Forcing a platform to remove an intimate image of you

The Act is Public Law 119-12, signed on 19 May 2025. Section 3 gave covered platforms one year to build the removal process. That year has run out: the duty became enforceable on 19 May 2026, and the Federal Trade Commission opened enforcement the same week. What follows is what it obliges a platform to do, and what it does not.

Which sites owe you the duty, and which do not

The Act calls them covered platforms, and the definition has two limbs. A site serving the public qualifies if it primarily provides a forum for user-generated content — messages, videos, images, games, audio — or if it is in its regular course of business to publish, curate, host or make available non-consensual intimate depictions. The second limb exists so a site built around this material cannot argue it is not a social network.

Three things are excluded outright: broadband internet access providers, electronic mail, and services consisting mainly of content the provider selected rather than users posted, where any chat function is incidental to it. A streaming service with a comment box escapes the first limb, not the second.

Preserve the evidence before you ask for removal

This is the step people skip, and the only one that cannot be repeated. A successful request destroys the record: the URL stops resolving, the account may go with it, and what you would need to identify whoever posted it is gone. Capture first, then send.

A short dated statement of what you saw and when, as a signed affidavit, is worth more later than a folder of undated screenshots, and is hard to reconstruct months afterwards.

What a valid request must contain

Section 3(a)(1)(B) lists four elements and requires them in writing. It is a short list — shorter than the six-element notice the DMCA requires for copyright, and with no statement under penalty of perjury.

That last element is the hardest part of the mechanism, and it deserves stating plainly. To make a platform act, you have to tell it who you are and how to reach you — sometimes a service you have no reason to trust. The statute does not require you to prove your identity: no ID upload, no selfie, no notarisation appears anywhere in section 3. But nothing forbids a platform from asking, and because Congress gave platforms no protection against false requests, several have built verification of their own. That is where requests stall.

Two practical responses. An authorised person may submit on your behalf, so a lawyer or advocacy organisation can be the contact point instead of you. And where a platform's report button has no field for a signature or a good-faith statement, use it and also send the four elements in writing — an ordinary report may not be a statutory request, and the clock starts only when a valid one arrives.

Sending the request

1. 1

   Capture the evidence

   Screenshots, permalinks, account details and the date you saw them. Removal deletes the record, so this cannot be done afterwards.

2. 2

   Find the platform's posted process

   Section 3(a)(2) requires a clear and conspicuous notice of the process, in plain language, on the platform. If there is none, record that — the absence is itself a failure to comply.

3. 3

   Submit through that process, carrying all four elements

   The duty attaches to a valid request made through the published process. A direct message to a support account is not it.

4. 4

   List every location you know of

   The extra duty covers known identical copies. Copies you know about and do not name may not be within the platform's knowledge at all.

5. 5

   Record the timestamp and count 48 hours

   Keep the confirmation, the reference number and the time of submission. The timestamp is what makes a missed deadline provable.

The 48-hour clock, and what "known identical copies" means

Section 3(a)(3) is unusually direct. On receiving a valid request, a covered platform shall, "as soon as possible, but not later than 48 hours after receiving such request", remove the depiction and "make reasonable efforts to identify and remove any known identical copies of such depiction". Forty-eight hours, not two business days, and not from when a human reads it.

The second half carries two limits. Known means the platform is not obliged to search the wider internet — the duty is about its own service and what it is aware of, which is why naming every URL matters. Identical means exactly that: a copy that has been cropped, recompressed or filtered may not match. Platforms handle this with hash matching, and hash matching is defeated by small edits.

AI-generated images are covered on the same terms

This is why the Act exists and why most people search for it. The definition added at 47 U.S.C. § 223(h)(1)(B) covers any intimate visual depiction of an identifiable individual "created through the use of software, machine learning, artificial intelligence, or any other computer-generated or technological means, including by adapting, modifying, manipulating, or altering an authentic visual depiction", which viewed as a whole by a reasonable person is indistinguishable from an authentic depiction.

The structure of that sentence settles a question people ask: a digital forgery is defined as a *kind of* intimate visual depiction, not a separate category beside it. Section 3 speaks about intimate visual depictions, so the removal process reaches synthetic material without needing to say so. The FTC has read it the same way, writing in May 2026 to companies operating tools that generate this material about their own obligations.

Who enforces this, and why it is not you

Section 3(b)(1) makes a failure to reasonably comply with the notice and takedown obligations "a violation of a rule defining an unfair or a deceptive act or practice" under section 18(a)(1)(B) of the FTC Act, 15 U.S.C. § 57a(a)(1)(B). The Commission enforces it with its ordinary powers, and section 3(b)(2)(D) extends its reach to non-profits it could not otherwise touch. Civil penalties run per violation and are adjusted for inflation annually, so treat any figure you read as a snapshot.

What that means for an individual, said plainly: there is no private right of action. If a covered platform ignores your request, misses the 48 hours, or removes one copy and leaves three, you cannot sue it for that. Your route is a complaint to the FTC, and the FTC decides whether to act. One well-documented complaint rarely produces a case; a pattern across many does.

What you can do alone is aimed at a different defendant. A separate statute, 15 U.S.C. § 6851, lets a person whose intimate visual depiction was disclosed without consent sue whoever disclosed it, recovering actual damages or liquidated damages of $150,000 plus costs and legal fees, and a court may allow the claim under a pseudonym. Whether it reaches digital forgeries is genuinely unsettled — Congress did not extend it explicitly here — so ask a lawyer rather than assuming either answer.

The criminal provisions sit at 47 U.S.C. § 223(h) and are brought by prosecutors, not by you. Publishing an authentic depiction or a digital forgery of an adult carries up to two years; where the subject is a minor, up to three. Threatening to publish is separately punishable, and a court must order restitution on conviction — the one place the criminal route produces money for the person harmed.

The routes that run alongside it

The statutory request is the fastest lever, but not the broadest. Platform policies on this material are usually wider than the statutory definition, and the Act has no preemption clause, so state law runs concurrently — every state and the District of Columbia has some form of non-consensual imagery law, though many were written before synthetic images and do not clearly cover them.

Where one person keeps reposting, a cease and desist letter does what the removal request cannot: it names them and records continued conduct after warning. It is also worth knowing what a defamation claim covers, since a fabricated image usually arrives with fabricated statements, governed by different rules.

What the mechanism gets wrong, and why it affects you

The criticism of this process has practical consequences for the person using it. Section 3(a)(4) protects a platform from liability for good-faith removal "regardless of whether the intimate visual depiction is ultimately determined to be unlawful or not". Over-removal is therefore cheap and under-removal expensive — the incentive the drafters wanted, and what worries the Act's opponents.

The Electronic Frontier Foundation's objection is that 48 hours is "rarely enough time to verify whether the speech is actually illegal", and that smaller services will depublish rather than assess. Unlike the DMCA, this statute has no certification under penalty of perjury, no liability for a knowing misrepresentation, and no counter-notice or restore window for someone wrongly removed.

The consequence for a genuine victim is not abstract. Because the statute hands platforms nothing to deter false claims, some have answered with gatekeeping of their own — identity checks, document uploads, manual review queues — friction imposed on the people the law was written for. Knowing that the four statutory elements are the actual legal requirement, and anything beyond them is platform policy, is the difference between accepting a stalled request and pushing back on one.

The part you control

What the Act contributes is a deadline and a form. It does not decide whether the platform believes you, whether every copy is findable, or what happens to the person who posted it — those fall to the FTC, a prosecutor, a court, or a moderator you will never speak to.

What you control happens before you press send: the evidence captured while it still exists, the four elements in writing, every URL you know of named in one place. Do that properly and the 48 hours becomes the platform's problem rather than yours. It is a small amount of control in a situation with very little, which is why it is worth taking seriously.