TAKE IT DOWN Act: A Compliance Checklist for Platforms

By Andrew R. Jacobs, Esq. | Founder & Managing Attorney, Jacobs Counsel LLC | Director, Sports, Entertainment & Gaming Initiatives, Seton Hall University School of Law | Super Lawyers Rising Star 2026

The TAKE IT DOWN Act is now an operational compliance issue for covered platforms. The May 19, 2026 deadline has passed, and the FTC has begun enforcing the platform notice-and-removal requirements. A policy statement is useful only if a request reaches people who can act on it.

This guide is for founders, product leaders and legal teams operating apps, online communities, messaging services and other platforms with user content. It focuses on platform obligations, including content created or altered with AI. It is not a guide to bringing an individual damages claim.

What is in effect now?

The FTC's enforcement announcement confirms that Section 3 enforcement began May 19, 2026. The agency also opened a reporting site for people whose requests are not handled properly. This is an existing requirement, not a future September deadline.

Section 3 addresses covered platforms' notice and removal duties. The Act separately contains criminal provisions concerning certain publications and threats. A platform response process should not require a person to obtain a criminal conviction before the business evaluates a valid request.

Does your app or website qualify as a covered platform?

Start with how the product actually works. The definition covers public-facing websites, services and apps that primarily provide a forum for user content, or that regularly publish, curate, host or make available nonconsensual intimate depictions in the course of business.

The statute excludes broadband access providers and electronic mail. It also contains a conditional exclusion for services primarily offering provider-selected content with only incidental, related or dependent interactive features. That exclusion does not override the regular-business category described above. Review the full Act, particularly Sections 3 and 4.

A product's label does not settle coverage. Describe what users can upload, generate, share, message and repost; where that material is stored; and which company operates each feature. For a mixed product, have counsel evaluate those functions together instead of assuming that a business-to-business audience, small team or AI feature determines the answer.

What must a removal request contain?

The statutory process calls for a written request with four elements: a physical or electronic signature from the depicted person or an authorized representative; enough information to identify and locate the depiction; a brief good-faith statement about the lack of consent, with relevant information; and contact information for the requester.

Use those elements to evaluate the form and triage instructions. The law also requires a clear, conspicuous, plain-language notice explaining the process and the platform's responsibilities. A generic contact page may not communicate enough for someone to use it.

What does the 48-hour requirement mean in practice?

The platform must act as soon as possible, with a 48-hour outer limit after receiving a valid request through its process. The duty includes removal of the reported depiction and reasonable efforts to identify and remove known identical copies. Read the operative language in Section 3; it is not a rule limited to the single URL submitted.

The FTC's business guidance addresses real intimate images and digital forgeries, and recommends ways to make requests accessible, trackable and easier to resolve. People without an account also need a usable route to request removal.

Assign a primary owner and backup who can reach moderation, engineering and legal support. Test receipt and escalation outside ordinary office hours. A Friday evening request should not sit unnoticed until a Monday meeting.

📥 Free Download: The Startup Legal Playbook

Compare legal support models and prepare your growing company for contracts, funding and recurring legal work.

A practical platform compliance checklist

The evidence column is our suggested preparation tool, not a list of forms mandated by the statute. Record what your process actually does and the points that remain unresolved.

What is required, and what is an implementation recommendation?

Keep statutory duties separate from useful operating choices. The FTC recommends request identifiers and status updates. It also discusses technologies such as hashing to help prevent removed content from reappearing. Those recommendations should inform the design without being described as a statutory requirement to buy a particular tool.

The FTC's May 2026 platform letter is a useful reference for these expectations. A vendor's claim that its product supports compliance still needs to be tested against your platform's permissions, content locations and response process.

Use synthetic test records and harmless placeholders for exercises. Restrict access to real reports and do not ask staff to download or circulate sensitive imagery in ordinary chat or email. Legal and security teams should decide how evidence, preservation duties and deletion requirements fit together.

What to prepare for a legal review

Bring a description of the product, its user-content features, the entities operating it, current terms and privacy notices, the reporting form, moderation procedures and relevant vendor agreements. Include a walkthrough of one hypothetical request from receipt to closure.

Counsel can then assess coverage, notice language, request requirements, responsibility gaps and related obligations. Where a live request or regulator communication already exists, identify it promptly through an appropriate secure channel; avoid placing intimate images in a general inquiry.

Questions platform teams ask about the TAKE IT DOWN Act

Is the TAKE IT DOWN Act only about AI deepfakes?

No. The platform requirements address covered nonconsensual intimate imagery, including authentic images and qualifying digital forgeries. An AI feature is not the only reason to evaluate coverage.

Does every website need the same removal process?

No. The first question is whether the service is a covered platform under the statutory definition and exclusions. A product-specific assessment should come before copying another company's policy.

Is the deadline 48 business hours?

The statute says 48 hours after receipt of a valid request, with action as soon as possible. Build the response process around elapsed hours, including weekends and holidays.

Does adopting a template policy establish compliance?

No. A notice must be supported by a working process for receiving and evaluating requests, taking required action and addressing known identical copies. The legal and operational review should cover both.

Review the process your platform will actually use

Jacobs Counsel can review the product and proposed process, subject to conflicts and engagement. Explore outside counsel for growing companies, read about structuring an AI startup's legal team, or discuss platform compliance.

Sources checked September 17, 2026. General information, not legal advice. The appropriate scope depends on the platform, facts and applicable law.

Need Legal Support?

We help high-performing creators, athletes, and founders protect their brands and build sustainable businesses.