For decades, getting an intimate image of yourself removed from the internet meant begging platforms, one report at a time, with no clock on anyone. The Take It Down Act, signed into US federal law in May 2025 after passing with overwhelming bipartisan support, changed the most important word in that sentence: when. Covered platforms now have 48 hours.
The law works through two mechanisms. Knowingly publishing non-consensual intimate imagery (NCII), real photos, real videos, or AI-generated deepfakes, of adults or minors, is now a federal crime. And covered platforms must honor a valid removal request within 48 hours, with the Federal Trade Commission enforcing the deadline. It is a floor, not a ceiling: state laws and platform policies still stack on top.
What counts as non-consensual intimate imagery under the Act
The Act, formally the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Instagram and National Discourse Act, one of Washington's more labored acronyms, protects identifiable people in intimate visual material distributed without their consent. Three boundary questions decide most cases.
Who is depicted. The material must show an identifiable person, by face, tattoos, setting, or the text the poster attached. It does not matter who took the picture or who owns the file. That is the Act's core break with copyright law: the right belongs to the person in the image, not to whoever is holding a copy.
Real or synthetic. The definition includes digital forgeries, images created or manipulated by software, including AI, that appear authentic. Before the Act, a deepfake of you sat in a legal dead zone: it copied no photo you owned, so the DMCA could not reach it, and state NCII statutes written for real cameras did not always reach a picture that never existed. The Act closes that gap explicitly; our deepfake removal guide covers the steps specific to synthetic images.
Adults and minors. If the subject is a minor, federal child-protection law already applied, and platforms carry their own mandatory reporting duties to the National Center for Missing and Exploited Children. The Act adds deepfakes to that machinery and gives minors the same 48-hour removal right as adults.
Consent is measured at the moment of distribution, not creation. A photo taken willingly, a video from a relationship, intimate content a creator sold on one subscription site, all of it becomes NCII the moment someone publishes it somewhere the depicted person never agreed to. The carve-outs are narrow: lawful disclosures tied to court, medical, or law-enforcement processes.
The 48-hour mechanism: valid requests, platform duties, and the FTC
The deadline runs from a complete request, not from your first contact with the platform. That distinction is where self-filed attempts lose the most time.
A valid request needs what a platform needs to act: the specific content, URLs, account names, a statement that you are the depicted individual or their authorized representative, which covers a parent filing for a child and a service filing for a client; a statement that you did not consent to this distribution; and working contact information. Major platforms fold these elements into a dedicated intimate-imagery form. Use it rather than the general report button, because it routes to the team that handles the Act. File complete on the first pass: if the platform has to come back for missing pieces, the clock effectively restarts from the completed submission. Keep copies of everything you send, with timestamps.
Once a complete request lands, the platform has 48 hours to remove the content, and the duty extends to copies of the same image, which the platform must make reasonable efforts to catch. In practice that pushes the industry toward hash matching: fingerprint the flagged file, then block re-uploads automatically. When you spot a re-upload on a covered platform, report it as a copy of your original request rather than a new case; the clock runs again.
Enforcement runs through the FTC, which treats violations as unfair or deceptive acts or practices under Section 5 of the FTC Act (15 U.S.C. § 45). That is regulatory language for expensive: investigations, consent orders, civil penalties. A complaint through the FTC's reporting portal lands harder with your documented request attached. Just know what it is, enforcement disciplines a company over weeks and months. The lever that helps your specific image this week is the platform's own process, and most large platforms now act well inside the deadline. The FTC complaint is what you escalate with when one doesn't.
Take It Down Act vs DMCA: which removal tool fits
Most people arrive at this confused, and the confusion decides what they file.
The DMCA is a copyright tool, it works only if you own the material, typically because you created it. Our explainer on what a DMCA takedown actually is covers how that machinery runs. The Act is different in kind: it works because you are the person depicted. No ownership, no registration, no copyright at all. If you took the selfie, you often hold both rights and can run both tracks at once. If someone else took the photo, the DMCA track is probably closed to you, and the Act is the lever that still moves.
The clocks differ. The Act fixes removal at 48 hours from a complete request. The DMCA requires only that a platform act "expeditiously" once notified, which is why DMCA takedown timelines vary so widely. The DMCA also carries counter-notice machinery: if the uploader disputes your notice, the platform can restore the material after ten to fourteen business days unless you take the matter to court. The Act's removal duty imports none of that; platforms run their own appeals.
Deepfakes show the split at its sharpest. A synthetic image of you copies nothing you own, so copyright cannot reach it, the Act can. And the tracks combine for creators: leaked subscription-platform content is both copyright infringement against you as the author and NCII against you as the depicted person, so file both in parallel. Stolen photos that aren't intimate stay purely a copyright problem.
The criminal side: when law enforcement joins the removal
The Act's other half makes knowingly publishing NCII, real or synthetic, adult or minor, a federal crime, punishable by up to two years in prison for the base offense, with higher maximum terms when the depicted person is a minor. It also reaches threats to publish, which is the core of sextortion: pay, or the image goes up.
Sequence matters. Preserve evidence before anything else, screenshots with the URL visible, timestamps, account names, payment demands if extortion is in play. Removal destroys evidence; who posted the image, and when, can stop being provable once the page is gone. Our evidence checklist covers what to capture and how to store it.
Then report in parallel, not in sequence. The platform handles the removal clock. Local police create a record. Extortion goes to the FBI's internet-crime reporting channel. A minor in the image triggers tipline reporting through the platform's own legal duties. None of that removes your image this week, the platform request does, but the report numbers strengthen every later step, including an FTC complaint.
Do not negotiate with an extortionist. Payment tends to escalate demands rather than end them, and the threat itself is now a federal crime.
The fastest path to removal, step by step
Run the sequence in this order. The two classic mistakes are reporting before documenting, and escalating before the platform has had its statutory shot.
- Document everything. Capture every URL, screenshot every post with its address bar and date visible, and note account names. Do this before any report, because takedowns destroy the map you need for every later step.
- File through the platform's dedicated intimate-imagery process, stating that you are the depicted individual and citing the Act. Our revenge-porn removal guide lists where each major platform actually hides these forms, which is rarely where you would guess.
- Submit the images to a free hash-matching service such as StopNCII before they spread further. It fingerprints the files on your side and shares only the fingerprints with participating platforms, so re-uploads are blocked before they render.
- Request search delisting. Google removes non-consensual explicit imagery, including fakes, from Search results on request; Bing runs a comparable process. Delisting does not delete the page, but it severs the discovery path, which is most of the practical harm.
- Re-check weekly for a month, then monthly. Treat any new appearance on a covered platform as a copy of your original request; the copy-removal duty applies, and the 48-hour clock runs again.
Our guide to getting pictures removed from a website walks this full sequence, with the order of operations and the wording that works.
Where the Act stops: offshore sites and the escalation ladder
The Act binds covered platforms. It does not bind the offshore leak site with no US presence, no US assets, and no intention of reading your letter. Those sites feel the Act indirectly, any copy that migrates to a covered platform comes down in 48 hours, but the source page answers to the older ladder, unchanged: hosts, registrars, search engines, payment processors.
Start by finding out who actually hosts a website like that. A hosting provider's abuse desk is often the fastest takedown on the internet, because acceptable-use policies on NCII are stricter than anything in copyright. If the host will not move, the domain registrar is next; registrar abuse policies bite harder than most people expect. Then search delisting, which cuts discovery even where the page survives. If the site monetizes, payment processors are the last rung, subscription sites trading in leaked intimate content sit on the wrong side of processor rules, and processor complaints have ended sites that ignored every legal letter.
Each rung has its own procedure, and running them out of order wastes weeks. Reporting a website to the right desk, with the right framing, is a skill, and it is the main reason takedown services exist. A law with a 48-hour deadline still needs someone to file everything, everywhere, on time.
What platform operators need to do differently now
If you run a community, forum, or marketplace that hosts user content, the Act added a second compliance clock next to the DMCA, and they are not the same clock.
The Act's obligations are direct: a clear, findable intake for requests from depicted individuals or their representatives; removal within 48 hours of a complete request; reasonable efforts against re-uploads of the same material; and records showing all of it. There is no conditional safe harbor here, nothing like the DMCA's immunity-for-process bargain. It is a straight duty, enforced by the FTC.
The DMCA side still runs its own machinery, and it still starts with registering a designated agent at the Copyright Office, six dollars and about fifteen minutes, plus the renewal trap that quietly voids registrations and strips the safe harbor. If both kinds of notice land in one inbox, log which statute each invokes; the deadlines, and the consequences of missing them, differ.
One caution: the Act's small-platform carve-out is defined by business size, not ambition. Designing compliance around an exemption you will outgrow is how companies end up explaining themselves to regulators.
Keeping it down: monitoring, re-uploads, and adjacent attacks
Removal is a point in time; circulation is a process. Leak sites re-post, scrapers copy, and the same file resurfaces under fresh domains.
Hash coverage is the strongest passive defense, once your fingerprints are in the matching system, participating platforms block the file before it renders. Beyond that, keep re-running the search check on a schedule and treat new appearances as copies, not new cases.
For creators, the calculus is ongoing rather than episodic: watermarking what you publish, tracking where your content travels, filing on a schedule instead of in a panic. Monitoring plus filing in one place is the gap our Protection Pro plan exists to fill, and it matters when the same images need action across a dozen sites in a month.
Watch the adjacent attack, too. NCII campaigns often run alongside impersonation, fake profiles amplifying the content or posing as you to your contacts. Impersonation has its own, usually faster, removal path on every major platform; our guide to removing impersonation accounts covers that flank.
Frequently asked questions about the Take It Down Act
Does the Take It Down Act cover AI-generated deepfakes?
Yes. The Act's definition of covered imagery includes digital forgeries, images created or altered by software that appear authentic. A fake that never existed as a real photograph triggers both the 48-hour platform removal duty and the criminal prohibition on publishing it. That is the provision that pulled deepfakes out of the legal gray zone.
How long does a platform have to remove the content?
Forty-eight hours from a complete, valid request, not from your first contact. The clock starts when the request contains the required elements: identification of the content, your identity as the depicted individual or their representative, and a statement that the distribution was non-consensual. A deficient request restarts the clock after the platform asks for more.
Can I sue someone under the Take It Down Act?
The Act itself creates no private lawsuit. Platform violations go to the FTC, and criminal enforcement belongs to the Department of Justice. Many state NCII laws do allow civil suits, though, and separate claims, copyright in images you took, invasion of privacy, harassment, may also be available. A lawyer can stack state claims on top of the federal removal right.
What if the image was taken with my consent but shared without it?
Covered. Consent to creation is not consent to distribution, and consent to one distribution is not consent to another. A private photo from a relationship, or intimate content a creator sold on one platform, becomes NCII the moment someone publishes it somewhere the depicted person never agreed to. The Act tests consent at the distribution you are reporting.
Does the Act work against websites hosted outside the US?
Not directly. The removal duty applies to covered platforms serving US users; a leak site with no US presence can ignore the deadline. The practical route there is the escalation ladder, host, registrar, search delisting, payment processors, plus 48-hour removal of any copies that appear on covered platforms. The Act shrinks the territory a rogue site can reach.
If you are dealing with this right now, the list for today is short:
- Preserve everything, URLs, screenshots with visible addresses and dates, account names, before any report.
- File with the platform through its intimate-imagery process, citing the Act, and log the submission time.
- Submit to StopNCII for re-upload blocking, then request search delisting from Google and Bing.
- If a covered platform blows the deadline, file an FTC complaint with your records attached; if the source site is offshore, work the ladder.
- If you would rather hand the sequence to someone who runs it daily, start a confidential takedown and we work every channel, in the right order, on the clock.