For years I gave people the same advice, and I gave it with the easy confidence of someone who had never needed it.
Screenshot everything. Save the URL and the timestamp. Find the platform's reporting form — usually four menus deep, under "safety" or "abuse," never on the page where the thing actually is. Submit it. Then check tomorrow, and the day after, and when the image comes back under a new handle, submit it again. Keep a log, because if this ever reaches a lawyer, the log is the case.
Every line of that is useful. It is also a to-do list handed to the one person who had done nothing wrong and had the least power to fix anything. The company hosting the image had a legal department and a compliance budget. The person in the image had a phone and a very bad night. And there I was, telling her to be better organized.
That is the habit I could not defend: I had quietly accepted that removal was her job. It took a federal deadline to break me of it.
The day the burden moved
On May 19, 2026, the Federal Trade Commission began enforcing the TAKE IT DOWN Act — the federal law on nonconsensual intimate imagery, including the AI-generated kind — and opened a complaint line for the people in the pictures on the same day.
If you are depicted in an intimate image published without your consent, you can now ask the platform to take it down, and the text of Public Law 119-12 leaves it no discretion about how long to think that over. It "shall, as soon as possible, but not later than 48 hours after receiving such request — remove the intimate visual depiction," and must "make reasonable efforts to identify and remove any known identical copies." Failing to reasonably comply is treated as violating a rule against unfair or deceptive acts — the machinery that lets a consumer-protection agency fine you. The perimeter is wide: the FTC's compliance guidance reaches social media, messaging, image sharing and gaming alike.
Then the number everyone quoted. The FTC's business blog is careful with its verbs, and so will I be: platforms violating the law "may face FTC law enforcement action, including potential civil penalties of $53,088 per violation." A statutory ceiling, not a price list — CyberScoop described it as a maximum civil penalty, and nobody has been made to pay a cent of it. But a ceiling is still a number, and a number changes how a room full of lawyers talks.
Which is why a law signed in 2025 became news in 2026. It was never dormant for individuals — creators and posters were prosecutable immediately — but the platforms hosting the material, as CyberScoop put it, got a yearlong runway to build their takedown systems. For twelve months the statute was real for one side of the transaction and a calendar entry for the other.
One sentence in the rollout matters more than the penalty, and almost nobody quoted it. The letter Chairman Andrew Ferguson sent to the major platforms closes the oldest loophole in the genre: "TIDA's protections are not limited to individuals who hold an account on your platform." Read that as a person rather than a lawyer. You no longer have to join the website hosting the worst thing that ever happened to you in order to ask it to stop.
What the agency has actually done — and what it has not
Eight days before the deadline, Chairman Andrew Ferguson wrote to fifteen major platforms — Alphabet, Amazon, Apple, Meta, Microsoft, Reddit, TikTok and X among them — reminding them compliance was due. On May 19 the clock started and the portal opened. On May 20 the agency sent warning letters to twelve "nudify" services — tools that take a clothed photograph and generate a sexualized version of it — which, in the FTC's words, "appear to be in violation" for offering victims no removal process.
Be precise about what those letters are, because the agency itself is. The warning letter template the FTC actually sent says staff "has reason to believe" the recipient is out of compliance, then adds that "this letter does not reflect a formal determination that you have violated TIDA." Allegations and warnings, sent to twelve websites the agency declined to name. Nobody has been found liable. Nobody has been fined.
So here is the honest label, and please hold onto it: as of mid-August 2026 the United States has an enforcement posture, not an enforcement record. A deadline, a ceiling, letters and a portal — no complaint, no consent order, no penalty. (Criminal enforcement against individuals runs on a separate track and has begun — lawyers tracking the rollout note arrests of two people in the Eastern District of New York.)
Why does this need a federal deadline at all? Because the supply side scaled first. In September 2023 — a snapshot now three years stale, and the trend has not been downward — the research firm Graphika counted 34 synthetic-imagery providers drawing 24 million unique visitors in a single month. Nor is this a story about celebrities: from a teacher survey covering the 2023–24 school year, the Center for Democracy and Technology estimated some 2.30 million American high schoolers had been exposed to deepfake nonconsensual imagery.
So that fixes it. Does it?
No — and the objections that matter are not the ones you would expect.
The floor might not hold. TIDA borrows its definition of a covered service from Section 230 of the Communications Decency Act — but as a student comment in the University of Baltimore Law Review's "Issues to Watch" puts it, section 230's core immunity remains intact, leaving open whether the removal remedy "will be enforceable and provide real relief." You can owe a duty under one statute while another shields you from liability for the content itself, and whether the two survive contact is unresolved.
You still cannot sue. Writing while the bill moved through the House, the center-right American Action Forum noted that a platform's violation is enforceable only by the Federal Trade Commission, leaving individuals with no private right of action against the platforms. If a platform ignores you for six days, your remedy is not a courtroom. It is a complaint form and the hope that an agency with a finite budget thinks your case is worth its week.
"Reasonable efforts" is doing enormous work. The duty extends only to "known identical copies," and counsel advising platforms point straight at the soft spot: what "reasonable efforts" means is unclear. Nobody has litigated it, so the first agency action to test it will write the definition.
Seoul chose the other end of the chain
It helps enormously that another country already ran the alternative experiment — at scale, for years, with a sharper instrument.
South Korea did not put the burden on the platform. It put it on the person — including the person who merely looks. In late September 2024 the National Assembly passed a bill that criminalizes possessing or watching sexually explicit deepfakes: purchasing, saving or viewing could bring up to three years in jail or a fine of up to 30 million won, and the maximum for making them rose to seven years, "regardless of the intention." That last phrase is the radical part — Korea dropped any requirement that the maker meant to distribute.
It is in the statute, not just the press release. Article 14-2 of Korea's sexual-crimes act, as amended into the text in October 2024, reaches whoever "possesses or has seen or purchased" such material with up to three years or 30 million won — and whoever makes it with up to seven years or 50 million won.
Now the structural inverse. The same round of legislation specified that it is the government's responsibility to delete illegally filmed materials and to help victims get their lives back. Washington made removal the platform's problem. Seoul made it the state's.
Harsher penalties, a government deletion service, years of practice. How did it go?
Here is the number that reorganized my thinking. Of 15,808 deepfake sexual videos Korea's communications standards regulator acted on between January and July 2025 — figures cited in the National Assembly by Rep. Park Choong-kwon and reported by the Korea Herald — two were removed with the provider's cooperation. Two. Access to the other 15,806 was restricted, a polite way of saying the material stayed where it was and Korean users were stopped from reaching it.
Why? A state can order its citizens around and order its own network to look away, but it cannot order a company that is somewhere else. The Korea Economic Institute of America is blunt: Telegram's leadership and servers sat outside Korea, so official requests to delete offending content were ignored until press coverage made ignoring them expensive.
Seoul has noticed. The government has said it plans to enforce a 24-hour deadline on platform operators — half of Washington's window — though that remains an announced policy, and I could find no enacted statutory 24-hour removal duty as of today. And in May 2026, two weeks before the FTC's start date, Seoul conceded the deeper problem. Reporting the launch of a cross-agency victim support team, Kyunghyang Shinmun quoted the official assessment that deletion requests filed address by address had limits in stopping the sites themselves, which "refused deletion requests or reposted the same videos repeatedly."
One fact cuts against my argument, and I will not hide it: criminalizing the viewer has not emptied the pipeline. Of suspects police linked to deepfake crimes in the year to October 2025, nearly 62 percent were teenagers. A seven-year maximum is not deterring fifteen-year-olds.
And one fact completes it. When Korea's Ministry of Gender Equality and Family analyzed 26,658 websites distributing this material — calendar-2025 figures reported in April 2026 by the Korea Times, which discloses the piece was produced with AI assistance and edited by its staff — it found 70.8 percent of servers were located in the United States, Australia and the Netherlands next.
Read that twice. A country with one of the world's toughest criminal laws on sexual deepfakes cannot get its citizens' images taken down, because roughly seven in ten of the machines holding them answer to American law. A removal duty enforceable in Washington is not only an American remedy — it is quietly part of Korea's.
Now imagine the version of this that arrives next
Picture a Tuesday in 2028. A ninth-grader in a mid-sized American city finds her face has been run through one of these tools by a classmate. Her mother files a removal request at 9:40 at night.
The big platform is the easy part, and that is the law's genuine achievement: an automated hash match, gone in eleven minutes, because no lawyer alive will advise spending a defense budget to argue over one post. The mid-sized forum where the image is actually thriving takes five days, three of them deciding whether it is a "covered platform" at all.
Then the interesting failure. On day six the image is back — but it is not the same file. It has been regenerated: same face, same room, new pixels, a fresh output from the same model. It is not a known identical copy of anything. The statute was written for a world where this material spreads by copying, and by 2028 it spreads by re-rolling. Every "reasonable efforts" clause in the country then hangs on how one regulator reads one adjective.
Now run it the other way, because that future is just as plausible. A documentary filmmaker's footage — newsworthy, uncomfortable to somebody powerful — draws a removal request at 4 p.m. on a Friday. The platform has 48 hours, no obligation to investigate, and a five-figure ceiling on the other side of the scale. It comes down in twenty minutes, and nobody hears about it, because the absence of a video is not a news event.
Both futures already sit inside the statute we have. Which one we get is decided by the first half-dozen enforcement decisions — none of which have happened.
What the people who have studied this longest are saying
The criticism does not sort neatly by ideology, which is usually a sign it is worth reading.
From the civil-liberties side, the Electronic Frontier Foundation — writing after enactment, so this is about the regime we actually have — calls the design a one-way censorship ratchet: no protection against frivolous or bad-faith requests, a deadline too tight for small services to verify claims, and lawful satire, journalism and political speech exposed to wrongful removal. While the bill was still moving, EFF argued it would build a far broader internet censorship regime than the DMCA, minus the DMCA's anti-abuse provision.
From the right, that same American Action Forum analysis raised a different alarm about the same clock — that the agency could use enforcement as a lever to drive content-moderation outcomes it could not constitutionally order directly, and that Congress should watch for the law being used as a pretext.
The platform-side arithmetic is the least ideological and the most damning. Becca Branum, who leads free-expression work at the Center for Democracy and Technology, told CyberScoop what any general counsel concludes: ask an attorney whether it is worth $53,000 to keep a given post up, and "the answer is always going to be taken it down." The penalty, she said, shows how much incentive is in place to take down anything arriving on the complaint line.
But the objection with the most standing comes from the victims' side. Mary Anne Franks, a George Washington University law professor and president of the Cyber Civil Rights Initiative, drafted the 2013 model federal statute against nonconsensual imagery that this law borrows from. She called the bill's passage bittersweet, and the takedown provision a poison pill: "an extremely broad takedown provision that will likely end up hurting victims more than it helps."
When the woman who wrote the model law and the free-speech lawyers who fought her end up worried about the same clause from opposite directions, the honest reader does not get to pick a team. They are describing the same 48 hours.
What does this mean for you?
If this ever touches you — or someone who calls you about it at eleven at night — here is the sequence that now exists and did not before.
Send the removal request to the platform first, and write down when you sent it. The 48 hours runs from your valid request, so that timestamp is the whole ballgame — and you do not need an account on the platform to ask.
Three separate things are reportable, not one: the platform blew the 48 hours, you cannot find its removal process, or the process is broken. Tell the FTC — the complaint goes to TakeItDown.ftc.gov.
You can file for yourself or your child, and for someone else if they have given you permission. Nobody has to relive it at a keyboard alone.
Report the underlying crime separately. The FTC complaint concerns the platform's conduct, not the perpetrator's. For that, go to local law enforcement and the FBI's tip line.
Get the fingerprint into circulation. The FTC's compliance guidance points platforms at two hash-sharing services, which means you can use them too: StopNCII.org for anyone 18 or older, which builds the hash on your own device and shares the fingerprint rather than the picture, and NCMEC's Take It Down for minors. Note the collision — NCMEC's "Take It Down" is not the TAKE IT DOWN Act. Same name, different thing, and it came first.
The lesson I take from my own bad advice
I still tell people to screenshot everything; that part was always right. What was wrong was everything the advice implied — that a log is a substitute for a remedy, that persistence is a policy, that the reasonable response to an industrial-scale problem is to become a better clerk about it.
The most important thing that happened on May 19 was not the $53,088, or even the 48 hours. It was that "whose job is this?" acquired a legal answer that is not "yours." Everything else — whether the ceiling is ever reached, whether Section 230 swallows the remedy, whether "reasonable efforts" means anything — is an argument about how well that answer works. A far better argument than the one we were having.
Korea, which tried the harder-sounding approach first, handed us the measurement: two videos removed with the host's cooperation against 15,806 merely hidden from Korean eyes is the difference between a state that can punish and a state that can reach.
So watch for the first real enforcement action. Not the letters; the case. It will tell us which law we actually passed: the one that moves the burden off the person in the picture, or the one that teaches every platform that the cheapest response to a complaint is to obey it without reading it. Because a deadline with nobody behind it is a press release. A deadline with somebody behind it is the first time in this whole miserable history that the phone rings in the right building.
The HAIA Foundation works on the unglamorous half of these questions — who carries the burden, and who has to prove it. If that is your kind of thing, subscribe — and forward this to whoever in your life would otherwise be told to keep a better spreadsheet.