Governance, risk & compliance

TAKE IT DOWN Act (Pub. L. 119-12), platform notice and removal Pub. L. 119-12, 19 May 2025; section 3 duties from 19 May 2026

The Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, Public Law 119-12, was approved on 19 May 2025.

Section 2 makes it a federal crime to knowingly publish, using an interactive computer service, certain nonconsensual intimate visual depictions, including 'digital forgeries' made with software or artificial intelligence, and applies to people rather than platforms. Section 3 applies to 'covered platforms': a public-serving website, online service or application that primarily provides a forum for user-generated content (messages, videos, images, games, audio), or that regularly publishes, curates, hosts or makes available nonconsensual intimate depictions.

Broadband internet access providers and email are excluded, as is a service made up mainly of provider-preselected content whose chat or comment features are incidental (s. 4(3)).

Not later than one year after enactment, that is by 19 May 2026, a covered platform must (1) set up a process for an identifiable individual, or an authorized person, to notify it of an intimate depiction published without consent and ask for removal, with a signature, enough information to find the content, a good faith statement and contact details (s. 3(a)(1)); (2) post a clear and conspicuous plain-language notice of that process (s.

3(a)(2)); and (3) on a valid request, remove the depiction as soon as possible and no later than 48 hours after receiving it, and make reasonable efforts to find and remove known identical copies (s. 3(a)(3)).

Good faith removal is protected from liability (s. 3(a)(4)).

The FTC enforces it as a violation of a rule on unfair or deceptive acts or practices, including against nonprofits (s. 3(b)).

The FTC published compliance guidance on 8 May 2026, said enforcement would begin once section 3 took effect, and on 20 May 2026 announced warning letters to 12 companies offering 'nudify' tools. The FTC has cited civil penalties of up to $53,088 per violation.

The Act protects minors and adults alike. It does not itself require hashing or proactive scanning; the FTC recommends hashing as good practice.

General information, not legal advice.

How Lavawall® helps you get to TAKE IT DOWN Act (Pub. L. 119-12), platform notice and removal compliance

Most of TAKE IT DOWN Act (Pub. L. 119-12), platform notice and removal comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to TAKE IT DOWN Act (Pub. L. 119-12), platform notice and removal, and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against TAKE IT DOWN Act (Pub. L. 119-12), platform notice and removal in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports TAKE IT DOWN Act (Pub. L. 119-12), platform notice and removal as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.