How to Get Intimate Images Removed — The 48-Hour Rule, Step by Step

If an intimate image or video of you has been posted without your consent, there is now a federal removal right in the United States with a deadline attached to it, and most people affected do not know it exists.

The TAKE IT DOWN Act creates a notice-and-removal duty for covered platforms. The Federal Trade Commission began enforcing Section 3 of it on 19 May 2026. This page sets out what the law actually requires, read from the FTC's own compliance guidance, and how to use it.

This is a description of published law, not legal advice. If the situation involves a minor, threats, or extortion, it is a criminal matter first — the reporting routes are at the end of this page and they should come before anything else here.

What a platform now owes you

The FTC's compliance guidance for businesses is the clearest statement of the duty, and it is worth knowing in the platform's own terms rather than yours.

A process must exist, and it must be easy to find. Platforms must provide plain-language information about their notice and removal process, including how to submit a request, and that notice must be "clear and conspicuous". The FTC goes further in what it expects: a notice on the home page and wherever intimate content might appear, and ideally a way to submit a request directly from the photo or video.

48 hours, including the copies. On a valid request the platform must remove the content and make reasonable efforts to identify and remove any known identical copies within 48 hours. The FTC states this explicitly: "People who file a request to remove an intimate image do not need to report duplicate images." You report the one you found; finding the rest is their job.

You do not need an account. In the FTC's own words, "TIDA's protections are not limited to individuals who hold an account on your platform" — and it instructs platforms to consider how people without an account can submit a request.

It covers AI images. The Act reaches "digital forgeries" — images that were digitally created or altered using software, an app, or artificial intelligence — as well as real photographs. A deepfake is squarely within scope.

It applies broadly. "Covered platform" reaches websites, apps and online services including social media, messaging, image or video sharing and gaming platforms, and any business that "primarily provides a forum for user-generated content or regularly publishes, curates, hosts, or furnishes intimate content shared without consent."

Non-compliance is enforceable. A violation of the Act is treated as a violation of an FTC rule, and the FTC's guidance states that platforms may face civil penalties of $53,088 per violation. Civil penalty maxima are adjusted annually for inflation, so read that as the figure published on that page rather than a fixed one.

How to make a request

Work in this order. It is the order that produces a record you can escalate with.

1. Capture the evidence before you report it. The exact URL of the page and, where possible, of the media file itself. A screenshot showing the content in place, with the URL bar visible. The date and time. Do this first — content sometimes moves before a platform acts on it, and a report you cannot substantiate is a report that stalls.
2. Find the platform's removal process. Since 19 May 2026 it is supposed to be clear and conspicuous — check the home page footer, the help centre, and the options attached to the content itself. If a covered platform has no findable process at all, that absence is itself the compliance failure, and it is worth noting in your report to the FTC.
3. Submit the request through that process, not by email. Use the platform's own channel where one exists; it is the one that starts the 48-hour clock and the one the platform's records will show.
4. Ask for the tracking number. The FTC tells platforms to "provide an identifying number for each take down request" so that the requester, the platform and law enforcement are all discussing the same image and request. If you are not given one, ask.
5. Report the one you found, not all of them. You are not obliged to hunt duplicates. The reasonable-efforts duty to find and remove known identical copies is the platform's, inside the same 48 hours.
6. Diarise 48 hours. Note the exact time you submitted. If the deadline passes with the content still up and no explanation, you have a specific, dated failure rather than a general complaint — and that is what an enforcement report needs.
7. Escalate. If the platform does not comply, report it to the FTC. Enforcement depends on the agency knowing which platforms are failing, and a dated report with a tracking number and a missed deadline is worth far more than a description.

Two things to do alongside the request

Ask about hashing. The FTC encourages platforms to use hashing to stop content reappearing after removal, and to share hashes with the National Center for Missing and Exploited Children's Take It Down service for imagery involving people aged 18 and over, so that other platforms can block the same content. A takedown that removes one copy from one site is worth much less than one that prevents the reappearance. It is a reasonable thing to ask a platform whether it does.

Do not pay anyone who contacts you offering to fix it. Unsolicited "removal services" and "recovery" offers that arrive after this kind of incident are a documented second run at the same victim. This pattern, and how to recognise the approach that led to the images in the first place, is covered in how to spot sextortion and romance scams.

If this involves threats, money, or anyone under 18

Stop here and treat it as a criminal matter first.

• A minor is involved, or you are unsure of the age. Contact the National Center for Missing & Exploited Children directly. This is not a content-moderation question.
• Someone is demanding money or anything else in exchange for not publishing. That is extortion. Report it to the FBI's Internet Crime Complaint Center and do not pay — payment reliably produces further demands rather than ending them.
• Outside the United States. TIDA is US law and reaches platforms rather than every corner of the internet. Your national police service and your data-protection authority are the two starting points, and several jurisdictions have their own image-abuse offences. The broader map is in adult laws around the world.

When the platform is offshore or simply does not answer

TIDA binds covered platforms, and a site that sits outside US jurisdiction and ignores you is a different problem. It is not a hopeless one, but the pressure has to come from somewhere other than the site itself. In rough order of how often each works:

• The host. Almost every site is hosted by somebody with an abuse policy and a legal department, and hosts respond to well-documented reports far more reliably than the sites they host. A WHOIS or IP lookup usually names them.
• The registrar. The company the domain was bought from has its own abuse contact and its own terms.
• The payment processor and the advertising network. A site that takes money or sells ads has a commercial partner with compliance obligations, and those partners are typically far more responsive than the site.
• Search de-indexing. Removal from search results is not removal from the internet, but it changes who finds the content in practice — which for most people is the outcome that actually matters. Major search engines run their own request processes for nonconsensual intimate imagery.
• The hash databases. Getting the content hashed and shared, as described above, is what stops it reappearing somewhere new after you have won one takedown.

Work several of these in parallel rather than in sequence. Each is a separate organisation with a separate queue, and the one that moves first is rarely the one you expected.

Keep a record of everything, from the first minute

This is the part people skip while distressed, and it is the part that decides whether an escalation goes anywhere. Keep one file with:

• Every URL, captured with a screenshot showing the address bar
• The exact date and time of each removal request
• The tracking number the platform gave you, or a note that it refused to give one
• Every reply, in full, including automated acknowledgements
• The date and time the 48-hour deadline fell, and what was still up at that point

A regulator report built from that file is a specific, dated allegation. Without it, the same events become a description — and descriptions do not get enforced.

What this law does not do

Being straight about the limits matters more here than anywhere else on this site.

• It does not reach every site. TIDA binds covered platforms; a site hosted outside US jurisdiction that ignores the request is a harder problem, and the practical route there is usually the host, the registrar, the payment processor and search-engine de-indexing rather than the site itself.
• It does not undo distribution. Removal within 48 hours is a great deal better than nothing and it is not the same as the content never having existed. Hashing and cross-platform sharing exist precisely because of that gap.
• It is not a private right of action. Section 3 is enforced by the FTC. Your route to pressure is the platform's own process and then a regulator report — which is exactly why the tracking number and the dated deadline matter so much.

Why this is on an adult review site

Because the platforms we write about are covered platforms, and because a site that reviews adult services and stays silent about the removal right is being useful to the industry rather than to its readers.

The same reasoning is behind our guide to how to cancel an adult subscription, our page on how to spot a legit adult site, and the reason we weigh a platform's record-keeping and removal conduct in free or paid: what you are actually choosing between. If a platform's compliance is invisible, that is information about the platform.

Every figure and quotation on this page was read from the FTC's own compliance guidance on 9 August 2026. Law and penalty figures change; check the current position before relying on it.