The TAKE IT DOWN Act: 48-Hour Takedowns (2026)

TL;DR. The TAKE IT DOWN Act is a federal law, signed on May 19, 2025, that does two things: it criminalizes knowingly publishing nonconsensual intimate images of real people, including AI-generated deepfakes, and it requires covered platforms to remove that material within 48 hours of a valid request. Covered platforms had until May 19, 2026 to stand up a notice-and-removal process, FTC enforcement began that day, and the announced civil penalty is $53,088 per violation. For an OnlyFans agency this is a new federal lever beside the DMCA: stronger for private material published without consent and for AI clones of your creators, while the DMCA remains the workhorse for leaked paywall catalogs, where copyright ownership is clean and identifiability does not matter. The statute lets "an authorized person acting on behalf of" the depicted individual file, so your agency can run takedowns roster-wide, provided you paper the authorization at onboarding.

Key sources for this guide: the text of Public Law 119-12, the TAKE IT DOWN Act, the FTC's business guidance on complying with the Act, and the FTC's enforcement announcement.

Almost everything written about the TAKE IT DOWN Act is a law-firm alert aimed at the platforms that must comply with it. Very little exists for the people on the other side of the form: the operators filing the requests. If you run an OnlyFans agency, leaks and deepfakes are recurring events across a roster, not one-off crises, and a federal 48-hour removal clock backed by five-figure per-violation penalties changes how fast you can make bad content disappear. This is the operator's manual: what the law covers, when it beats a DMCA notice, how to file step by step, and how to wire takedowns into SOPs so protection scales with the roster.

What the TAKE IT DOWN Act covers

The full name is the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, Public Law 119-12. It passed both chambers of Congress with near-unanimous votes and was signed on May 19, 2025. The law has two distinct halves.

The criminal half (Section 2) amends the Communications Act to make it a federal crime to knowingly publish a nonconsensual intimate visual depiction of an identifiable adult, or a "digital forgery" of one, when specific conditions are met. Penalties run up to 2 years in prison for offenses involving adults and up to 3 years for offenses involving minors. Threatening to publish is its own offense, aimed squarely at extortion: threats involving digital forgeries carry up to 18 months for adult victims and 30 months for minors, and threats involving authentic images are punished like publication itself.

The platform half (Section 3) is the part that changes your workflow. It requires every "covered platform" to run a notice-and-removal process for nonconsensual intimate imagery and to act within 48 hours of a valid request. That obligation went live on May 19, 2026, one year after enactment.

Three definitions in the statute matter enormously in practice:

• Digital forgery means an intimate depiction of a real person created or altered by software, machine learning, AI, or similar means that, "when viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction of the individual." Realistic AI clones of your creators are squarely inside this. Obviously stylized or cartoonish fakes may fall outside it.

• Identifiable individual means someone whose face, likeness, or "other distinguishing characteristic," including a unique birthmark or recognizable feature, is displayed in connection with the depiction. For faceless creators: a distinctive tattoo or feature can still carry the claim, but the further content sits from an identifiable likeness, the more you should lean on copyright instead.

• Covered platform means a public-facing website, online service, or app that primarily provides a forum for user-generated content, or one for which publishing nonconsensual intimate imagery is part of its regular course of business, a clause deliberately aimed at dedicated leak and deepfake sites. Excluded: broadband providers, email, and services built on preselected editorial content.

One more provision answers the most common objection. The statute states outright that consent to the *creation* of an image is not consent to its *publication*, and that privately sharing an image with one person is not consent for that person to publish it. The "she made this content willingly" defense that leak-site operators lean on is dead on arrival under this law.

The 48-hour removal requirement explained

Here is what Section 3 obligates a covered platform to do.

First, the platform must operate a notice-and-removal process and post a clear, plain-language notice explaining how to use it. If you cannot find a platform's reporting channel for nonconsensual intimate imagery, that absence is itself a compliance problem.

Second, upon receiving a valid removal request, the platform must act "as soon as possible, but not later than 48 hours": remove the depiction, and make reasonable efforts to identify and remove any known identical copies. That identical-copies clause matters at agency scale, because leaks rarely appear once: one valid request should sweep the duplicates the platform can find, not just the URL you flagged.

Third, platforms get a liability shield for good-faith removals, even if the material later turns out to be lawful. Read that as an operator: a platform that removes in good faith is protected, one that leaves content up past 48 hours is exposed, so borderline calls tilt toward removal, an asymmetry that works in your creators' favor.

Enforcement sits with the FTC: a failure to reasonably comply is treated as an unfair or deceptive act or practice under the FTC Act, and the enforcement announcement put civil penalties at $53,088 per violation. In the run-up to the May 19, 2026 deadline, FTC Chairman Andrew Ferguson sent warning letters to fifteen major companies, from Alphabet, Amazon, Apple, and Meta to Discord, Reddit, Snap, TikTok, and X. Notice the overlap with the platforms your marketing runs on every day. The FTC also told platforms to issue an identifying number for each takedown request and to tell requesters the outcome, which gives you something concrete to log and cite.

The criminal half has teeth too. In April 2026 the Justice Department announced the first conviction under the Act, an Ohio man who pleaded guilty to charges that included publishing AI-generated digital forgeries of real people. One conviction is not a wave, but it shows prosecutors will use the statute, which strengthens every demand letter your counsel sends.

This law is part of the broader 2025-2026 regulatory tightening around adult content, the same wave driving the age-verification laws now reshaping how agencies promote: platforms keep being handed legal duties they used to handle as discretionary trust-and-safety policy.

TAKE IT DOWN versus the DMCA: when to use which lever

Your agency almost certainly already runs DMCA takedowns; our playbook for protecting creators from leaks with the DMCA covers that mechanism in full. TAKE IT DOWN does not replace it: they are different legal claims, and choosing which to lead with should be standard takedown triage.

Legal basis. The DMCA is a copyright claim: this content belongs to us and was republished without a license. TAKE IT DOWN is a consent claim: this intimate depiction of a real person was published without her consent. Same leak, two different doors.

Who can file. A DMCA notice comes from the copyright owner or their agent, often the agency directly. A TAKE IT DOWN request comes from the identifiable individual or an authorized person acting on her behalf, so the agency can file, but the authorization must trace back to the creator.

The clock. The DMCA requires platforms to act "expeditiously," a word with no fixed number attached, and response times in practice range from hours to weeks. TAKE IT DOWN gives you a hard 48-hour statutory deadline with a federal penalty behind it.

The counter-move. The DMCA has a built-in counter-notice process: a reposter can contest the takedown and the platform may restore the content while the dispute plays out. The TAKE IT DOWN statute as written contains no counter-notice mechanism, so removed content has no formal statutory path back up. Civil-liberties groups have criticized this as ripe for abuse; do not be the abuser, since junk filings are wrong and corrode your credibility with platforms.

Deepfakes. This is where the DMCA fails outright: a fabricated AI image of your creator was never her copyrighted work, so a copyright notice has nothing to stand on. For AI clones, TAKE IT DOWN is not the better lever, it is essentially the only one with force of law behind it.

Faceless and catalog content. The mirror image. The DMCA does not care whether anyone is identifiable, only who owns the file, so it remains the stronger claim for faceless-creator content and bulk catalog rips. TAKE IT DOWN needs an identifiable individual.

Leaked paywall content, the honest read. Here the two halves of the Act diverge. The criminal offense for authentic imagery includes an element that the material "was not voluntarily exposed by the identifiable individual in a public or commercial setting," which arguably makes prosecutions over leaked commercial content harder to bring. But the removal mechanism in Section 3 does not restate that carve-out; it turns on whether the depiction was *published* without the individual's consent, and a leak-site repost of paywalled content is exactly that. How platforms and courts will treat commercial content under the removal process is still being worked out, and lawyers genuinely differ. The operator's move while the dust settles: for catalog leaks, lead with the DMCA, where your claim is unambiguous, and file the TAKE IT DOWN request in parallel where the creator is identifiable. Two claims, two review queues, and the faster one wins.

Where neither works cleanly. Offshore leak sites that ignore US law ignore both statutes; the pressure points there remain hosts, registrars, payment processors, and search de-indexing. A dedicated leak site is a covered platform by definition, which gives the FTC a hook where there is US exposure, but do not expect a 48-hour miracle from a server the FTC cannot reach.

Filing a TAKE IT DOWN removal request step by step

The statute sets out exactly four elements a valid request must contain. Build your template around them and a platform has no lawful reason to reject the filing.

Step 1: Find the platform's process. Covered platforms must publish a plain-language notice of their removal process; look in help or safety pages for "non-consensual intimate imagery" or "NCII." Every major platform on the FTC's warning-letter list now has a dedicated flow. If a smaller site has none, screenshot the absence; that gap is evidence for an FTC complaint later.

Step 2: Assemble the four required elements. In writing, the request must include: a physical or electronic signature of the identifiable individual or her authorized representative; identification of the depiction and information reasonably sufficient for the platform to locate it, meaning exact URLs plus a description; a brief statement of good-faith belief that the depiction is not consensual, with any context that helps the platform confirm it was published without consent; and contact information for follow-up.

Step 3: File as an authorized person, properly. The statute lets "an authorized person acting on behalf of" the individual submit the request, but does not spell out what proof a platform may demand. Remove the doubt yourself: have every creator sign a short authorization letter naming the agency as her representative for content-removal requests, and attach it to filings. This is a one-paragraph addition to the paperwork you already run in the first 30 days of creator onboarding.

Step 4: Start the clock and log everything. Timestamp the submission, capture the request's identifying number, and screenshot the offending URLs before they change. The 48-hour window runs from receipt of a valid request, so a clean, complete first filing matters; a rejection for a missing signature restarts everything.

Step 5: Verify at 48 hours, then escalate. Confirm the content and its known identical copies are gone. If the platform blew the deadline or never responded, file a complaint through the FTC's intake at ReportFraud.ftc.gov with your timestamps, request ID, and screenshots. That hands a federal regulator a documented violation, and it is the same paper trail counsel wants for a demand letter.

Step 6: Layer the hash tools on top. Removal is reactive; hashing is preventive. StopNCII lets an adult create digital fingerprints of intimate images so participating platforms block re-uploads before they appear; partners include Facebook, Instagram, TikTok, Reddit, Snap, Bumble, and OnlyFans itself, with over two million images protected to date. One naming trap: NCMEC runs a separate hash service literally called "Take It Down" for imagery of people under 18, unrelated to your adult roster.

For the escalation ladder: a separate 2022 federal law (15 U.S.C. 6851) gives the depicted individual a private civil action against whoever disclosed the images, with liquidated damages of up to $150,000 plus attorney's fees. The takedown gets the content offline; the civil claim is how a persistent leaker gets made to regret it.

Deepfakes: the new federal tool against AI clones of your creators

Agencies we work with report the deepfake problem growing along two distinct lines, and the Act addresses both.

The first is impersonation for fraud: AI-generated accounts using a creator's face to run fake profiles, sell fake subscriptions, or lure fans into scams on exactly the platforms where your marketing runs, including X, whose adult-content rules already make account standing fragile. Before this law, your remedy was platform impersonation policy, discretionary and unevenly enforced. Now a realistic AI depiction of your creator meets the digital-forgery definition and the 48-hour removal duty applies. File the same four-element request and state explicitly that the content is an AI-generated forgery of a real, identifiable person who did not consent to its publication.

The second is harassment and extortion. Intentionally threatening to publish a digital forgery for intimidation, coercion, or extortion is a standalone federal offense, so a "pay me or I post the fakes" message is now itself evidence of a crime. The advice changes from "block and ignore" to "preserve everything and report."

Two practical notes on forgery filings. First, the "indistinguishable from an authentic depiction" standard means your request should explain why the image reads as real and why it is not: reference the creator's verified accounts, note that no such original exists, attach the authorization letter. Second, keep a reference set of each creator's verified likeness on file so a new fake can be documented quickly. Your job is to make every incident easy for a platform, a regulator, or a prosecutor to act on.

Building takedowns into agency SOPs across a roster

One creator getting leaked is an incident. A forty-creator roster means leak response is a permanent function, and functions need systems, not heroics. Here is the structure agencies we observe are converging on.

Paper the authorization at onboarding. Every creator signs a removal-request authorization naming the agency as her representative under the Act, alongside the content-licensing language your management contract clauses should already contain for DMCA purposes. Doing this on day one costs nothing; chasing a signature mid-crisis while a leak spreads costs hours you do not have.

Build one evidence pack per creator. Verified profile links, a likeness reference set, catalog fingerprints or watermark records, the signed authorizations, and the creator's emergency contact. Store it where the on-call person can reach it at 2 a.m.

Run a monitoring cadence. Weekly reverse-image and name-search sweeps per creator, plus fan reports funneled through chatters, who are usually the first to hear "I saw her stuff on another site." Every report enters a ticket queue, not a group chat.

Triage with a decision tree. Deepfake or AI clone: TAKE IT DOWN request, plus the platform's impersonation and synthetic-media flows. Private or never-published material: TAKE IT DOWN leads, DMCA follows if you hold rights. Paywalled catalog leak: DMCA leads, TAKE IT DOWN files in parallel where the creator is identifiable. Extortion threat: preserve evidence, report to law enforcement, and let counsel send the letter citing the threat provisions.

Log like the FTC is watching, because it may be. Request IDs, submission timestamps, platform responses, and 48-hour outcomes, per incident, per platform. This log turns a blown deadline into an FTC complaint, and it teaches you which platforms actually honor the clock.

Tell the creator what you did. Leak response is a retention event. A creator who watches her agency kill a leak across five sites in two days, with receipts, does not shop for a new agency. Silence, even competent silence, reads as inaction.

The through-line: the Act did not create your duty to protect the roster. It handed you a faster, federally enforced tool for a job you were already doing, and the agencies that operationalize it first will quietly turn protection into a selling point.

FAQ: the TAKE IT DOWN Act for creators and agencies

What is the TAKE IT DOWN Act in plain terms?

It is a US federal law, signed May 19, 2025, that criminalizes knowingly publishing intimate images of real people without their consent, including realistic AI deepfakes, and requires covered platforms to remove such material within 48 hours of a valid request from the depicted person or her authorized representative. The FTC enforces the platform side.

Is the TAKE IT DOWN Act actually being enforced in 2026?

Yes. Covered platforms had until May 19, 2026 to stand up their notice-and-removal processes, and the FTC began enforcing on that date, with civil penalties pegged at $53,088 per violation. The FTC sent pre-deadline warning letters to fifteen major companies, and the Justice Department secured the first criminal conviction under the Act in April 2026.

Can my agency file a removal request on a creator's behalf?

Yes. The statute expressly allows "an authorized person acting on behalf of" the identifiable individual to submit the request. The clean way to do it is a signed authorization letter collected at onboarding, attached to every filing along with the four required elements: a signature, information locating the content, a good-faith non-consent statement, and contact details.

Does the TAKE IT DOWN Act cover leaked OnlyFans content?

Partially. The removal mechanism turns on whether the depiction was published without the individual's consent, which a leak-site repost plainly was, so filing is reasonable where the creator is identifiable. The criminal offense, however, requires that the material was not voluntarily exposed in a commercial setting, which complicates prosecutions over paywalled content. For catalog leaks, lead with a DMCA notice and file the federal request in parallel.

Does it cover AI deepfakes of a creator?

Yes, and this is where the law matters most for agencies. A "digital forgery" is an intimate depiction of a real person created or altered by AI that a reasonable person would find indistinguishable from an authentic image. The DMCA is useless against fabricated content, since the creator owns no copyright in it, so the federal request is the primary removal lever for AI clones. Threatening to publish a forgery for extortion is a separate offense.

What happens if a platform ignores the 48-hour deadline?

Document it and escalate. Non-compliance is treated as an unfair or deceptive practice under the FTC Act, exposing the platform to civil penalties of $53,088 per violation. File a complaint through the FTC's intake at ReportFraud.ftc.gov with your request ID, timestamps, and screenshots. Where the leaker is identifiable, a civil claim under 15 U.S.C. 6851 allows liquidated damages up to $150,000.

Should agencies use TAKE IT DOWN instead of the DMCA now?

No, use both, matched to the content. TAKE IT DOWN is faster on paper (a hard 48-hour clock versus the DMCA's undefined "expeditiously"), has no counter-notice process, and uniquely covers deepfakes, but it requires an identifiable individual. The DMCA covers faceless content and bulk catalog rips regardless of identifiability. A mature takedown SOP triages each incident and files the right claim, or both, within hours.

Work with WhaleFinders

WhaleFinders is a white-label growth and content-direction department for OnlyFans agencies. Protecting a roster is part of running one: we help agencies build the operational systems around their creators, from promotion funnels to the monitoring routines that catch leaks and clones early, so your brand is the one that responds fast when it counts. If you want an operation built to scale across a roster, message us on Telegram at t.me/whalefindersupport.