The Take It Down Act has been federal law for just over a year. The criminal provisions went live the day President Trump signed it in May 2025. The civil notice-and-takedown regime went live exactly one year later, on 19 May 2026. We are now a month into the second phase, and the picture is clearer than it was even three months ago. Here is what creators need to know about what the law actually does, what has happened in year one, and what to do with it.
What the Act actually requires
The Take It Down Act has two pieces. The criminal piece makes it a federal crime to knowingly publish a non-consensual intimate image or a sexually explicit deepfake of an identifiable real person, with up to two years in prison for adult victims and three years for minors. The civil piece requires "covered platforms" to remove a reported NCII image within 48 hours of receiving a valid written request from the victim, and to make reasonable efforts to remove identical copies. The enforcement authority sits with the Federal Trade Commission, with civil penalties of up to $53,088 per violation.
A "covered platform" under the Act is broad. It includes any service that primarily hosts user-generated content (almost every social network, every leak site, every Telegram channel running on a publicly accessible web frontend, every Discord server that publishes channel content publicly) and any service that "regularly publishes, curates, or hosts" NCII. Read the statute carefully: leak sites are explicitly in scope.
Year one in enforcement
The first 12 months looked very different on the criminal side and the civil side.
On the criminal side, the first conviction landed quickly. James Strahler II of Columbus, Ohio pleaded guilty on 7 April 2026 to cyberstalking, producing CSAM, and publishing digital forgeries under the Act. The case was a worst-case combination of charges that would have prosecuted regardless of the new law. It established the Act has teeth in extreme scenarios but did not test the standard takedown enforcement path.
On the civil side, the picture is more cautious. FTC Chair Andrew Ferguson stood up takeitdown.ftc.gov for complaints in May 2026 and sent demand letters to more than a dozen platforms on the same day. As of mid-June 2026, no civil penalty has been announced against any platform. The FTC has signalled intent without yet showing teeth. Privacy and civil-liberties organisations (the EFF and the Center for Democracy and Technology) have argued the statute is broad enough to enable censorship rather than focused enforcement, and the FTC under the current administration is being watched closely.
The honest read is that the civil prong is on a slow ramp. The first one or two penalty actions will set the tone for what platforms actually comply with. Until then, the strongest leverage comes from the implicit threat of FTC action rather than the FTC itself.
The 48-hour clock and what it means for creators
The civil piece gives victims a tool that did not exist a year ago. If you find your intimate content on a covered platform, you can send a written removal request. The platform must remove it within 48 hours of receiving a valid request. If they refuse, the FTC may treat that as a rule violation.
In practice the 48-hour clock works best on US-based platforms with established legal teams. It works less well on offshore leak sites that ignore most takedown notices regardless of the law. For those, the standard DMCA escalation playbook (host, CDN, registrar, payment processor) remains the more reliable lever. The Take It Down Act gives you an additional argument when filing, but it does not magically make non-compliant sites compliant.
The bigger practical impact is on platforms that historically dragged their feet. Reddit, Discord, and even Telegram (which has been increasingly responsive in 2026 under separate regulatory pressure) now have a clear federal rule to point at. That changes the conversation.
What evidence creators should keep on file
The Act creates a safe harbour for platforms that act in good faith on takedown requests. Counsel guidance from multiple law firms has been consistent: platforms must maintain auditable records of every request received and every removal action. That obligation sits with the platform, not the creator. But the creator-side mirror of that obligation matters too.
If you intend to use the Act, keep your own audit trail. For each piece of content you report, save: the URL where it appeared, a screenshot or archive copy (use archive.today or a forensic capture tool, not just a regular screenshot), the date and time you first identified the content, the date and time you sent the takedown request, the platform's acknowledgement (if any), and the eventual removal status. This is the evidence package you need if you ever want to escalate to the FTC or pursue civil action.
For creators who file dozens or hundreds of takedowns a year, doing this manually is impossible. A protection service that maintains this audit trail automatically as a by-product of normal operations becomes valuable independent of removal speed. Privly's per-finding audit trail is built specifically to function as this evidence layer, because the civil enforcement question is likely to become more salient over the next 12 months rather than less.
How the Act interacts with DMCA
The Take It Down Act and the DMCA are complementary, not redundant. DMCA is a copyright tool. The Take It Down Act is an image-abuse tool. Both apply to most leak scenarios because most creator leaks involve both unauthorized copying (copyright) and non-consensual distribution of intimate imagery.
The practical play in 2026 is to file under both. The DMCA notice gives platforms the safe-harbour-compliance reason to act. The Take It Down Act notice adds the federal NCII overlay. Together they remove the standard "we don't believe this is your content" objection that some non-compliant sites use to stall. Privly's auto-filing includes both citations when applicable, which has measurably improved response rates from US-based platforms over the last six months. For the full DMCA mechanics, see the DMCA takedown master guide.
How Privly helps
Three concrete things, all already shipped.
First, Privly is a registered DMCA Designated Agent with the US Copyright Office (registered as Privly Takedown Service / dmca@useprivly.com in April 2026). That gives us legal standing to file on behalf of creators across both DMCA and Take It Down Act regimes, with our agent identity on the public record instead of yours.
Second, every Privly takedown carries a full audit trail: the URL detected, the platform contacted, the legal basis cited (DMCA, Take It Down Act, or both), the response, and the resolution. Creators can export this audit pack on demand for any case they want to escalate.
Third, we monitor the platforms most likely to be in scope of the Act (US-based services with covered-platform status) and we file under the dual basis whenever applicable. Creators do not need to know which legal regime applies to which platform: Privly handles the routing.
What to watch in year two
Three signals are worth tracking over the next 12 months.
The first FTC civil action will set the enforcement tone. If the FTC issues a penalty against a non-compliant platform in 2026, expect a wave of compliance overhead across the industry. If 18 months pass with no civil action, the Act will continue to function more as a signalling tool than an enforcement tool.
Constitutional challenges are nearly certain. The Act's broad scope, particularly around deepfake content, will be litigated. The First Amendment defence the EFF and CDT raised is real, and a circuit court could narrow the Act's application substantially.
State-level analogues are proliferating. Virginia, New York, California, and Tennessee have or are passing their own NCII-specific laws with longer takedown windows but tighter penalties. The interplay between federal and state laws will shape what platforms must do.
The bottom line
The Take It Down Act is real law with real consequences, but its civil prong is still finding its enforcement footing. Use it now as a signal-amplifier on top of DMCA, build your audit trail expecting it to matter more in 18-24 months, and stay aware that the constitutional litigation could narrow it. Creators who treat it as the new floor of takedown leverage (rather than a magic bullet) are positioned correctly. If you're actively affected by NCII or a deepfake right now, Privly runs a free NCII assistance program that helps with the Take It Down Act filings alongside the traditional DMCA route.
