Platform obligations

Who is a covered platform

The Act defines a covered platform broadly to include any website, online service, online application, or mobile application that primarily provides a forum for user-generated content, or that in the regular course of trade or business publishes, curates, hosts, or makes available content of nonconsensual intimate visual depictions. In its compliance guidance, the FTC has confirmed that the definition reaches social media platforms, messaging services, image and video sharing sites, and gaming platforms.

If a business primarily provides a forum for user-generated content, or regularly publishes, curates, hosts, or furnishes intimate content shared without consent, it is likely covered and should adopt the requirements summarized below.

Core operational duties

1. Provide a clear notice-and-removal process. Platforms must publish plain-language information explaining how to submit a removal request. The notice must be clear and conspicuous. The FTC has indicated that, depending on a platform's design, the notice may need to appear on the home page and wherever intimate content might appear.
2. Accept requests from any individual depicted. The process must accommodate individuals who do not hold an account on the platform. A removal request may be submitted by the subject of the imagery or by an authorized representative.
3. Remove valid content within 48 hours. Upon receipt of a valid request, the platform must remove the reported intimate visual depiction or digital forgery as soon as possible, and no later than 48 hours from receipt.
4. Search for and remove known identical copies. Within the same 48-hour window, the platform must make reasonable efforts to identify and remove any known identical copies of the reported content across its service.
5. Communicate with the requester. The FTC recommends that platforms issue a unique tracking identifier for each request, confirm the outcome to the requester, and explain any decision not to remove.

What counts as a valid removal request

A request is valid when it contains the four statutory elements: a signature (electronic or physical) of the depicted individual or an authorized representative; identifying information sufficient to locate the content, ideally including a URL; a statement of good-faith belief that the content was published without consent; and contact information sufficient for the platform to respond.

A platform may design its own intake form, but the form must not impose conditions that are inconsistent with the statute. For example, a platform may not refuse to act on a request solely because the requester does not hold an account.

Recommended technical measures

The FTC's guidance highlights several technical practices that align with the statute's expectations and reduce enforcement risk.

1. Image and video hashing. Computing a cryptographic hash of removed content allows automated detection of re-uploads. This directly supports the duty to find known identical copies.
2. Hash sharing with sector partners. The FTC has specifically pointed platforms to the National Center for Missing and Exploited Children's Take It Down service for imagery of minors and to StopNCII.org for imagery of adults. Participating in these hash-sharing networks helps prevent removed content from reappearing elsewhere.
3. Contextual reporting controls. Reports should be submittable from the same surface where intimate content might appear, such as a per-post reporting menu or a per-message option.
4. Internal logging and audit trails. Maintaining timestamped records of each request, its evaluation, and the actions taken supports both internal accountability and any subsequent FTC inquiry.

Enforcement and penalties

A violation of the Take It Down Act's Section 3 obligations is treated as a violation of an FTC rule. That treatment authorizes the Commission to seek civil penalties in federal court. As of May 2026, the FTC has indicated that civil penalties of up to $53,088 per violation may be sought against noncompliant platforms, in addition to other remedies available under the Federal Trade Commission Act.

On May 11, 2026, the FTC Chairman issued a public letter advising covered companies to be in compliance by the May 19 enforcement date. The Commission has signaled that enforcement will be a priority and that companies should not expect a grace period.

Relationship to Section 230 and existing notice regimes

Section 230 of the Communications Decency Act continues to apply to user-generated content generally. The Take It Down Act, however, creates an independent statutory duty enforceable by the FTC, separate from the immunity framework of Section 230. Existing copyright takedown processes under the Digital Millennium Copyright Act are also distinct; a single piece of content may give rise to obligations under multiple regimes, and a platform's DMCA workflow does not satisfy its TIDA workflow.