The Take It Down Act deadline has passed: what you owe the person in a photo they never agreed to post
A photo of someone who never agreed to be listed
A listing appears on a directory built around a photo of someone who never signed up as an advertiser. An ex-partner uploads pictures from a relationship that ended badly and posts them as if they were an ad. A stranger runs someone else's photo through an image generator and turns it into a listing that never existed. A professional photo gets lifted from somewhere else and reused without the person in it ever knowing. None of these people asked to be on the site. They find out when someone they know sees the page, or when they search their own name and a listing they never made comes back, and they write in the same day demanding it come down.
The instinct is to route that message through whatever takedown process already exists, usually the one built for stolen photos. But the person writing in is rarely the photographer and does not care who owns the picture. Their complaint is that it is a photo of them, published without their consent, and it needs to be gone now, not after a copyright form gets filed that a distressed person may never think to send.
That specific complaint now has its own federal law attached to it, with its own clock and its own regulator. The Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, known as the TAKE IT DOWN Act, was signed into law on May 19, 2025. It gave covered platforms exactly one year to put a working removal process in place. That year ended on May 19, 2026, and the Federal Trade Commission has confirmed it began enforcing the requirement from that date.
Today is well past that deadline. An operator who still thinks of this as something to prepare for in 2026 is not ahead of the law. The date the law expected a process to already be running has come and gone, and this piece is about what that process actually has to contain: what counts as a valid request, how fast the clock runs once one arrives, who enforces it, and how it differs from the two takedown duties a directory operator likely already knows.
Three duties that look alike and are not the same one
It helps to separate three obligations that arrive looking like the same email and are not. The copyright takedown process built for stolen photos protects whoever owns the picture, and it does not care what the picture shows or who appears in it. The mandatory report that covers child sexual abuse material is triggered by the age of the person depicted, has no 48-hour removal clock, and ends with a report to the National Center for Missing and Exploited Children rather than a simple takedown. The Take It Down Act is neither of those.
Its trigger is consent, not ownership and not age. It covers an intimate image of an identifiable adult or minor published without that person's agreement, and it explicitly covers a photo that is not a photo at all: a digital forgery, meaning an AI-generated image built to look like a real person, whether or not any real photograph of them was ever taken. A deepfake made from a headshot lifted off social media falls inside the same duty as a stolen intimate photo, because the harm the law targets is the false depiction itself, not the camera that produced it.
The definition of who has to comply is written wide on purpose. A covered platform is any public-facing website, app, or online service that primarily serves as a forum for content its users post, or that hosts this kind of material in the regular course of its business. The only carve-outs are broadband and email providers, and services whose content is pre-selected by the operator rather than uploaded by users. A listings site built entirely around photos its advertisers upload does not come close to either exception.
There is no size or revenue threshold anywhere in that definition. A five-person classifieds startup is a covered platform on the same terms as a company with a billion users, and the Federal Trade Commission's own guidance is explicit that neither size nor nonprofit status changes that. The law is written for the volume of user uploads, not the size of the company handling them, which is precisely the shape of a listings business.
What a valid request looks like, and the clock that starts running
The bar for a valid request is deliberately simple, because the person filing it is often in distress and is not a lawyer. It needs a signature from the depicted individual or someone authorized to act for them, enough detail to identify the specific image, enough information to locate it on the site, a brief statement made in good faith that it was published without consent, and a way to contact the person who filed it. Nothing more elaborate is required, and nothing less will start the clock.
Once a request that meets that bar arrives, the platform has 48 hours to remove the reported image and to make what the Federal Trade Commission calls reasonable efforts to find and remove known identical copies of it. The person reporting the photo is not expected to go hunting for every re-upload themselves; the duty to find duplicates sits with the platform, not the victim.
What counts as a reasonable effort is not spelled out in the statute, which leaves an operator to build something defensible rather than wait for a court to define the minimum. A listings platform already keeps photos tied to advertiser accounts for identity-verification purposes, and running a simple image-matching check against a reported photo, to catch the same picture reappearing under a different listing days later, turns reasonable efforts from a phrase in a policy document into an action a log can actually show happened.
There is no statute of limitations written into the removal duty, and no exception for an old listing. A photo that has been up for three years is covered by exactly the same 48-hour clock as one posted yesterday, so a request cannot be set aside on the theory that the listing predates the operator's awareness of the law.
The safe harbor built into the Act only runs one direction, and that shapes the right default. A platform that removes a reported photo in good faith is protected even if the image later turns out not to have violated the law. There is no matching protection for a platform that keeps a photo up because its own reading of the situation says the complaint does not qualify. When a request clearly meets the bar above, the safer move is to take the listing down first and sort out any dispute afterward, not the reverse.
Building the process without waiting for a complaint to force it
The practical fix is a reporting path that a person outside the advertiser relationship, someone who never created an account and has no login, can actually find and use. Burying this inside a general contact form or a support ticket queue built for advertisers misses the entire population the law is written to protect, since the person filing a valid request is by definition not the one who posted the photo.
The queue this creates does not need a separate team built from nothing. The team that already reviews listings before they go live is trained for exactly this kind of work: look at material quickly, make a call inside a fixed window, and write down why. Handing this queue to the same people, with a clear rule that a facially valid request gets actioned inside the 48 hours regardless of what else is in their queue that day, is faster to set up than training a new team from scratch.
Every request needs a record: when it arrived, what it contained, what was removed, and the good-faith basis for the decision. That record is what lets a platform invoke the safe harbor later if a removal is challenged, and it is the same record a regulator would ask for first if the platform's compliance were ever questioned.
None of this replaces the parallel duty sitting under state law. Nearly every state already had some law addressing non-consensual intimate imagery before this federal one arrived, and roughly two dozen to thirty states have laws specifically covering AI-generated deepfakes. The federal Act does not preempt any of them, so a request that a platform judges does not quite clear the federal bar can still expose the site to a claim under state law on its own separate terms.
The enforcement side is already live, not theoretical. The Federal Trade Commission opened a public complaint portal and sent compliance reminders to a long list of major platforms in the weeks before the May 2026 deadline. A platform found to have not reasonably complied is treated as having committed an unfair or deceptive practice under the FTC Act, with civil penalties that can run to $53,088 per violation, a figure from the Commission's own published guidance and not a per-company cap.
What the law does not settle, and what to do this week
None of this is free of real legal uncertainty, and an honest account of the law says so. Civil liberties groups have argued in public, repeatedly, that a mandatory 48-hour window with no built-in counter-notice step pressures platforms to remove lawful content rather than risk missing the deadline, and legal commentators have raised open questions about how the removal duty interacts with Section 230 and the First Amendment. None of that has produced a court ruling, an injunction, or a delay to the deadline as of today, and the Commission is proceeding as though none of it will.
The absence of a formal counter-notice mechanism, the kind DMCA gives to someone whose photo gets pulled on a copyright claim, is a real gap for an operator to plan around rather than ignore. A bad-faith reporter, an ex trying to knock a legitimate ad offline out of spite, or a rival abusing the process, is a real possibility the statute does not solve for. Building an internal review step for disputed removals is the platform's own job, on its own timeline, and it should never be allowed to slow down the 48-hour clock on requests that plainly qualify.
Two things are worth checking this week rather than filing under future work. First, whether the site has a visible way for someone who is not a registered advertiser to report their own photo, reachable without creating an account or logging in anywhere.
Second, whether one page exists anywhere that says who owns this queue, what a request has to contain to count as valid, and what happens in the first hour and the first 48. If that page does not exist yet, the deadline the law set months ago is not a future task. It is already unmet, today, and the clock on the next request that arrives starts the moment it lands, not the moment someone gets around to reading it.
