The TAKE IT DOWN Act's 48-hour removal duty
Platform notice-and-removal duties for non-consensual intimate imagery, including AI-generated, became FTC-enforceable on 19 May 2026. What to build.
Most of the AI law that landed in 2026 asks you to label something. The TAKE IT DOWN Act asks you to delete something, within 48 hours, on request. The platform side of it became FTC-enforceable on 19 May 2026.
That difference in mechanism is why it needs engineering attention rather than a paragraph in your terms. A disclosure duty is satisfied by a template. A 48-hour removal duty is satisfied by a rota, an intake path, a clock, and a re-upload check — none of which exist by default in a small content operation.
This is not legal advice and the statutory scope questions belong with counsel. What follows is the build.
What is actually in force
The Act (Pub. L. 119-12) has two halves that get conflated.
The criminal half prohibits distribution of non-consensual intimate imagery, and it expressly reaches AI-generated depictions. That is the part that got the coverage.
The platform half requires a notice-and-removal process operating on a 48-hour window, and it is enforced by the FTC. Enforcement began 19 May 2026.
It is worth being explicit about how this differs from the transparency regimes that started around the same time:
| Disclosure regimes (EU Article 50, US state transparency laws) | TAKE IT DOWN, platform duties | |
|---|---|---|
| Mechanism | Mark and label synthetic content | Receive a report and remove |
| What satisfies it | Metadata, watermarking, a visible label | An operating process with a deadline |
| Failure mode | Unlabelled content | Content still up after the window |
| Underlying question | Was this made by a machine? | Did the person depicted consent? |
Those bottom two rows are the point. Transparency law and consent law are different regulatory objects, and a perfectly labelled file can still be unlawful. We wrote about that gap in two transparency laws, one start date; TAKE IT DOWN is the first federal instrument aimed squarely at the other side of it.
Who should assume they need a process
The definition of a covered platform is in the statute and is a question for a lawyer, not a blog. The operational test that keeps you out of trouble is much simpler:
If third parties can put media onto a surface you run, and other people can see it, build the process.
Surfaces that get forgotten:
- A community gallery or "made with our tool" showcase
- A UGC contest microsite
- A Discord or forum you moderate
- Comments that accept image or video attachments
- A template or preset marketplace
- A client portal where several people can upload
None of those feel like "a platform" to the person running them. All of them are surfaces where someone else's media appears.
Why 48 hours is a spec, not a policy line
Run the arithmetic once and the design constraints fall out. A report arriving Friday at 17:00 is due Sunday at 17:00. A support inbox triaged on business days fails that report before anyone has read it.
The things that break, in the order they usually break:
- Weekday-only triage. Structurally incapable of meeting the window for reports arriving Thursday evening onward.
- A shared mailbox with no SLA. The clock starts when the report arrives, not when someone opens it.
- Mandatory legal review before removal. Too slow, and the wrong sequencing for this category.
- Removal with no re-upload defence. The file comes straight back, and the second report starts a second clock.
- No timestamped log. You may have complied and be unable to show it, which for a regulator is close to the same thing.
What to build
- One findable intake path. A single URL, linked from the footer and from a report control on the content itself. Not an email address buried in the terms. If a reporter has to hunt, your clock is already running and you do not know it.
- A short intake form. The URLs complained of, the reporter's relationship to the person depicted, a statement of non-consent, and a contact address. Resist the urge to ask for more. A twenty-minute form gets abandoned, and an abandoned report is still a real-world harm sitting on your site.
- Start the clock on receipt and stamp it. Your record of "received at" must be the moment the submission hit your server, not the moment a human triaged it.
- A weekend-capable rotation. This is the single most expensive requirement and the one most teams skip. Someone has to be reachable.
- Remove first, adjudicate second, with an appeal path. This inverts the instinct people bring from copyright disputes. Build the appeal properly so that inversion is safe.
- Fingerprint on removal. Store a perceptual hash, not a file hash — any re-encode changes the bytes while the content stays the same. This is the same class of tooling as durable provenance, which is why it usually lands with the same team that owns your watermark and credentials work.
- Log everything, immutably. Received at, removed at, actor, scope of removal, what was retained and why. The log is your answer if the FTC asks.
- A separate lane for reports about your own generated output. If you publish AI video, some reports will be about content you made, not content a user uploaded. That path needs an owner, and it should not queue behind the general support desk.
The likeness overlap, and where the tooling runs out
A meaningful share of reports in this category will concern AI-generated depictions of real people. That puts this duty next to the consent and likeness work most content teams are already behind on.
Two practical notes:
Detection is asymmetric. Face-matching likeness detection exists and is improving — enrolment is a concrete process with real trade-offs. Voice has much thinner coverage, which we walked through in face covered, voice exposed. Do not assume automated detection will surface these before a human report does.
Consent is becoming a licensable thing rather than only a tort. That shift is under way in US federal policy and it changes what a records system needs to hold; digital replica rights turning into property covers the direction of travel.
Upstream of all of it, the cheapest control is pre-publication. A consent record for every identifiable person who appears in anything you ship, held with the project files, prevents most of what the removal process exists to clean up. That is item one on the brand safety checklist.
Finally, write the process down where your team can find it, in the same document that covers your labelling rules. The structure in writing an AI disclosure policy for your company — tiers, owners, sign-off, wording — works for a removal process too, and having one document instead of two is the difference between a policy people follow and a policy people reference in an incident review.
FAQ
Does this reach a solo creator with a personal site?
Whether the statutory platform duties attach to you is a scope question for counsel, and it depends on facts about your service. But the practical exposure does not wait for that answer: if someone can upload to your surface, you will eventually receive a report, and having no path to act on it is bad regardless of which statute applies. Build a minimum process even if you conclude you are outside scope.
Is the 48 hours in business hours or calendar hours?
Do not assume business days. The conservative build is calendar hours, which is what forces the weekend rotation, and it is the assumption that costs you nothing if you turn out to have had more room. Confirm the precise reading against the statute with a lawyer before you narrow it.
Does labelling the content as AI-generated help?
No. Disclosure and consent are separate obligations answering separate questions. A video can carry machine-readable marking, a visible AI label, and intact content credentials through the whole pipeline, and still be exactly what this Act is aimed at. Labelling is not a defence here.
How is this different from a DMCA takedown?
Different subject, different enforcer, different posture. DMCA notices concern copyright and sit inside a safe-harbour regime with a counter-notice mechanism. This duty concerns non-consensual intimate imagery, is enforced by the FTC, and runs on a fixed 48-hour window. Do not route these reports into your copyright queue — the clocks and the correct first action are not the same.