One year after the TAKE IT DOWN Act (TIDA) became law, the statute’s notice-and-takedown obligations are now in effect. Ahead of the May 19 effective date, the Federal Trade Commission (FTC) made clear that it was prepared to enforce the law on day one, and has since issued guidance to businesses, consumer-facing materials, and warning letters to companies that may fall within the law’s scope.
Federal authorities also have begun using the Act’s new tools as shown by the Department of Justice announcement last month of a criminal action involving websites that allegedly published AI-generated nonconsensual intimate imagery and seized associated domain names. While the case arose under the Act’s criminal provisions rather than its platform-compliance requirements, it underscores the federal government’s broader focus on addressing nonconsensual intimate imagery and AI-generated sexual deepfakes.
The TIDA reflects a broadly shared goal: providing meaningful remedies for victims of nonconsensual intimate imagery, including AI-generated “digital forgeries” that can be created and distributed at unprecedented speed and scale. Yet for platforms that host user-generated content, several important compliance questions remain unanswered.
Those questions matter because the statute imposes a short timeline for action by platforms while providing limited guidance on how they should evaluate difficult and ambiguous cases. Companies that may qualify as covered platforms should understand both the law’s requirements and the areas where uncertainty remains.
Does the Law Apply to Your Platform?
Companies should be asking first whether the TIDA even applies. A “covered platform” is a website, online service, online application, or mobile application that primarily provides a forum for user-generated content. The law, however, does not define what it means to “primarily” provide such a forum or what types of functionality are sufficient to qualify as a forum for user-generated content.
Unfortunately, that means there is considerable uncertainty about how broadly the FTC ultimately will interpret the statute. While much of the public discussion around the law has focused on large social media companies, the statutory language is not so limited and while the FTC’s compliance guidance describes covered platforms to include social media services, it also broadly includes messaging, image-sharing, video-sharing, and gaming platforms.
For now, organizations should be cautious about assuming the law applies only to a narrow category of consumer-facing social media companies. Depending on how the FTC interprets the statute, a range of services that facilitate user-generated content—including community forums, creator and streaming platforms, collaboration tools, hosting services, and other online communities—could potentially be considered covered platforms.
What Review Is Required Before Content Must Be Removed?
Perhaps the most significant unanswered question under the TIDA is what exactly triggers a platform’s removal obligations. The statute requires covered platforms to remove content within 48 hours after receiving a “valid request” from an individual depicted in nonconsensual intimate imagery or that individual’s authorized representative. The law also identifies information that a requestor must provide. The TIDA does not, however, clearly explain what makes a request “valid.”
One reasonable reading is that a request becomes valid when it contains the information required by the statute which would trigger a platform’s removal obligations when it receives a procedurally complete request, regardless of whether the platform independently verifies the underlying allegations. Another reading is that a request is not truly “valid” unless the reported content actually qualifies as nonconsensual intimate imagery under the law, which would imply that platforms must make at least some substantive assessment before removing content.
That distinction matters because determining whether content falls within the statute’s scope may not be straightforward. The Act applies to imagery published without consent, but consent disputes can be factually complex. Platforms may receive requests alleging that consent never existed, that it was later withdrawn, or that the use of an image exceeded the scope of consent originally provided. The law also encompasses certain AI-generated and digitally manipulated imagery, raising additional questions about authenticity and whether a particular image qualifies as a “digital forgery.”
Yet the statute provides limited guidance regarding what evidence platforms should consider, how much investigation is expected, or what level of confidence is required before concluding that content is covered by the law. Nor does it clearly address how platforms should handle requests involving disputed facts, potentially newsworthy content, satire, or other forms of protected expression.
These questions become particularly difficult when considered alongside the statute’s 48-hour deadline. If a facially complete request is sufficient, platforms may feel compelled to remove content even where the underlying allegations are difficult to verify. If substantive review is required, platforms may need personnel and processes capable of evaluating complex factual and technical questions on an accelerated timeline.
The Safe Harbor Does Not Eliminate the Challenging Cases
The statute includes a safe harbor for covered platforms that remove or disable access to reported content after conducting an analysis and determining that “facts or circumstances from which the unlawful publishing of an intimate visual depiction is apparent, regardless of whether the intimate visual depiction is ultimately determined to be unlawful or not.”
At first glance, that provision may appear to provide platforms with a measure of comfort. But it also reinforces one of the central ambiguities in the statute.
Notably, the safe harbor appears difficult to reconcile with a purely procedural review model. The statutory standard turns on whether a reasonable person would conclude, based on the facts and circumstances surrounding the publication, that the content constitutes nonconsensual intimate imagery. That language appears to contemplate some assessment of the underlying facts rather than merely confirming that a request contains the information required by the statute.
At the same time, the safe harbor provides little guidance regarding what that assessment should entail. The statute does not explain what evidence platforms should consider, how much investigation is required, or what level of certainty is necessary before concluding that the reasonable-person standard has been satisfied.
In some situations, that determination may be relatively straightforward. In others, it may not. Platforms may encounter disputes regarding consent, questions about whether an image has been digitally altered or generated using AI, competing accounts of the relevant facts, or claims that content has newsworthy, political, artistic, or satirical significance.
Thus, the safe harbor may provide the greatest certainty in the easiest cases, while offering less guidance in the more difficult cases that are most likely to challenge platform review teams. Although the provision suggests that platforms are expected to exercise substantive judgment, it leaves many unanswered questions about the scope of that judgment and the level of diligence required before making a removal decision.
What Companies Should Be Doing Now
Although many implementation questions remain unresolved, organizations do not have the luxury of waiting for additional guidance.
Companies that may fall within the law’s scope should consider:
- Assessing whether any products or services could qualify as covered platforms;
- Creating or updating public disclosures and intake mechanisms for TAKE IT DOWN requests;
- Developing review and escalation procedures for challenging cases;
- Evaluating technical capabilities for identifying duplicate content;
- Training legal, trust and safety, moderation, and customer-support personnel; and
- Maintaining documentation that demonstrates compliance efforts and decision-making processes.
Organizations that already operate notice-and-takedown systems may be able to build upon existing workflows. Others may need to establish entirely new processes to comply with the law’s requirements.
Looking Ahead
The TIDA represents an important effort to address the growing harms associated with nonconsensual intimate imagery and AI-generated sexual deepfakes. Its objectives are clear; however, some aspects of implementation are not.
Additional FTC guidance, enforcement activity, and eventual judicial interpretation likely will provide greater clarity. Until then, companies must navigate a framework that imposes concrete obligations while leaving several operational questions unanswered.
For organizations that may qualify as covered platforms, now is the time to evaluate existing processes, identify potential gaps, and prepare for compliance. The legal requirements are already in effect—and the FTC is watching—even if some of the practical answers are still developing.