This article explains what federal laws now cover, what conduct is criminalized, what platforms must do, and — critically — what victims can do right now.
We'll cover the TAKE IT DOWN Act (signed into law in 2025), earlier federal protections that were already on the books, the 48-hour platform removal mandate, and how federal law works alongside state laws.
TL;DR: Key Takeaways
- The TAKE IT DOWN Act (signed May 19, 2025) is the first federal criminal law targeting nonconsensual intimate image sharing — carrying up to 2–3 years in federal prison
- Covers both authentic images and AI-generated deepfakes ("digital forgeries")
- Platforms must remove flagged images within 48 hours or face FTC enforcement
- Federal law does not replace state laws: both can apply simultaneously
- Preserve evidence before requesting removal: save screenshots, URLs, and timestamps before filing any takedown request
What Is Revenge Porn — and Why Federal Law Now Matters
"Revenge porn" is a common term, but the legal phrase is nonconsensual intimate image sharing (NCII) or nonconsensual distribution of intimate images (NDII). It covers the distribution of sexually explicit or intimate images of a person without their consent — regardless of whether the person originally agreed to the image being created.
The perpetrators aren't only jilted exes. Hackers, and extortionists use NCII as a tool for coercion, financial gain, and psychological harm. The consent-to-create vs. consent-to-share distinction is central to how every current law is written and prosecuted.
The Scale of the Problem
According to the Cyber Civil Rights Initiative's research, 1 in 8 adult social media users have been targeted by NCII, and 1 in 12 have been direct victims. Documented harms include anxiety, depression, PTSD, job termination, and reputational damage that can follow victims for years.
Why State Law Wasn't Enough
When someone in Virginia has images posted to a server in California and shared via a platform headquartered in New York, state criminal jurisdiction gets complicated fast. The CCRI notes that NDII enforcement breaks down precisely because online distribution routinely crosses state lines. Federal jurisdiction was the obvious solution, and the TAKE IT DOWN Act finally delivers it.
The TAKE IT DOWN Act: What the New Federal Law Actually Says
Signed by President Trump on May 19, 2025, the TAKE IT DOWN Act (Public Law 119-12) is the first dedicated federal criminal statute for nonconsensual intimate image sharing. The bill passed with bipartisan support and applies nationwide.
Scope of the Criminal Offense
The law criminalizes knowingly publishing, or threatening to publish, an intimate image of an identifiable person without their consent, where the subject had a reasonable expectation of privacy.
Two categories of content are covered:
- Authentic images — real photographs or videos
- Digital forgeries — AI-generated or digitally altered depictions that appear indistinguishable from authentic images to a reasonable person
Threats to publish images for purposes of extortion, coercion, or causing emotional harm are separately criminalized under the same statute.
Intent Requirements: Adults vs. Minors
The law uses a two-tier intent standard:
- Adult victims: Prosecution must prove the defendant intended to cause financial, psychological, or reputational harm — or that such harm actually resulted
- Minor victims: Prosecution must show the content was published to abuse, humiliate, harass, or degrade the minor, or to arouse or gratify sexual desire; no reasonable-expectation-of-privacy requirement applies
Criminal Penalties
| Victim Category | Maximum Prison Term |
|---|---|
| Adult victim (authentic image or deepfake) | Up to 2 years |
| Minor victim (authentic image or deepfake) | Up to 3 years |
| Threats involving adult deepfakes | Up to 18 months |
| Threats involving minor deepfakes | Up to 30 months |
Penalties also include fines, forfeiture of property used in the crime, and victim restitution. If the content meets the legal definition of child pornography under existing federal statutes, significantly harsher penalties apply independently.
Exceptions and Free Speech Provisions
The law includes built-in safeguards to address First Amendment concerns:
- Good-faith disclosures to law enforcement
- Content shared to assist a victim
- A "public concern" exception for matters of legitimate public interest
- A safe harbor for constitutionally protected speech or expression
The identifiable-victim requirement and the harm/intent standard appear specifically designed to address constitutional challenges — including the Supreme Court's Ashcroft v. Free Speech Coalition precedent on virtual child pornography.
Federal Protections Before the TAKE IT DOWN Act
Two federal tools predated the TAKE IT DOWN Act, each addressing non-consensual intimate images (NCII) from a different angle.
The VAWA 2022 Civil Remedy
The Violence Against Women Act Reauthorization Act of 2022 created the first federal civil cause of action under 15 U.S.C. § 6851. Victims could sue individuals who disclosed intimate images without consent in federal court, seeking:
- Actual damages or $150,000 in liquidated damages
- Attorney's fees and litigation costs
- Injunctive relief
- The right to proceed using a pseudonym
This was a civil remedy, not a criminal one — meaning the federal government wasn't prosecuting offenders. Victims had to bring their own lawsuits.
Federal Cyberstalking Law as an Interim Tool
Before a dedicated statute existed, federal prosecutors used 18 U.S.C. § 2261A (cyberstalking) to charge NCII cases when the conduct involved using electronic communications to harass, threaten, or cause substantial emotional distress across state lines. Prosecutors had to shoehorn NCII conduct into a broader stalking framework rather than charge it on its own terms — effective in some cases, but structurally mismatched to the offense.
The Section 230 Gap
The Communications Decency Act of 1996 shielded platforms from liability for user-generated content, meaning websites historically had no legal obligation to remove NCII. The TAKE IT DOWN Act addresses this directly with mandatory removal obligations — covered below.
Platform Obligations: The 48-Hour Removal Rule
The TAKE IT DOWN Act places direct obligations on platforms, not just criminal liability on individual offenders.
What platforms must do:
- Establish a notice-and-removal process by May 19, 2026 (one year from enactment)
- Post visible notice of that process on their website
- Remove a qualifying intimate image within 48 hours of a valid removal request
- Make reasonable efforts to remove known identical copies
Enforcement: The Federal Trade Commission is empowered to take action against platforms that fail to comply. The FTC treats noncompliance as an unfair or deceptive act or practice, giving the agency clear authority to pursue action.
Platform safe harbor: Platforms that remove content in good faith — even if that content later turns out to be lawful — are protected from civil liability for doing so. The provision encourages prompt removal by shielding platforms from counter-suits.
How Federal Law Interacts With State Laws
The TAKE IT DOWN Act contains no preemption provision. State laws remain fully in force, and a perpetrator can face both federal and state criminal charges for the same conduct.
The Current State Landscape
According to the Cyber Civil Rights Initiative, all 50 states plus Washington D.C., Guam, and Puerto Rico now have laws against nonconsensual distribution of intimate images. As of 2025, at least 19 states have also passed laws specifically targeting sexually explicit deepfakes.
State-level classifications vary significantly — most treat first offenses as misdemeanors, with felony enhancements for repeat offenses, cases involving minors, or extortion elements.
Why Dual Coverage Matters
Federal law is particularly valuable when images cross state lines or are shared via national platforms. State law often provides complementary remedies:
- Injunctive relief
- Potentially larger civil damage awards than the federal $150,000 cap
- State criminal charges that prosecutors can bring independently
Pursuing both tracks simultaneously allows victims to seek criminal accountability through federal prosecution while advancing civil remedies — including damages and takedown orders — through state courts in parallel.
What to Do If You're a Victim: Steps, Evidence, and Legal Action
Step 1: Preserve Evidence First
Do not request removal before documenting everything. Removing images before preserving evidence can seriously complicate criminal prosecution or civil litigation.
Document the following before taking any other action:
- Screenshots of all postings, including URLs, usernames, timestamps, and surrounding page context
- Any threatening messages or communications received
- Every platform or website where the images appear
- Any communications from the person responsible
Step 2: Request Removal
Once evidence is preserved, pursue removal through multiple channels:
- Direct platform requests — cite the 48-hour federal removal mandate
- StopNCII.org — creates a digital fingerprint (hash) of the image so participating platforms can proactively find and remove it without you re-uploading the content
- NCMEC's Take It Down service — specifically for minors whose images were taken when they were under 18
- DMCA takedown notices — if you took the image yourself (selfies are typically copyright-protected by the subject), a DMCA notice is an additional removal avenue; research suggests more than 80% of NCII images are selfies
Step 3: Report to Law Enforcement
- Local police — file a report for potential state criminal charges
- FBI / IC3 — submit a tip to the FBI's Internet Crime Complaint Center for federal investigation, especially when the sharing crosses state lines or involves a major national platform
Step 4: Pursue Civil Remedies
Under 15 U.S.C. § 6851, victims can sue for:
- Actual damages or $150,000 in liquidated damages
- Attorney's fees and injunctive relief ordering removal
- The right to proceed pseudonymously in court
State civil laws may provide additional or uncapped remedies. To illustrate what courts can award: in 2023, a Texas jury awarded $1.2 billion to a victim in Jane Doe (D.L.) v. Marques Jamal Jackson — $200 million for mental anguish plus $1 billion in exemplary damages. Actual collection in cases like this varies, but the verdict reflects how seriously courts treat these cases.
Step 5: Engage Digital Forensics Expertise
Tracing a leak's source, authenticating AI-generated deepfakes, and recovering deleted content requires certified forensic expertise. Prudential Associates, based in Rockville, MD, provides forensic services specifically for NCII cases — working directly with victims and the attorneys representing them.
Their certified examiners (CFCE, EnCE, CMFE, GASF, and Certified Social Media Intelligence Expert) can:
- Trace image sources across platforms using metadata extraction, OSINT, and social media intelligence
- Authenticate or analyze AI-generated deepfakes using specialized forensic tools
- Recover deleted content and document digital artifacts in a forensically sound manner
- Produce court-ready reports supporting criminal prosecution, civil litigation, takedown demands, and protective orders
- Provide expert witness testimony in federal and state court proceedings
Evidence gathered by a certified examiner follows strict chain-of-custody protocols, making it admissible in court. Screenshots taken on a personal phone do not carry the same evidentiary weight on their own.
Frequently Asked Questions
Is it illegal to send intimate pictures of someone without their consent?
Yes. The TAKE IT DOWN Act makes knowingly publishing or sharing intimate images without consent a federal felony, with additional penalties for sharing with intent to harm, extort, or coerce. All 50 states also have parallel criminal laws that can apply at the same time.
Is the TAKE IT DOWN Act a federal law?
Yes. The TAKE IT DOWN Act was signed into federal law on May 19, 2025 (Public Law 119-12) and represents the first federal criminal statute specifically targeting nonconsensual intimate image sharing. It covers both authentic images and AI-generated deepfakes.
What are the penalties for violating the TAKE IT DOWN Act?
Violations carry up to two years in federal prison for adult victims, or up to three years when a minor is depicted, plus fines and forfeiture of property used in the crime. Content that also qualifies as child pornography under existing federal statutes triggers significantly harsher penalties.
Can I sue someone for sharing my intimate images without consent?
Yes. Under 15 U.S.C. § 6851, federal law allows a civil lawsuit with actual or liquidated damages capped at $150,000 plus attorney's fees and an injunction ordering removal. Many state civil laws provide additional remedies, including uncapped compensatory and punitive damages.
Does federal law cover AI-generated deepfakes?
The TAKE IT DOWN Act covers "digital forgeries" — meaning AI-generated or digitally altered images that appear indistinguishable from authentic depictions — and applies the same intent requirements and criminal penalties as it does to authentic images.
How quickly must platforms remove intimate images?
Platforms must remove flagged intimate images within 48 hours of receiving a valid request. Platforms that fail to comply face enforcement action by the Federal Trade Commission.
