What Is the Take It Down Act? The 2025 Federal NCII Law Explained

The Take It Down Act is a federal law, enacted May 19, 2025 as Public Law 119-12, that makes it a crime to publish non-consensual intimate images of an identifiable person and requires covered websites to remove reported images within 48 hours.

This article covers United States federal law under Public Law 119-12 and the related federal civil action at 15 U.S.C. § 6851. State criminal and civil NCII laws still apply on top of it, and those are compared in revenge porn laws by state. If images of you are online right now, the procedural walkthrough is in how to file a Take It Down request.

What the Take It Down Act Is

The Take It Down Act began as S. 146 in the 119th Congress and became Public Law 119-12 on May 19, 2025. It is short, five sections, and it does two distinct things that are easy to confuse. Section 2 creates federal crimes by adding a new subsection (h) to 47 U.S.C. § 223. Section 3 creates a civil regulatory duty for websites, enforced by the Federal Trade Commission, and is codified at 47 U.S.C. § 223a. Sections 4 and 5 supply definitions and a severability clause.

The distinction matters for anyone trying to use the law. The criminal half is aimed at the person who published or threatened to publish the images, and only federal prosecutors can bring it. The platform half is aimed at the website hosting the images, and only the FTC can enforce it. Neither half gives you, personally, a cause of action against a website.

Congress passed the Act against a documented enforcement gap. An audit study by University of Michigan researchers, reported in October 2024, posted AI-generated nude images to X and reported half under the DMCA and half under X's non-consensual nudity policy. Every image reported as copyright infringement was removed within about 25 hours; none of the images reported as non-consensual imagery were removed in over three weeks. The copyright route worked and the abuse route did not, and the Act was written to close that difference.

"NCII" is the term that shows up in the statute's shorthand and in FTC materials. It stands for non-consensual intimate imagery, and it is the neutral term for what older state statutes call revenge porn. The newer term is broader on purpose, because a great deal of this material has nothing to do with revenge and was never consensually created in the first place.

Who the Law Protects

The Act protects identifiable individuals, and it splits its protection along two axes at once: adult versus minor victim, and authentic image versus digital forgery. That produces four criminal tracks, plus two more for threats.

Adult victims

For an adult victim, the government has to establish a cluster of elements. The intimate visual depiction has to be of an identifiable adult. The adult has to have had a reasonable expectation of privacy in it. The image cannot have been voluntarily exposed by that person in a public or commercial setting, and it cannot be a matter of public concern. And the publication has to have been intended to cause harm, or actually caused harm, including psychological, financial, or reputational harm.

That is a real evidentiary burden, and it is deliberate. The public-concern and voluntary-exposure carve-outs are what keep the statute from reaching journalism or a person's own published work.

Minor victims

Where the victim is a minor, the elements are different and easier for prosecutors to reach. The question is whether the person published the depiction with intent to abuse, humiliate, harass, or degrade the minor, or with intent to arouse or gratify the sexual desire of any person. There is no reasonable-expectation-of-privacy element to litigate and no harm-causation showing. The maximum prison term also rises from 2 years to 3.

Material depicting a minor may also be child sexual abuse material under other federal statutes, which carry far heavier penalties. Reports involving a minor should go to the NCMEC CyberTipline and to law enforcement, not only to a platform form.

Digital forgeries and deepfakes

The Act covers AI-generated imagery on the same terms as photographs. The Act defines, at 47 U.S.C. § 223(h)(1), a digital forgery as an intimate visual depiction created through:

software, machine learning, artificial intelligence, or any other computer-generated or technological means, including by adapting, modifying, manipulating, or altering an authentic visual depiction, that, when viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction.

That clause matters. An unaltered real photo that has been edited, including by a nudify tool, is a digital forgery under the Act; it does not have to be generated from nothing.

Two things follow from that wording. The test is a reasonable-person test applied to the image as a whole, not a technical forensic test, so the question is whether an ordinary viewer would take it for real rather than whether a detection tool can flag it. And the definition is technology-neutral, covering "any other computer-generated or technological means," so it does not expire when the generation method changes.

The digital-forgery tracks carry the same maximums as the authentic-image tracks: up to 2 years where the victim is an adult, up to 3 where the victim is a minor. The elements differ in one respect: for a real photograph the government must prove the person had a reasonable expectation of privacy, while for a digital forgery it must prove only that it was published without consent. For state-level AI rules that sit alongside this, see our deepfake laws by state coverage.

What consent means under the Act

The statute defines consent narrowly, which forecloses the most common defense. The Act defines it, at 47 U.S.C. § 223(h)(1), as:

an affirmative, conscious, and voluntary authorization made by an individual free from force, fraud, duress, misrepresentation, or coercion.

Consenting to the creation of an image is not consent to its publication, and the definition's reference to fraud and misrepresentation reaches images obtained under a false pretext. Sending an image to one person is not consent to its publication by anyone else.

Criminal Offenses and Penalties

Section 2 of Public Law 119-12 sets these maximum terms:

These are statutory maximums. A federal judge sets the actual sentence, and the Act does not impose mandatory minimums. Conviction also carries consequences beyond prison. The court must order restitution to the victim, and it must order forfeiture of the material itself, of any proceeds of the offense, and of the devices used to commit it.

The threat provisions are worth noticing separately, because sextortion typically stops at the threat stage if the victim pays or complies. Under the Act the threat itself is chargeable; the images never have to be published for a federal crime to have occurred. If you are facing a threat like this right now, our guide to sextortion scams covers the first steps, from not paying to getting the images taken down.

Section 2 also writes in exceptions. The prohibition does not reach disclosures made in the course of lawful law enforcement activity, in legal proceedings, for legitimate medical purposes, in reporting the conduct or seeking support, in disclosures reasonably intended to assist the depicted individual, or where the individual published the material themselves.

The 48-Hour Platform Takedown Duty

Section 3, codified at 47 U.S.C. § 223a, is the part most victims will actually use. It requires a covered platform to run a notice-and-removal process, and once it receives a valid request from the depicted individual or their authorized representative, to remove the depiction "as soon as possible, but not later than 48 hours after receiving such request." That is the operative language of 47 U.S.C. § 223a(a)(3), and it is the provision to look up if you need to quote the duty itself.

The obligation does not stop at the reported copy. The platform must also make "reasonable efforts to identify and remove any known identical copies" of the image. That is the provision that addresses re-uploads, which is the single most demoralizing part of this for victims, and it is why platforms have moved toward hash-matching systems rather than manual review of individual URLs.

Section 3 also requires the platform to post a clear, plain-language notice explaining the process, placed conspicuously enough that someone in distress can find it. And it gives platforms a good-faith safe harbor for removing content they reasonably believed was covered, which is there to stop platforms from stalling out of fear of a wrongful-removal suit.

Which platforms are covered

The duty applies to what the Act calls covered platforms: websites, online services, applications, and mobile apps that serve the public and either primarily provide a forum for user-generated content or publish nonconsensual intimate imagery in the regular course of business. Internet service providers, email services, and services whose content is chosen by the provider rather than by users are excluded.

In practice that means social networks, image and video hosts, forums, and messaging platforms with public posting are in scope. Your broadband provider and your email host are not.

The May 19, 2026 compliance deadline

Section 3 gave platforms "not later than 1 year after the date of enactment" to comply, which set the deadline at May 19, 2026. The criminal provisions in Section 2 carried no such delay and applied immediately on enactment in 2025.

That one-year runway is why the timeline looks odd from outside. A person was already convicted under the Act in April 2026, a month before the platforms were required to have a takedown process in place at all.

How the FTC Enforces the Act

A platform's failure to meet the Section 3 duty is treated, by 47 U.S.C. § 223a(b)(1), as a violation of a rule defining an unfair or deceptive act or practice under Section 18(a)(1)(B) of the FTC Act, 15 U.S.C. § 57a(a)(1)(B). The Act specifies that nonprofit entities are covered too, closing a gap that would otherwise sit outside normal FTC jurisdiction.

The Commission began enforcing on May 19, 2026. It launched a complaint portal at TakeItDown.ftc.gov for people whose removal requests were ignored, and its business guidance states that a violation can draw civil penalties of up to $53,088 per violation. The guidance also recommends hash-matching as the practical way to satisfy the identical-copies requirement.

On May 11, 2026, a week before the deadline, FTC Chairman Andrew Ferguson sent letters to more than a dozen major technology companies, including Alphabet, Amazon, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok, and X, reminding them of the May 19 compliance date. The day after enforcement began, on May 20, 2026, the Commission sent warning letters to twelve websites offering AI nudify tools, stating that they appear to be in violation of the Act for failing to provide a removal process at all and urging them to come into compliance immediately.

As of August 2026, the FTC has not announced a completed enforcement action against any platform under the Act. The posture is still at the warning-letter stage, though the Commission has already named twelve companies as apparently non-compliant. That matters for expectations: filing a complaint at TakeItDown.ftc.gov creates a record and feeds the FTC's enforcement picture, but it is not a mechanism that forces a specific image down on a specific timeline. The platform's own removal process remains the fastest route, and the FTC complaint is the escalation when that process fails.

The First Criminal Conviction

On April 7, 2026, the U.S. Attorney's Office for the Southern District of Ohio announced that a Columbus man, James Strahler II, 37, pleaded guilty to cyberstalking, producing obscene visual representations of child sexual abuse, and publication of digital forgeries. That last count is the Take It Down Act charge, and the U.S. Attorney described him as the first person in the United States to be convicted under the Act.

On September 8, 2026, Chief U.S. District Judge Sarah D. Morrison sentenced Strahler to 180 months, or 15 years, in prison.

That term is far longer than anything the Take It Down Act by itself authorizes, and the reason is worth understanding before you read it against the penalty table above. The Act's maximums are 2 years where the victim is an adult and 3 years where the victim is a minor, so the digital-forgery count could account for at most a small fraction of 180 months. Strahler was sentenced on three groups of counts at once, and the bulk of the term rests on the cyberstalking and child-exploitation convictions, which are charged under other federal statutes carrying their own, much heavier penalties. The sentence does not mean the Act's own maximums are higher than stated.

Two features of that case are worth carrying forward. It was a prosecution of an individual under Section 2, entirely separate from the FTC's platform track, and it involved AI-generated material, which shows the digital-forgery provisions being used rather than sitting decorative. It also arrived roughly eleven months after enactment, which is fast for a new federal statute.

How the Act Fits With Other Laws

The Take It Down Act was layered onto an existing patchwork rather than replacing it. Understanding what sits alongside it is how you find a remedy the Act itself does not provide.

The federal civil action at 15 U.S.C. § 6851

Congress created a private federal civil action for NCII three years earlier, in the Violence Against Women Act Reauthorization Act of 2022 (Public Law 117-103, enacted March 15, 2022), codified at 15 U.S.C. § 6851. It lets a person whose intimate visual depiction was disclosed in or affecting interstate commerce, without consent, sue the person who disclosed it.

The remedy is substantial. A plaintiff may recover actual damages or liquidated damages of $150,000, plus costs and reasonable attorney's fees. A guardian or other representative may bring the action on behalf of a minor, a person who is incapacitated, or a deceased person.

This is the answer to "can I sue," and it is aimed at the individual who shared the images, not at the platform. The statute also lets the court order the defendant to stop displaying or disclosing the images, through a temporary restraining order or an injunction, and it lets the court protect a plaintiff's identity by allowing the case to proceed under a pseudonym. A lawyer licensed in your state can advise on whether and how to proceed, including on filing deadlines, which vary by claim and jurisdiction.

State revenge porn laws

The text of Public Law 119-12 contains no preemption clause, so state NCII statutes continue to operate. Every state now criminalizes non-consensual distribution of intimate images in some form, but the details vary a great deal: whether the offense is a felony or a misdemeanor, whether intent to harm is an element, whether digitally altered images are covered, and whether the statute carries a civil remedy alongside the criminal one.

Those differences decide which door is worth knocking on first. A state with a felony tier and a civil cause of action gives a victim more options than the federal criminal statute alone. The state-by-state breakdown is in revenge porn laws by state.

The copyright route, and why it is different

Before this Act, a selfie was often removed faster as a copyright claim than as an abuse report, because the DMCA takedown process was mature and the abuse process was not. If you took the photo yourself, you own the copyright in it, and a DMCA notice remains available. Our DMCA takedown notice generator drafts that notice from your answers.

The copyright route has real limits here. It does not work if someone else took the photograph, and it does not work at all against an AI-generated image of you, since you hold no copyright in something you did not create. It also requires you to identify yourself as the copyright owner in a notice that may be forwarded to the uploader. The Take It Down Act route exists precisely because those limits left most victims without a workable option.

Related conduct may also support other claims. Where false statements accompany the images, our defamation coverage applies, and where the person sharing the images is a current or former partner, a restraining order may be available through your state courts.

What to Do If Your Images Were Shared

The sequence below is the short version. The full walkthrough, with what each form asks for and what to do when a platform goes quiet, is in how to file a Take It Down request.

1. Document before anything else. Capture URLs, screenshots, usernames, and timestamps. Removal destroys the evidence you may later need, so preserve it first.
2. File with the platform. Use the platform's own NCII or Take It Down reporting form. The 48-hour clock starts when a valid request is received, so note the date, the time, and any reference number.
3. Use the hash tools. If you were an adult when the image was taken, StopNCII.org lets you generate a hash on your own device so participating platforms can block matches. If you were under 18 when it was taken, use takeitdown.ncmec.org instead. Both hash the image locally; the image itself is not uploaded. Neither is a guarantee of removal, and neither replaces filing with the platform.
4. Escalate to the FTC. If a covered platform misses the 48-hour window, file at TakeItDown.ftc.gov.
5. Report the underlying crime. Publishing or threatening to publish is a crime in its own right. Reports can go to local law enforcement and to the FBI at tips.fbi.gov.
6. Consider civil options. 15 U.S.C. § 6851 and your state's civil NCII statute both target the person who shared the images. A lawyer licensed in your state can assess which applies.

Nothing in this sequence should cost money, and no legitimate service charges a fee to do what the platform is already required to do for free.

What the Act Does Not Do

Being clear about the limits is more useful than overstating the law.

It does not give you a way to sue a platform. Enforcement of the 48-hour duty belongs to the FTC, and as of August 2026 that enforcement has not yet produced a completed action.

It does not reach every website. Platforms outside the covered-platform definition, and sites operating outside U.S. jurisdiction, sit beyond its practical reach even where the conduct is plainly criminal.

It does not guarantee that an image stays down. The identical-copies duty addresses known copies on that platform; a re-upload elsewhere starts a new request. Hash-matching through StopNCII or NCMEC is the closest thing to a preventive measure, and it only works on participating services.

And it does not remove the need for state law. Most prosecutions in this area are still state prosecutions, and most civil recoveries still run through state statutes or 15 U.S.C. § 6851.

Information Last Verified

This article presents general legal information about United States federal law under Public Law 119-12 and 15 U.S.C. § 6851, verified against the primary sources listed below in August 2026, with the codification of the platform duty at 47 U.S.C. § 223a and the September 2026 sentencing in the Strahler case verified in September 2026. It is not legal advice, and it does not create an attorney-client relationship. Enforcement posture and platform reporting procedures are changing; for advice on your own situation, consult a lawyer licensed in your state.

Frequently Asked Questions

Is a violation of the Take It Down Act a felony?

It depends on the maximum term Congress attached to the specific offense. Publishing non-consensual intimate imagery of an adult carries up to 2 years in prison, and publishing imagery of a minor carries up to 3 years. Federal offenses punishable by more than one year are classified as felonies, so those two offenses sit on the felony side. Threatening to publish an authentic image is punished on the same scale as publishing it (2 years adult, 3 years minor); threatening to publish a digital forgery carries up to 18 months (adult) or 30 months (minor). The penalties in Public Law 119-12 are maximums, not mandatory sentences, and a federal judge sets the actual sentence.

Does the Take It Down Act cover AI deepfakes?

Yes. The Act reaches what it calls a digital forgery, defined as an image created through software, machine learning, artificial intelligence, or any other computer-generated or technological means that, when viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction. That means an AI-generated nude of a real, identifiable person is treated on the same footing as a real photograph, with the same 2-year and 3-year maximum terms. It also means the platform takedown duty applies to deepfakes.

Does the law protect minors as well as adults?

Yes, and on a separate track with a lower bar to prove. For an adult victim, the government generally has to show the image was private, was not voluntarily exposed in a public setting, was not a matter of public concern, and that the publication was intended to cause harm or actually caused harm. For a minor victim, the question is whether the publication was intended to abuse, humiliate, harass, or degrade the minor, or to arouse or gratify sexual desire. The maximum term is also higher, 3 years rather than 2.

Can I sue a website that refuses to take my images down?

Not under the Take It Down Act. The text of Public Law 119-12 contains no private right of action, so enforcement of the 48-hour duty runs through the Federal Trade Commission rather than through a lawsuit you file. If a covered platform ignores a valid removal request, the route is a complaint at TakeItDown.ftc.gov. You may still have a claim against the person who shared the images under 15 U.S.C. § 6851 or under your state's civil NCII statute, and those are separate from the platform question.

What happens if a platform misses the 48-hour deadline?

A covered platform that fails to run a compliant notice-and-removal process is treated, under 47 U.S.C. § 223a(b)(1), as having violated a rule defining an unfair or deceptive act or practice under the FTC Act, which is what gives the Federal Trade Commission jurisdiction. The FTC's business guidance puts civil penalties at up to $53,088 per violation. As a victim, your step is to file at TakeItDown.ftc.gov and keep your evidence of the original request, including the date, the time, and any ticket or reference number the platform gave you.

Does it cost anything to have images removed?

No. Platform removal requests under the Act are free, the FTC complaint portal is free, and the NCMEC and StopNCII hash-matching tools are free. Nobody should be asked to pay a fee to a website to take down an image of them, and services that charge to do what the law already requires for free are worth avoiding. Filing a civil lawsuit is a different matter and normally involves a lawyer, but the takedown pathway itself carries no cost.

Does the Take It Down Act replace my state's revenge porn law?

No. The text of Public Law 119-12 contains no preemption clause, so state criminal and civil NCII statutes continue to operate alongside the federal law. In practice most cases are still handled by state prosecutors under state statutes, and many states offer a civil remedy the federal criminal provision does not. A single incident can support a state charge, a federal charge, and a civil suit at the same time.

How long did platforms have to comply?

Section 3 of the Act gave covered platforms one year from enactment to stand up a notice-and-removal process, which put the compliance date at May 19, 2026. The criminal provisions in Section 2 were not delayed and applied on enactment. That gap is why the first criminal case under the Act, a guilty plea in the Southern District of Ohio in April 2026, arrived before the platform duty was even enforceable.