This coverage has repeatedly found the law trailing technology. There is one front where, for once, regulation has begun to close the distance — and it concerns one of the internet’s most damaging abuses: the nonconsensual spread of intimate imagery, including AI-generated forgeries. The story is worth telling not for the harm itself, which is well documented, but for what it reveals about how, and how quickly, a society can decide to act when the harm becomes undeniable. As a matter handled with the seriousness it requires, this piece focuses on the legal and regulatory response, not on the mechanics of the abuse.
Begin with the scope of the problem, stated soberly. Nonconsensual intimate imagery — what the law calls “nonconsensual intimate visual depictions,” encompassing both real images shared without consent and entirely fabricated AI forgeries — has become a metastasizing crisis. Researchers estimate that the overwhelming majority of deepfake content circulating online is nonconsensual intimate imagery, and that its victims are almost entirely women and girls. Before recent laws, those victims had limited and often ineffective recourse: a fragmented system of state-level statutes and copyright workarounds, frequently powerless against platforms hosted in another state or country.
The regulatory turn: a federal takedown duty
The pivot in the United States came with the TAKE IT DOWN Act, signed into law in May 2025 after a rare display of bipartisan unity — it passed the House 409 to 2. Its design has two halves, worth distinguishing precisely.
The first is a criminal prohibition, effective immediately on signing, against the nonconsensual publication of intimate images, whether authentic or computer-generated. Penalties are calibrated to the victim: offenders face up to two years in prison when the subject is an adult, and a longer term when a minor is involved — a deliberate severity for cases affecting children.
The second half is a platform obligation that reached its operational milestone only in May 2026. Covered platforms — broadly, public websites and apps that host user-generated content — must now maintain a clear process for any depicted person to request removal, and must take down the reported content within 48 hours, including finding and removing duplicates. Enforcement falls to the Federal Trade Commission, which can treat noncompliance as an unfair or deceptive practice, with civil penalties reaching tens of thousands of dollars per violation. The FTC’s guidance encourages platforms to use hashing technology to prevent re-uploads and to coordinate with established services — the National Center for Missing and Exploited Children’s system for content involving minors, and a separate service for adults.
The shift this represents is concrete: a victim no longer has to navigate copyright law or hope a foreign platform cooperates. There is now a federal right to demand removal, a deadline, and a regulator with the jurisdiction to enforce it.
The global patchwork
The United States is not alone, but the world’s responses do not align — they form a patchwork of different legal theories. Within the US, nearly all states already had laws on nonconsensual intimate imagery, and a majority addressed deepfakes specifically; the federal law does not preempt them, giving victims more than one avenue. Internationally, the European Union’s AI Act imposes transparency obligations on AI-generated content under Article 50; the United Kingdom and Australia have moved through online-safety and image-based-abuse frameworks; South Korea and others have used criminal law. Some countries route the problem through election law, others through personality or privacy rights.
For anyone — platform or victim — operating across borders, this is the recurring difficulty this coverage has traced: content that is a serious crime in one jurisdiction may fall into a gray zone in the next, and a removal duty that binds a platform in one country may not reach the same content hosted elsewhere. The harm is borderless; the remedies are not.
The gaps that remain
Even sympathetic analysts note that the new framework, however significant, leaves troubling gaps — and presenting them is part of an honest account. Legal scholars have flagged that the takedown duty targets only certain public-facing platforms primarily hosting user-generated content, potentially leaving out other channels through which such material spreads. The law’s interaction with encrypted or private services is unsettled. Some worry about over-broad takedown requests being misused, and about the privacy implications of the verification processes platforms must build. And there is the perennial enforcement question: a 48-hour rule is only as good as the FTC’s capacity and will to enforce it at scale.
There is also a legislative wildcard. A proposed multi-year moratorium on state-level AI regulation, debated in Congress, raises the question of whether some state protections that overlap with the federal law could be swept up — an illustration of how a fast-moving policy environment can complicate even a settled win.
Two readings, with comparable weight
The response admits two legitimate readings, worth presenting without tilting the scale.
The first welcomes the law as a landmark: for the first time, victims of nonconsensual intimate imagery — including AI deepfakes — have a federal mechanism to force removal and hold distributors criminally accountable, ending an era in which, as the bill’s sponsor put it, platforms could “look the other way.” From this angle, an imperfect law that protects real people now is far better than waiting for a perfect one.
The second reading, often from the same people who support the law’s goals, stresses that the framework may promise more than it can deliver: that without broader scope, clearer privacy safeguards, and robust enforcement, the protection could prove partial, leaving victims exposed in the gaps. From this angle, the law is a necessary first step that must not be mistaken for a complete solution.
It is not for this outlet to decree the balance. What can be stated is that both readings share the premise — the harm is real and serious — and disagree only on whether the remedy is sufficient. That is a healthier kind of disagreement than the years of inaction that preceded it.
What this case reveals
What this episode adds to the coverage is a hopeful variant of the gap between technology and law: proof that the distance can be narrowed when the harm becomes undeniable and the political will aligns. For most of the technologies this coverage tracks, regulation arrives late, weak, or not at all. Here, faced with a harm too concrete to rationalize away, lawmakers acted with unusual speed and near-unanimity. It is not a complete solution, and it may yet prove harder to enforce than to pass. But it shows that the gap is not a law of nature — that when a society decides a digital harm is intolerable, it can move.
The verifiable fact is that nonconsensual intimate deepfakes became a widespread abuse with weak remedies; that the United States enacted a federal law criminalizing them and requiring platforms to remove reported content within 48 hours, with full enforcement beginning in 2026; and that the global response remains an uneven patchwork with real gaps. Whether this protection proves effective or merely symbolic will depend on decisions not yet settled: on how vigorously the FTC enforces the rule, on whether the scope expands to close the gaps, and on whether other countries build compatible remedies for a harm that ignores borders. As in every story of this kind, what is decisive is not the law that gets passed, but whether it reaches, in practice, the people it was written to protect.