The Federal Trade Commission has moved from rulemaking to active enforcement under the TAKE IT DOWN Act, signaling that covered online platforms must now operationalize compliant procedures for handling non-consensual intimate imagery. On May 19, 2026, the Commission began enforcing Section 3 of the Act, which requires covered platforms to maintain a clear notice-and-removal process and to remove validly flagged non-consensual intimate imagery within 48 hours of receiving a qualifying report.
The following day, May 20, 2026, Chairman Ferguson issued warning letters to a slate of the largest online services, including Alphabet, Amazon, Apple, Meta, Microsoft, TikTok, X, and other major platforms, urging immediate compliance with the statutory obligations. While framed as warnings rather than formal enforcement actions, the letters underscore the Commission's expectation that covered entities have functioning takedown workflows in place now, not at some future implementation date. Platforms that have not yet stood up dedicated intake channels, triage criteria, and removal mechanisms should treat the letters as a clear signal of imminent scrutiny.
The financial stakes are significant. Non-compliance can trigger civil penalties of up to $53,088 per violation, a figure that scales rapidly given the volume of content moderation decisions modern platforms make each day. For in-house counsel, the practical implications extend well beyond drafting a policy. Companies should evaluate whether their notice-and-removal pages are accessible and intelligible to ordinary users, whether intake forms capture the information needed to validate a report, whether trust and safety staffing supports the 48-hour removal window around the clock, and whether documentation practices will withstand regulatory review.
Counsel should also confirm that escalation paths exist for ambiguous reports, that recordkeeping captures the timing of each step from receipt to removal, and that vendor or contractor arrangements supporting moderation are aligned with the statutory deadlines. Cross-functional coordination among legal, product, engineering, and trust and safety teams will be essential to translate the statute's requirements into auditable operational practice.
Given the rapidly evolving enforcement landscape and the fact-specific nature of compliance obligations, clients should seek tailored legal advice regarding their particular platforms, products, and risk profiles before relying on the general guidance discussed above.