If your small business runs a platform that hosts user content — a community forum, a marketplace with seller images, a social app, a job board with profile photos, or even a Discord-style chat for customers — you became subject to a federal 48-hour removal clock on May 19, 2026. Miss it, and the FTC can treat the failure as an unfair or deceptive practice with fines up to $51,744 per violation.
The law is the TAKE IT DOWN Act (TIDA 2025), signed in 2024 and enforceable since May 19, 2026. It targets nonconsensual intimate imagery (NCII), including AI-generated deepfakes of identifiable people. Widely praised as a victim-protection measure and closely watched for over-removal risk, it passed the Senate by unanimous consent and the House 409–2. For covered platforms, the compliance obligations are concrete and the window is short: provide a clear way for people to request removal, and take down the image and all identical copies within 48 hours of a valid request.
Here is who is covered, what the request process must do, and how a small business can implement a defensible 48-hour workflow before the next warning letter goes out.
Who Is Covered
The Act defines a "covered platform" as:
- A website, online service, online application, or mobile application that serves the public and primarily provides a forum for user-generated content — including messages, videos, images, games, and audio files; or
- An online service in the business of publishing, curating, hosting, or making available content that is nonconsensual intimate visual depictions.
That scope is broader than social media. A niche marketplace where sellers upload product lifestyle images, a fitness app where members share progress photos, a local news site with user comments that allow image uploads, or a SaaS forum where users post screenshots can all qualify if they are public and primarily user-content driven. Internal-only tools behind a login are generally outside the definition, but anything public and participatory should be assumed in scope until you have a written analysis that says otherwise.
Size does not exempt you. The Act applies to small businesses operating covered platforms, not just Big Tech. The FTC's May 2026 warning letters went to a dozen websites of varying sizes, signaling that enforcement will not be limited to household names.
What the Law Requires — Publication Ban Plus Takedown Duty
Two prohibitions work together:
- Do not publish nonconsensual intimate images. The Act makes it illegal to publish — including via AI-generated digital forgeries — intimate visual depictions of an identifiable individual without that individual's consent. This applies to the platform's own publishing and to user submissions the platform hosts.
- Remove on request within 48 hours. Upon receiving a valid request from a victim (or authorized representative), a covered platform must remove the reported NCII and all known identical copies within 48 hours.
The 48-hour clock starts on receipt of a valid request, not on your next business day. Weekends count. The FTC enforces Section 3 of the Act and has stated it will treat non-compliance as an unfair or deceptive practice under its existing authority, with civil penalties and, in egregious cases, referral for criminal dissemination.
What Counts as a Valid Request
A request is valid when it provides enough information for the platform to identify and remove the content without requiring the victim to do investigative work:
- Identification of the depicted individual and a statement that the depiction is nonconsensual (the Act does not require the victim to prove they never consented — their statement is the basis)
- Location of the content — URL, post identifier, or other locater that lets the platform find the file
- Contact information for follow-up
The platform may not condition removal on the victim providing a government ID to the public, nor may it require the victim to pay a fee or to engage with the person who posted the content. Good-faith implementation means making the request channel easy to find — clearly disclosed on the platform, not buried three clicks deep in a help center.
AI deepfakes are explicitly in scope. A digitally forged intimate image of an identifiable person — face-swapped or synthetically generated — is covered to the same extent as an authentic photograph. Your moderation process must treat them identically.
The 48-Hour Workflow Small Businesses Need
You do not need enterprise trust-and-safety tooling to comply, but you do need a documented, clock-driven workflow that survives an FTC inquiry.
1. Publish a Takedown Request Channel
Create a dedicated, clearly labeled path — e.g., "Report Nonconsensual Intimate Image" — visible from every page that hosts user content and from your terms or community guidelines. The channel should:
- Be accessible without login, because the victim is often not a user
- Accept requests 24/7 via a form that generates a timestamped ticket
- Auto-acknowledge receipt with the ticket number, the 48-hour commitment, and a contact for follow-up
- Log the receipt time to the minute — that timestamp starts the clock
Do not route NCII reports through a general support inbox where they compete with billing questions. A separate queue ensures they are seen first.
2. Triage and Verify Without Requiring the Impossible
Within hours, not days, a designated moderator should:
- Confirm the request identifies a depiction that appears to be intimate and nonconsensual and provides a locater
- Locate the file and all known identical copies — same hash, same URL variations, same reposts in the platform's storage
- Preserve the evidence (hash, URL, uploader account, timestamp) before removal, because you may need to show you removed identical copies and to support law enforcement
Do not delay removal to investigate whether the depicted person "really" consented or to ask the uploader for their side. The Act shifts the burden to removal upon a valid request; the proper recourse for a wrongful takedown is a counter-notice and restoration process, not a pre-removal debate that blows the 48-hour deadline. Free-speech experts have flagged that this tight window can incentivize over-removal — acknowledge that trade-off in your policy, but comply with the statute's timeline.
3. Remove and De-Duplicate Within 48 Hours
Removal means the image is no longer publicly accessible on the platform, and the platform has taken reasonable steps to prevent identical copies it knows about from remaining accessible. In practice:
- Delete or disable access to the original file and purge it from CDNs and caches where you control the cache
- Hash the image (e.g., PhotoDNA, PDQ, or a simple perceptual hash) and scan for identical copies in the same datastore — the Act explicitly requires removal of known identical copies, not just the reported URL
- Suspend the uploader's ability to repost the same file while preserving audit logs
Document the removal time in the ticket. If removal is completed at hour 30, that timestamp is your compliance evidence.
4. Notify and Offer a Counter-Process
After removal, notify both the requester and the uploader:
- Tell the requester the content was removed and provide the ticket closure time
- Tell the uploader what was removed and why, and explain how to submit a counternotice if they believe the removal was in error — counter-notices do not pause the 48-hour duty, but they create a record for any later dispute
Keep the communications factual and avoid editorial language about guilt or intent.
5. Retain Records and Review
Retain the ticket — request, receipt timestamp, verification notes, removal timestamps for each copy, and notifications — for at least two years. The FTC's enforcement to date has included warning letters advising companies of their obligations; a documented history of timely removals is the best response to an inquiry.
Quarterly, review the log for patterns: repeated uploads of the same hash (indicating a banned user circumventing via new accounts), or a spike in reports tied to a single community or product feature that may need design changes.
Financial and Operational Implications
Compliance is not free, but non-compliance is more expensive.
- Staffing: Designate at least two people who can triage NCII reports, so vacation or illness does not break the 48-hour chain. For very small teams, a founder plus a trusted moderator is sufficient if both have access and are trained.
- Tooling: Free or low-cost hashing and reporting form tools exist. The cost driver is not software but response time — a form that creates a ticket and pages the on-call moderator is worth more than a sophisticated detection model with no on-call.
- Terms and insurance: Update your terms to describe the takedown process and to prohibit NCII and AI deepfakes explicitly. Review your media liability or cyber insurance — some policies now ask whether you have a TIDA-compliant process.
- Bookkeeping: Track compliance costs — moderation hours, tooling, legal review — as a distinct cost center. If you later face a penalty, documented good-faith compliance efforts influence the outcome, and the costs are deductible business expenses.
What Not to Do
- Do not require victims to email the uploader or to obtain a court order — the Act provides a direct platform-reporting right.
- Do not condition removal on the victim proving the image is "real" versus AI-generated — both are covered.
- Do not re-host removed content for evidentiary purposes in a publicly accessible way — preserve internally, remove publicly.
Keep Your Platform Defensible
The TAKE IT DOWN Act's 48-hour rule is one of the tightest compliance windows small businesses have faced for user-content issues — tighter than DMCA's 10–14 business days and comparable only to the most urgent safety escalation. For a small team, the key is not scale but clarity: a visible reporting channel, a timestamped 48-hour workflow, a hash-based identical-copy sweep, and a ticket that proves you met the clock. Implement that now, before the next request arrives, and your platform can protect victims, preserve a record, and survive an FTC inquiry.
Simplify Your Financial Management
Content moderation is not just a legal workflow — it is a financial one, with staffing, tooling, and risk that belong in your books. Beancount.io gives you plain-text, version-controlled accounting where every compliance cost, every moderation hour, and every risk reserve is traceable — so your 48-hour process is documented in operations and reflected in your financials. Get started for free and keep your platform's finances as organized as its takedown queue.