The US deepfake takedown duty goes live — the TAKE IT DOWN Act in 2026

A federal deepfake law that was signed in 2025 became operative for platforms in 2026 — and that second date is the one that matters for any service with US users. On 19 May 2026 the platform obligations of the TAKE IT DOWN Act took full effect, and the Federal Trade Commission began enforcing them. For the first time American federal law imposes a concrete, deadline-bound takedown duty for non-consensual intimate images, including AI-generated ones.

What the Act does

The TAKE IT DOWN Act (S. 146, 119th Congress) was signed into law on 19 May 2025. It has two distinct parts. The first is a criminal prohibition on knowingly publishing non-consensual intimate visual depictions of identifiable individuals — which took effect immediately and reaches both authentic images and digital forgeries, the statute's term for AI-generated or otherwise technologically altered "deepfake" depictions. It covers adults and, with stricter terms, minors under 18.

The second part is the one that just came alive. Section 3 requires every covered platform to operate a notice-and-removal process — and Congress gave platforms exactly one year, until 19 May 2026, to build it. A covered platform is, broadly, a public website, online service or app that primarily provides a forum for user-generated content, or that is primarily designed to publish non-consensual intimate imagery. In practice this captures social media, messaging, image- and video-sharing and gaming services alike.

The 48-hour duty

Under Section 3 a covered platform must give individuals a clear way to request removal of an intimate depiction published without consent. On receiving a valid request, the platform must remove the content — and make reasonable efforts to identify and remove any known identical copies — within 48 hours. It should also issue an identifying number for each request so the requester, the platform and law enforcement can track the same image. The duty is the operative heart of the statute: a fixed clock, running from a valid report, with copy-propagation explicitly inside its scope.

How the FTC enforces it

The Act routes enforcement through existing consumer-protection machinery. A failure to comply with the notice-and-removal requirement is treated as an unfair or deceptive act or practice under Section 18(a)(1)(B) of the FTC Act, which lets the Commission seek civil penalties of up to $53,088 per violation. The FTC did not wait quietly for the deadline: in May 2026 Chairman Ferguson sent warning letters to more than a dozen of the largest platforms — among them Alphabet, Amazon, Apple, Discord, Meta, Microsoft, Reddit, Snap, TikTok and X — reminding them that full compliance was due no later than 19 May 2026.

Why it matters beyond the US

For European organisations the Act is a reminder that the United States, lacking a horizontal AI statute, increasingly regulates AI harms through narrow, enforceable federal duties rather than a broad framework. The reach is extraterritorial in effect: a covered platform serving US users must operate the removal process regardless of where it is established. The mechanism also contrasts instructively with the EU approach. The same synthetic intimate imagery is addressed in Europe partly through the AI Act's transparency duties for deepfakes, partly through content-moderation duties under the Digital Services Act, and — once the Digital Omnibus is adopted — through two new Article 5 prohibitions on non-consensual intimate imagery and AI child sexual abuse material. Washington reaches a similar outcome through a single notice-and-removal duty enforced by the FTC. The destination converges; the instrument does not.