FTC sets May 19 enforcement clock for the Take It Down Act, with $53,088 per violation on the table

Editor’s Note: Federal enforcement of the Take It Down Act starts May 19, and the Federal Trade Commission spent May 11 making sure 15 prominent technology platforms know it. Chairman Andrew N. Ferguson’s compliance letters — sent to Amazon, Alphabet, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok and X — warn that covered platforms leaving nonconsensual intimate images online past the 48-hour takedown window may face FTC enforcement, including civil penalties of up to $53,088 per violation.

For cybersecurity, information governance and eDiscovery professionals, this is the week content moderation crosses the line from trust-and-safety practice to regulated workflow. Each takedown becomes a system-of-record event. Each duplicate sweep becomes a defensible search. Each removal log becomes a future subpoena target. The Act’s coverage of AI-generated “digital forgeries” pulls synthetic-media response inside the FTC perimeter, and the law’s functional definition of “covered platform” may sweep in business software-as-a-service tools that most operators do not think of as platforms.

Watch the next 30 days for the first FTC inquiry letter, the first First Amendment legal challenge, and how aggressively the agency interprets “reasonable efforts” on duplicate removal. Each will set the operational bar for years to come.

Industry News – Data Privacy and Protection Beat

FTC sets May 19 enforcement clock for the Take It Down Act, with $53,088 per violation on the table

ComplexDiscovery Staff

The Federal Trade Commission has put 15 prominent technology platforms on a one-week clock. After May 19, covered platforms that leave nonconsensual intimate images online beyond the 48-hour window following a valid takedown request may face FTC enforcement, including civil penalties of up to $53,088 per violation.

That penalty figure is the per-violation amount Chairman Andrew N. Ferguson cited in the compliance letters his agency sent May 11 to 15 prominent social media, messaging, video sharing and gaming services operating in the United States — Amazon, Alphabet, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok and X. The mailing closed any doubt that Section 3 of the Take It Down Act will be enforced from day one.

A one-week clock with a five-figure price tag

The Take It Down Act, formally the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, was signed into law by President Donald J. Trump on May 19, 2025. FTC officials credited First Lady Melania Trump’s leadership in support of the law. The criminal provisions of the law took effect immediately. The platform compliance obligations enforced by the FTC under Section 3 carry a one-year runway that closes May 19, 2026.

“We stand ready to monitor compliance, investigate violations, and enforce the Take It Down Act,” Ferguson said in the agency’s May 11 announcement. “Protecting the vulnerable — especially children — from this harmful abuse is a top priority for this agency and this administration.”

The mechanics leave little room for delay. A covered platform that receives a valid removal request must take down the reported intimate photo or video — and any known identical copies — within 48 hours. The FTC will treat a breach of Section 3 as a violation of an FTC rule, and noncompliance may result in civil penalties of up to $53,088 per violation, opening the door to penalty calculations that scale with volume.

What the FTC says compliance looks like

The agency’s plain-language business guidance, last updated May 8 and reinforced by the May 11 letters, sketches a specific architecture. Covered platforms must publish clear and conspicuous notice of how to report nonconsensual content. Depending on platform design, the FTC guidance indicates that this clear and conspicuous notice may need to appear on home pages and wherever intimate content might appear, including posts, messages, comments, livestreams, or other areas. The intake path must be available to people who do not hold an account, because the law’s protections do not stop at the login wall.

Platforms also have to find duplicate copies on their own. A reporter does not have to file a separate request for every reposted version of the same image. The FTC said platforms should make reasonable efforts to detect identical copies and remove them within the same 48-hour window, and it pointed operators toward hashing and hash-sharing resources, including the National Center for Missing and Exploited Children’s Take It Down service for minors, and StopNCII.org for adults, as ways to keep removed content from reappearing across the wider web.

Coverage extends to artificial intelligence. The FTC guidance treats “digital forgeries” — images created or altered using software, mobile applications, or generative AI — as squarely within scope. That language closes a loophole earlier state laws struggled to address and signals that synthetic-media incident response is now an FTC compliance area, not a trust-and-safety afterthought. One operational challenge is that hash-based matching is strongest when platforms have a known reference image; novel AI-generated content may lack that prior fingerprint, which pushes detection toward provenance-watermarking and content-authenticity standards that are still maturing across the vendor stack.

Where moderation, IG and eDiscovery converge

For cybersecurity, information governance and eDiscovery teams, the May 19 deadline is the point at which content moderation stops being a trust-and-safety silo and becomes a regulated workflow with audit obligations. Each takedown is a record. Each duplicate sweep is a search. Each refusal to remove is a defensible decision that may be revisited under FTC inquiry, civil litigation, or law enforcement subpoena.

Practitioners should expect three operational shifts to land at once. First, the system of record for takedown intake, validation and resolution becomes a regulated information asset, with retention schedules and access controls that resemble what privacy teams already maintain for data subject access requests under the California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR). Second, hash-matching infrastructure — already mature in the child sexual abuse material context — moves into a broader adult-victim use case, with implications for vendor selection, model governance, and cross-platform hash sharing. Third, every removal record carries downstream eDiscovery weight; counsel handling defamation, harassment or family-court matters will subpoena these logs, and legal hold processes need to anticipate that.

A separate guidance bullet from the FTC pushes the operational bar higher. Platforms, the agency wrote, “should provide an identifying number for each take down request” so requesters, the platform and law enforcement can confirm they are discussing the same image. That is a ticketing-system mandate in everything but name.

A preservation-versus-removal tension also confronts eDiscovery and incident-response teams and needs to be resolved in advance. The 48-hour clock requires removal from public view. It does not, by its terms, require destruction of the underlying file or its associated metadata, and the statute carries good-faith exceptions for disclosures made for law enforcement investigations and legal proceedings. Counsel handling parallel criminal complaints, civil claims, or internal investigations will want preserved-but-quarantined copies of removed content held under chain of custody, with hash values, timestamps, requester identifiers and removal logs that can survive a later subpoena. Building that workflow into the takedown system before May 19 is materially easier than retrofitting it after the first incident.

Aravind Swaminathan and Jake Heath, partners in the cyber, privacy and data innovation practice at Orrick, Herrington & Sutcliffe, advised clients in a May 21, 2025 alert that platforms should revise moderation workflows to ensure both a 48-hour turnaround and identification and removal of identical copies, audit reporting tools for accessibility, train moderators to distinguish nonconsensual intimate imagery from lawful content, and designate an FTC-facing compliance contact. They wrote that the law does not explicitly require proactive monitoring but that platforms are “well-advised to consider using duplicate detection tools” given the ambiguity of the “reasonable efforts” standard the statute applies to duplicate removal.

The Section 230 fault line

The Take It Down Act does not amend Section 230 of the Communications Decency Act, the federal liability shield that protects interactive computer services from being treated as the publisher of third-party content. The Act sits beside Section 230 and creates a notice-and-removal duty whose breach is enforceable by the FTC regardless of how Section 230 might apply to the underlying content.

That posture has drawn pushback. The Electronic Frontier Foundation said the law’s notice-and-takedown provisions provide few guardrails against false reports and warned that the 48-hour mandate could pressure platforms into removing legitimate speech without a judicial determination. The Center for Democracy and Technology has called for a more carefully constructed takedown system. None of those objections carries weight against the May 19 deadline; the law is in force, and the agency has signaled it intends to enforce it.

Practitioners should also track the cross-Atlantic comparison. The European Union’s Digital Services Act already imposes systemic notice-and-action duties on Europe’s largest online platforms, and Brussels has been advancing additional rules on synthetic content and child safety through both the AI Act’s transparency obligations and a separate proposed Child Sexual Abuse Regulation. The Take It Down Act gives the United States a comparable enforcement hook, narrower in scope but immediate in effect, and it pulls American platform governance closer to the European model than at any point since the General Data Protection Regulation took effect in 2018.

What practitioners should do this week

Inside counsel and compliance leaders at any platform that hosts user-generated content should treat the next seven days as a final readiness window. Map every place intimate content can appear and confirm a notice path exists at each one. Walk a sample takedown request through intake, verification, removal, duplicate detection, requester notification and log retention end-to-end with a stopwatch. Identify the named accountable executive for the program and document escalation paths for borderline submissions. Rehearse the conversation a customer-support representative will have with a non-account holder making a first-time request, because the FTC has explicitly flagged that population.

Cybersecurity professionals whose company runs a community feature, a comments section, or a customer-uploaded media workflow should also assume the law applies until counsel rules otherwise. The Act’s “covered platform” definition is functional, not categorical. If a service “primarily provides a forum for user-generated content or regularly publishes, curates, hosts, or furnishes” the kind of imagery the statute targets, it sits inside the regulatory perimeter. That sweep can pull in business-to-business software-as-a-service vendors with profile photos or document uploads, customer review sites, learning management systems, internal collaboration suites used by external contractors, and dating or marketplace apps that few outside their user base would call “platforms” in the everyday sense. Counsel-led scoping is the only way to know.

Will the May 19 deadline survive the legal challenges that the Section 230 and First Amendment community has telegraphed for months — or will the FTC’s first enforcement action under the new statute become the test case that defines how American platforms moderate nonconsensual content for the next decade?

News sources

• FTC Chairman Ferguson Advises Companies to Comply with the Take It Down Act (Federal Trade Commission)
• Complying With the Take It Down Act (Federal Trade Commission)
• FTC reminds tech platforms of deadline to comply with Take It Down Act (Biometric Update)
• FTC Warns Major Tech Platforms as Take It Down Act Deadline Nears (GRC Report)
• TAKE IT DOWN Act Becomes Law, Introducing Landmark Federal Protections to Combat Online Exploitation and Deepfakes (Orrick, Herrington & Sutcliffe)
• The TAKE IT DOWN Act: A Federal Law Prohibiting the Nonconsensual Publication of Intimate Images (Congressional Research Service)
• Congress Passes TAKE IT DOWN Act Despite Major Flaws (Electronic Frontier Foundation)
• NDII Victims Deserve Help. Let’s Build an Effective Takedown System. (Center for Democracy and Technology)
• Text – S.146 – 119th Congress (2025-2026): TAKE IT DOWN Act (Congress.gov)

Assisted by GAI and LLM Technologies

Additional reading

• The Data Sovereignty Vise: Two Governments, One Compliance Trap, No Safe Harbor
• The EU’s E-Evidence Framework Goes Live in August and Most of Europe Isn’t Ready
• We Wanted Smarter Legal Tech, but Instead Got an Expensive Dependency
• The AI Sanction Wave: $145K in Q1 Penalties Signals Courts Have Lost Patience with GenAI Filing Failures
• FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
• White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
• The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.