What the TAKE IT DOWN Act actually changes — and what it doesn't.

The TAKE IT DOWN Act (S.146, 119th Congress) was signed into law on 19 May 2025.^[1] It is the first federal statute to combine a criminal prohibition on non-consensual intimate imagery with an affirmative platform-removal obligation. The combination matters more than either piece in isolation. Here is what it actually does — and the gaps it leaves.

What it changes

It criminalises distribution. The Act prohibits any person from knowingly publishing, without consent, intimate visual depictions of minors or non-consenting adults — and any deepfakes (whether intimate depictions or not) intended to cause harm.^[2] The criminal prohibition was effective on enactment.

It puts a 48-hour clock on platforms. Covered platforms — public websites, online services, and applications that either primarily host user-generated content or are primarily designed to publish non-consensual intimate visual depictions — must provide a notice-and-removal process and remove valid reports within 48 hours.^[2] Platforms had one year (to 19 May 2026) to set up the process.

It applies to deepfakes, not just authentic captures. The statutory definition of intimate visual depiction explicitly covers AI-generated and AI-altered content. This closes a gap that left earlier state NCII laws ambiguous when the imagery was synthetic.

What it leaves untouched

Section 230 protection survives. The Act does not amend Section 230 — it adds a notice-and-removal duty, violations of which can be enforced by the FTC, but it does not make platforms generally liable for user content.^[3] This is a deliberate design choice and a contested one; commentators have argued that it limits the meaningful enforcement window to platforms that fail to set up the process, not to ones that set it up and miss the window in individual cases.

It does not preempt state law. If your state has a stronger statute — and roughly thirty states have specific deepfake-NCII laws as of mid-2025^[4] — that statute continues to apply alongside the federal regime. File under both where applicable.

It is not a civil remedy. Civil claims under state NCII / right-of-publicity / IIED law are available now in many jurisdictions. A federal civil cause of action would come from the DEFIANCE Act — $150,000+ liquidated damages, 10-year statute of limitations — but that bill is still pending in Congress. S.3696 (118th Cong.) passed the Senate by unanimous consent in July 2024 but did not pass the House. Reintroduced as S.1837 (119th Cong.), it passed the Senate again by unanimous consent in January 2026, where it remains stuck.^[5] Until DEFIANCE clears the House, the federal regime in this space is criminal-only — TAKE IT DOWN — plus the FCC's TCPA AI-voice rule and the standard wire-fraud statutes. Survivors should not rely on TAKE IT DOWN alone to do civil-remedy work.

What it means in practice

If you are a survivor: you now have a federal floor for platform takedown speed. If a covered platform receives a valid report and does not remove the content within 48 hours, that is now a federal compliance failure, not just a customer- service complaint. Combine the federal notice with a hash submission to StopNCII.org (adults) or NCMEC Take It Down (under-18 content); a copyright report where you hold rights in the underlying image; and a civil claim under existing state law (or DEFIANCE if and when it becomes federal law) if the economic and emotional harm warrants it.

If you are counsel: read the statute itself (link below) — the Congressional Research Service's Legal Sidebar (LSB11314) is a useful one-page primer.^[3] Note the interaction with state law and Section 230.

If you operate a covered platform: the notice-and-removal process must accept reports from any user, must act within 48 hours of a valid report, and must be navigable without specialised legal knowledge. The independent audit by Qiwei et al. (arXiv 2024) found that on at least one major platform, copyright reports cleared in 25 hours while NCII reports cleared in zero days over three weeks. The new statute makes that asymmetry compliance-relevant, not just policy-embarrassing. ^[6]