TAKE IT DOWN Act: How to comply as the FTC begins enforcement

Last year, the U.S. Congress passed a new privacy and artificial intelligence governance law, focused on the issues of deepfakes and nonconsensual images, in a resounding demonstration of bipartisan cooperation. The TAKE IT DOWN Act was  signed into law 19 May 2025. The law's criminal prohibition on "knowingly publishing" authentic or synthetic nonconsensual intimate images took effect immediately, as explained in IAPP's initial legal analysis of the law. These federal rules add a layer of complexity on top of a patchwork of criminal deepfake rules in almost every state.

More importantly for privacy teams, the law contains significant civil provisions meant to protect individuals impacted by the sharing and posting of nonconsensual intimate images on covered platforms. These civil provisions took effect 19 May 2026. Leading up to the enforcement deadline, the U.S. Federal Trade Commission made clear its intentions to enforce the new law, via repeated emphasis in speeches by Chairman Andrew Ferguson and Commissioner Mark Meador and, most recently, in a tranche of warning letters delivered to at least 15 companies. 

Not just for social media platforms

The TAKE IT DOWN Act covers a broad range of online platforms, websites, services and applications when they "primarily" provide a forum for user-generated content. In addition to social media platforms this likely includes messaging and gaming platforms and any forum for the sharing of video, images or audio. 

This scoping provision appears to apply at the service level. That is, a content-sharing service or platform does not have to be a company's primary business to fall within scope. That said, it is unclear how broadly the FTC will interpret "service," so even organizations that tangentially offer a forum for user-generated content should consider complying.