What Is the TAKE IT DOWN Act | Federal Law on AI Deepfakes and Nonconsensual Intimate Imagery Explained

The TAKE IT DOWN Act approaches digital exploitation through two entirely separate legal tracks operating simultaneously: a criminal enforcement system targeting individuals who publish or threaten to publish nonconsensual intimate imagery, and a platform compliance mandate forcing hosting companies to actively remove flagged material. Neither track is optional, and neither substitutes for the other. A victim can pursue platform removal while DOJ simultaneously pursues criminal charges against the individual uploader.^[1]

The statute's formal name, Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, describes its dual scope precisely. "Technological deepfakes" signals that the law is not limited to authentic photography or video. It explicitly extends to any synthetic, AI-generated, or digitally manipulated visual depiction that represents an identifiable real person in an intimate or explicit context without that person's consent to the depiction's creation or distribution. This closes the gap that had allowed deepfake-specific content to evade prior revenge-porn statutes that were written around authentic imagery.

The law fills what had been the most significant structural gap in American digital privacy legislation: prior to its enactment, a patchwork of state revenge-porn laws covered authentic imagery with inconsistent penalties and no unified federal enforcement authority. No federal statute directly addressed AI-generated sexual deepfakes at scale. The TAKE IT DOWN Act addressed both gaps in a single bill with bipartisan support that allowed it to move from introduction to presidential signature in under four months.

The criminal provisions of the Act target any person who knowingly publishes, or even threatens to publish, an explicit visual depiction of an identifiable individual without that person's consent. The threat-to-publish provision is significant: it extends criminal liability to sextortion schemes where the perpetrator never actually uploads the material but uses the threat of doing so to extort money, sexual favors, or behavioral compliance from the victim.

The statute explicitly covers both categories of content. Authentic media is any real photograph or video depicting the victim. Digital forgeries are AI-generated, face-swapped, or otherwise synthetically produced depictions of the victim that were never actually photographed or recorded. The law treats both identically for criminal liability purposes, which eliminates the defense that synthetic content cannot violate privacy because the depicted acts never actually occurred.

A critical distinction: consent to create an image does not constitute consent to distribute it. A person who voluntarily appears in an intimate photograph does not thereby authorize that photograph to be shared with anyone else. The consent evaluation applies separately to creation and to each individual act of distribution.

The Act's platform provisions apply to "covered platforms," defined as publicly accessible websites, social media applications, and hosting forums whose primary function involves user-generated content that can be discovered or shared by non-members. This deliberately excludes closed communication systems but captures the full range of social networks, video platforms, image hosts, and forum sites where nonconsensual content is most likely to spread at scale.^[1]

Once a covered platform receives a valid written notice from a victim or an authorized representative, the clock starts: the platform has exactly 48 hours to review the complaint and remove the material. The 48-hour window was a negotiated compromise between victim advocacy groups pushing for immediate takedown and platform lobbies arguing that context review takes time. The law does not require the platform to make a definitive legal determination during the 48-hour window, only to act on the notice in good faith.

The duplicate scrub requirement is one of the most technically demanding provisions. Platforms cannot satisfy their obligations by removing only the specific URL reported. The law requires them to make reasonable efforts to proactively identify and delete known identical copies or re-uploads of the flagged material. In practice, this means platforms must deploy perceptual hashing or similar fingerprinting technology to detect re-uploads of removed content, which has significantly increased the compliance cost burden for smaller platforms.

The good-faith safe harbor protects platforms that remove material under the Act from civil liability even if the removed material is later found to have been lawful. This provision was essential to the bill's passage. Without it, platforms faced the impossible position of being liable for hosting unlawful content if they did not remove and liable for wrongful removal if they did. The safe harbor resolves this by indemnifying good-faith compliance while preserving FTC enforcement authority against platforms that systematically fail to act.

Congress carved out three explicit categories of exemptions to protect privacy architecture and prevent the law from disrupting legitimate professional and infrastructure functions.

Infrastructure providers are fully exempt. Broadband internet service providers, routing backbone operators, and underlying cloud infrastructure are not required to monitor or filter content in transit. The Act targets the application layer, not the network layer. An ISP whose network carries a URL containing nonconsensual content has no obligation under this statute.

Closed and encrypted communication systems are exempt from the notice-and-removal mandates. End-to-end encrypted messaging applications such as Signal, iMessage, or WhatsApp are not "covered platforms" under the Act's definition. The law targets publicly discoverable, user-generated content environments. Private communications that cannot be discovered by non-participants fall outside its scope. This exemption is relevant context for the Texas AG's separate lawsuit against Meta over WhatsApp's encryption practices, which operates under a different legal theory entirely.

Professional and institutional use is exempt when the purpose falls within recognized ethical and legal frameworks. Medical professionals diagnosing or treating conditions, researchers studying the phenomenon under IRB protocols, attorneys filing legal materials, and law enforcement officers conducting or supporting criminal investigations are all shielded from liability when transmitting or using such material responsibly within their professional context. This exemption ensures the statute does not inadvertently criminalize the evidentiary and investigative work required to actually prosecute TAKE IT DOWN Act violations.

The first criminal complaints under the TAKE IT DOWN Act were unsealed in Brooklyn's Eastern District of New York on May 20, 2026, one year and one day after the law took effect. Cornelius Shannon, 51, of Hasbrouck Heights, New Jersey, was charged with publishing approximately 360 albums of AI deepfake pornography depicting roughly 90 female victims, including actresses, singers, and political figures. Arturo Hernandez, 20, of Bedias, Texas, was charged with publishing approximately 113 albums depicting roughly 50 victims, including non-public figures and personal acquaintances. Content uploaded by both defendants was viewed millions of times.^[2]

The cases are docketed as E.D.N.Y. 26-MJ-96 (Shannon) and 26-MJ-97 (Hernandez) and are being prosecuted by AUSAs Nicholas J. Moscow and Molly N. Delaney under the supervision of U.S. Attorney Joseph Nocella, Jr. Both defendants face up to two years in federal prison if convicted.

The prosecutions are significant beyond the individual charges. They establish the first judicial interpretation of what constitutes a "covered platform" and a "valid notice" under the Act's criminal provisions, and they test whether the statute's AI-generated deepfake coverage survives First Amendment scrutiny in the context of a federal criminal prosecution. Defense filings in both cases will be the primary source of legal challenge to the Act's scope in the near term. Full coverage of the arrests and ongoing case developments is at OzoneNews's TAKE IT DOWN Act arrests coverage.

Before the TAKE IT DOWN Act, the United States had no unified federal statute covering nonconsensual intimate imagery. Forty-eight states had enacted revenge-porn laws by 2025, but they varied dramatically in scope, penalties, and coverage of AI-generated content. A victim in Texas had different legal recourse than a victim in Montana. AI-generated deepfakes were explicitly covered by fewer than a dozen state statutes at the time the federal law passed.

The Act resolves four structural gaps simultaneously. First, it creates federal jurisdiction, allowing DOJ to pursue cases regardless of state law variations. Second, it explicitly covers synthetic media, future-proofing the statute against next-generation AI imagery tools. Third, it creates a binding platform removal obligation with real enforcement teeth under the FTC Act, replacing the voluntary moderation policies that platforms had previously applied inconsistently. Fourth, it establishes a federal reporting infrastructure through the FTC portal, creating a centralized record of platform compliance failures that the FTC can use to build systematic enforcement cases against repeat offenders.

The remaining gap in the legal landscape is platform liability beyond the FTC civil enforcement track. The TAKE IT DOWN Act does not create a private right of action for victims against platforms that fail to meet the 48-hour removal standard. Victims can report platform non-compliance to the FTC, but cannot sue platforms directly under this statute. Whether Congress will revisit that gap, and whether the first wave of prosecutions and platform enforcement actions generates political pressure to do so, will define the next phase of digital privacy legislation in the United States. Follow all updates on the OzoneNews copyright and digital law hub.