US federal law: the TAKE IT DOWN Act and what else applies
The United States has no comprehensive federal privacy law that gives everyone a right to have personal data deleted. The TAKE IT DOWN Act is narrower. Since 19 May 2026, covered platforms must remove intimate images published without consent, including AI-generated ones, within 48 hours of a valid request. The Federal Trade Commission enforces that duty. Wider deletion rights come from state laws such as California's.
- Written by
- UltoPulto Editorial
- Published
- Last reviewed
General information, not legal advice. This page has not yet been reviewed by a lawyer; check the linked primary sources before relying on it.
Key takeaways
- Covered platforms must remove a nonconsensual intimate image, and known identical copies, within 48 hours of a valid request.
- The Act covers real images and digital forgeries, including images created or altered with AI.
- You or an authorised person can make the request. The FTC enforces the duty and takes reports at TakeItDown.ftc.gov.
Who is protected?
The TAKE IT DOWN Act, signed on 19 May 2025, protects an identifiable individual: a person who appears in whole or in part in an intimate visual depiction and whose face, likeness or other distinguishing characteristic is displayed with it. It covers adults and minors. The FTC says its protections are not limited to people with an account on the platform.
The removal duty applies to covered platforms: websites, online services and apps that serve the public and primarily provide a forum for user-generated content, or that regularly publish or host nonconsensual intimate images. Broadband providers and email are excluded.
What rights do you have?
- Removal. A covered platform must provide a process for you to report an intimate image published without your consent and ask for its removal.
- Copies. The platform must make reasonable efforts to find and remove known identical copies.
- Criminal protection. Knowingly publishing a nonconsensual intimate image or digital forgery of an identifiable person through an online service is a federal crime when the Act's conditions are met. Threatening to do so can be one too.
What else applies
There is no general federal right to see or delete the personal data companies hold about you. The FTC acts against unfair or deceptive practices and enforces sector laws such as the Children's Online Privacy Protection Act and the Fair Credit Reporting Act. Deletion rights for most consumer data come from state law. See California and Illinois.
How do you use them?
- Find the platform's notice about removing nonconsensual intimate images. The Act requires it to be clear, conspicuous and in plain language.
- Submit a written request with your physical or electronic signature, or that of an authorised person acting for you.
- Identify the image, give enough information for the platform to find it, and state briefly your good-faith belief that it was published without your consent.
- Give contact details, and record the date and time you submitted.
Deadlines and enforcement
On receiving a valid request, the platform must remove the image as soon as possible and no later than 48 hours afterwards. Platforms had until 19 May 2026, one year from enactment, to set up the process.
A failure to reasonably comply is treated as a violation of an FTC rule. FTC guidance from May 2026 says enforcement could result in civil penalties of $53,088 per violation. You can report a platform to the FTC if it misses the 48 hours, if you cannot find its removal process, or if the process is broken. You can also report for your child, or for someone else with their permission.
The criminal provisions carry up to 2 years in prison for offences involving adults and up to 3 years for offences involving minors.
How this applies to AI and face data
The Act covers digital forgeries: intimate depictions of an identifiable person created or altered with software, machine learning or AI that a reasonable person would find indistinguishable from an authentic image. It does not cover deepfakes or impersonation that are not intimate, and it does not deal with face-search engines, data brokers or AI training data.
The FTC has used its general powers in cases about face data. In a 2021 settlement with Everalbum, it required deletion of facial recognition models and algorithms developed with users' photos. In 2023 it banned Rite Aid from using facial recognition for five years and required deletion of images and of algorithms developed from them.
Those were terms of FTC orders against particular companies. They are not a right an individual can invoke, and no service can remove a person from a trained AI model on request.
What you can do yourself
These steps are free and do not need UltoPulto.
- Use the platform's own removal process for nonconsensual intimate images. A valid request made that way starts the 48-hour clock, so keep a copy and note the time.
- If the platform does not act, report it to the FTC at TakeItDown.ftc.gov.
- Report the person who published the image to local law enforcement or the FBI.
- For other personal data, check your state's law with the privacy rights finder.
What UltoPulto can do
- Prepare formal takedown notices to platforms for deepfakes, intimate images and impersonation, including notices that rely on the 48-hour duty under the TAKE IT DOWN Act.
- Send removal requests to people-search and data-broker sites, written for the law that applies where you live.
- Keep an evidence trail of each request, timestamp, reply and status.
- Deliver requests only to contacts our team has verified. Until then a request stays a draft.
- Monitoring platforms for fake accounts and synthetic media. Today you report what you find and we prepare the notice.
What UltoPulto cannot do
- We are not a law firm and do not give legal advice.
- No service can remove a person from an AI model that has already been trained.
- Outcomes depend on the organisation and the regulator. Only the FTC can enforce the 48-hour duty against a platform.
- The Act covers intimate imagery. A notice about another kind of deepfake or impersonation relies on the platform's own rules or on other law.
Sources
- 1TAKE IT DOWN Act, Public Law 119-12 (S. 146), approved 19 May 2025United States Congress (Congress.gov)
- 2Complying With the Take It Down ActFederal Trade Commission
- 3What will the FTC's enforcement of the TAKE IT DOWN Act mean for you?Federal Trade Commission, Consumer Advice
- 4FTC Begins Enforcing the TAKE IT DOWN ActFederal Trade Commission
- 5Privacy and Security (business guidance)Federal Trade Commission
- 6Internet Privacy: Additional Federal Authority Could Enhance Consumer Protection and Provide Flexibility (GAO-19-52)U.S. Government Accountability Office
- 7California Company Settles FTC Allegations It Deceived Consumers about use of Facial Recognition in Photo Storage AppFederal Trade Commission
- 8Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable SafeguardsFederal Trade Commission
Questions
Does the TAKE IT DOWN Act cover AI-generated deepfakes?
Yes, when they are intimate and a reasonable person would find them indistinguishable from an authentic image. The Act calls these digital forgeries.
Who can send a removal request?
The person shown in the image or an authorised person acting on their behalf. The request must be in writing, signed, and include the information the Act lists.
What if a platform ignores the 48-hour deadline?
You can report it to the FTC at TakeItDown.ftc.gov. The FTC treats a failure to reasonably comply as a rule violation and can seek civil penalties.
Is there a federal right to delete my data from data brokers?
There is no general federal deletion right. Some states provide one. California residents, for example, can use the CCPA and the state's DROP platform.