that. It is a federal law written specifically around consent, not ownership, and it puts a clock on the companies hosting the content.
This is a plain-English walkthrough of what the law does, who it covers, and how to actually use the 48-hour removal right.
The short version
The Take It Down Act is a U.S. federal law signed on May 19, 2025. Its full name is a mouthful (Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act), which is where the “TAKE IT DOWN” acronym comes from.
It does two separate things.
First, it makes it a federal crime to knowingly publish intimate images of a person, adult or minor, without their consent. That criminal piece covers real photographs and videos, and it explicitly covers “digital forgeries,” meaning AI-generated deepfakes that look real. This part took effect as soon as the law was signed.
Second, it places a duty on online platforms. A covered platform has to give people a way to request removal of nonconsensual intimate images, and once it receives a valid request, it has to take the content down within 48 hours. It also has to make reasonable efforts to find and remove identical copies. The Federal Trade Commission (FTC) enforces this part, and enforcement began on May 19, 2026, after platforms were given a year to build their removal systems.
That 48-hour duty is the piece most victims will actually use.
First, clear up the name confusion
There are two different things called “Take It Down,” and people mix them up constantly.
One is the law described above: the federal Take It Down Act, enforced by the FTC.
The other is a free tool called Take It Down, run by the National Center for Missing and Exploited Children (NCMEC). The tool predates the law. It works by hashing: it creates a digital fingerprint of an image or video on your own device, sends only that fingerprint (never the image itself) to a shared database, and participating platforms use it to detect and block matching content. The NCMEC tool was built for people who were under 18 when the image was created, so it is the right starting point in those cases.
So when a platform’s help page mentions “Take It Down,” check which one it means. The law gives you leverage and a deadline. The tool gives you scale and works quietly in the background.
Why this law matters for victims
The Take It Down Act fills a real gap, and it is easiest to see by comparing it to copyright.
A DMCA notice is one of the fastest removal tools available, but it only works when you own the copyright. If you took the selfie or filmed the video yourself, you do. If someone else held the camera, the photographer usually owns the copyright, not you, and the DMCA stops being a clean fit.
The Take It Down Act does not care who owns the copyright. It is built around consent. The question it asks is whether the image is intimate and whether it was published without your agreement, not whether you can prove authorship. That alone makes it usable in a whole category of cases the DMCA never reached.
It is also one of the few tools that handles deepfakes well. Copyright law struggles with a fabricated image, because no original photo of yours was copied. The Take It Down Act addresses synthetic intimate imagery directly, as long as it depicts an identifiable real person. For anyone dealing with AI-generated content of themselves, this is often the strongest legal footing available.
How to use the 48-hour removal right
The mechanics are straightforward, but the details decide whether your request counts as “valid,” and only a valid request starts the 48-hour clock.
Who has to comply. The duty falls on “covered platforms.” The law defines these broadly: a website, online service, or app that serves the public and primarily hosts user-generated content (messages, videos, images, audio), plus any service that in the regular course of business publishes or hosts nonconsensual intimate images. Mainstream social networks, forums, and many image and video hosts fall inside this definition. A few things sit outside it, such as email providers and services that are not really in the business of hosting public user content.
What a valid request looks like. Under the law, your written request to the platform needs to include four things:
- A physical or electronic signature from you, or from someone authorized to act for you.
- Enough identification of the image and where it is for the platform to find it. In practice that means the specific URLs, not just the name of the site.
- A brief statement of your good-faith belief that the image was published without your consent.
- Your contact information.
Most covered platforms now have a dedicated reporting form built around these elements, which is the easiest route. If a platform has no form, a written notice containing the four items still triggers the obligation.
Keep records of every request you send. The timestamp on your notice is what defines the 48 hours, so a clear paper trail is what turns “they ignored me” into something the FTC can act on.
How it compares to the DMCA and GDPR
Think of these as three different keys, not competitors. The right one depends on your situation, and using more than one at once is normal.
| Take It Down Act | DMCA | GDPR | |
|---|---|---|---|
| Where it applies | United States | United States (and widely honored) | EU and UK residents |
| Based on | Consent | Copyright ownership | Privacy and personal data |
| Covers deepfakes | Yes, directly | Poorly | Yes, as personal data |
| Need to own the image | No | Yes | No |
| Built-in deadline | 48 hours | ”Expeditiously” | About one month |
If you did not take the content yourself, or it is a deepfake, the Take It Down Act gives you a deadline that copyright cannot. And if you live in the EU or UK, GDPR lets you demand erasure of intimate content as personal data, with its own enforcement behind it. When you do own the content, a DMCA notice is still worth filing, but as the removal guides here make clear, none of these routes is instant and most cases take persistence across many sites.
Most real removal campaigns combine them. You might file a DMCA notice on a copy you own, invoke the Take It Down Act on a deepfake version, and lean on GDPR for European hosts, all for the same underlying problem. Each tool reaches a point in the chain the others miss.
The Take It Down Act is the newest of the three, and for nonconsensual intimate content it is frequently the most direct. Pair it with a DMCA notice on any copies you own, and with GDPR if you live in the EU or UK, and you cover every angle.