The TAKE IT DOWN Act is Public Law 119-12, enacted 19 May 2025. Section 3 creates the duty: covered platforms had one year to stand up a notice-and-removal process, and must remove a reported depiction and known identical copies within 48 hours of a valid request. Section 4 says who owes that duty. Operators read section 3, recognise the 48-hour number, and never reach section 4 — which is the paragraph that decides whether the 48 hours are theirs.
The definition below is quoted from the enrolled text as published by the Government Publishing Office. It is reproduced rather than summarised because the summaries compress the second prong and drop the third exclusion, and both of those are where the edge cases live.
What is a “covered platform” under the TAKE IT DOWN Act?
Public Law 119-12 §4(3)(A) defines a covered platform as “a website, online service, online application, or mobile application” that meets two conditions. The first is that it “serves the public.” The second is satisfied either by being a platform “that primarily provides a forum for user-generated content, including messages, videos, images, games, and audio files,” or by one for which “it is in the regular course of trade or business” of that platform “to publish, curate, host, or make available content of nonconsensual intimate visual depictions.”
Read the second prong carefully: it is a disjunction, not a pair of requirements. A platform qualifies under the first branch by being a forum for user-generated content of any kind — the statute names messages, videos, images, games and audio files, and nothing in that list is about intimate content. A general-purpose forum with no adult material on it and no history of any is inside the definition on the plain text. The second branch exists to catch the sites whose business is the material itself, which is why the FTC’s first enforcement letters went to “nudify” services.
Which kinds of platforms does the FTC name as covered?
The FTC’s business guidance on complying with the Act gives a plain-language gloss on the statutory definition: “TIDA covers a broad range of online platforms. TIDA’s definition of ‘covered platform’ covers various websites, apps, and online services, such as social media, messaging, image or video sharing, and gaming platforms.”
Two of those four categories surprise operators. Messaging is named, so a private direct-message product is not outside the Act by virtue of being private. Gaming is named, and the statute itself lists “games” among the forms of user-generated content in §4(3)(A)(ii)(I), so a game with user-uploaded avatars, skins, screenshots or chat is squarely in the frame. Neither category is a place operators expect NCII law to reach.
What is excluded from the definition of a covered platform?
Public Law 119-12 §4(3)(B) lists three exclusions, and only three. The first is “a provider of broadband internet access service.” The second is “electronic mail.” The third, quoted in full, is “except as provided in subparagraph (A)(ii)(II), an online service, application, or website—(I) that consists primarily of content that is not user generated but is preselected by the provider of such online service, application, or website; and (II) for which any chat, comment, or interactive functionality is incidental to, directly related to, or dependent on the provision of the content described in subclause (I).”
The third exclusion is the one that matters to most small operators, and it is written conjunctively: both subclauses must be true. A site qualifies for it when the content is mostly the provider’s own and preselected, and whatever interactivity exists hangs off that content. A streaming catalogue with reviews attached to titles fits. A publication with comments under articles fits. A marketplace where sellers upload their own listings and photographs does not obviously fit, because the listings are user generated and are the point of the site rather than an accessory to editorial content.
The opening words of the third exclusion are also load-bearing. “Except as provided in subparagraph (A)(ii)(II)” means the exclusion is unavailable to any site that hosts nonconsensual intimate visual depictions in the regular course of business, however little of its content is user generated.
Does the TAKE IT DOWN Act apply to small platforms?
Nothing in the definition of “covered platform” turns on size. Public Law 119-12 §4(3) sets no monthly-active-user floor, no revenue threshold, no employee count and no small-business exemption, and the three exclusions in §4(3)(B) are about what a service is — broadband access, email, preselected content — not about how large it is. A forum with two hundred members meets the same test as one with two hundred million.
The absence of a threshold is the single most consequential fact on this page, because the compliance burden does not scale down with the platform. The FTC’s guidance states that platforms which violate the law “may face FTC enforcement that could result in civil penalties of $53,088 per violation.” That figure is per violation and does not shrink for a small operator, and the 48-hour clock runs at the same speed for a team of one as for a trust-and-safety department.
Does the Act apply to a platform that has never hosted intimate content?
Yes, on the plain text, if the platform serves the public and primarily provides a forum for user-generated content. The first branch of §4(3)(A)(ii) asks what the platform is, not what has been posted to it. A platform with a spotless moderation history is still a platform where someone can upload an image, and the Act’s requirement is that a process exists before anything is reported — the FTC’s complaint portal at TakeItDown.ftc.gov “also accepts complaints about platforms that have failed to create a process for people to request removal of these images.”
That is the asymmetry worth internalising. A covered platform that has never received a removal request can still be out of compliance, because the missing process is itself the exposure. Nothing has to have gone wrong on the platform first.
The definition as a test
| Question | Source | If yes |
|---|---|---|
| Does the service serve the public? | §4(3)(A)(i) | Continue — this prong is necessary |
| Does it primarily provide a forum for user-generated content — messages, videos, images, games, audio? | §4(3)(A)(ii)(I) | Second prong met |
| Or does it publish, curate, host or make NCII available in the regular course of business? | §4(3)(A)(ii)(II) | Second prong met, and no exclusion is available |
| Is it a broadband internet access provider? | §4(3)(B)(i) | Excluded |
| Is it electronic mail? | §4(3)(B)(ii) | Excluded |
| Is the content primarily preselected by the provider AND is interactivity incidental to it? | §4(3)(B)(iii) | Excluded — both subclauses must be true |
| Does it have fewer than N users? | Not in the statute | Irrelevant — there is no size threshold |
This is the statutory text laid out as a sequence, not legal advice, and the second prong in particular is a judgement about what a service primarily does. A platform near the line of the third exclusion is exactly the platform that should put the question to counsel rather than to a table.
If your platform is covered, what does it owe?
A covered platform owes a notice-and-removal process, a clear and conspicuous notice describing it, removal of a reported depiction and known identical copies within 48 hours of a valid request, and — per FTC guidance — an identifying number for each request and notice to the requester of the outcome. The full list, including the two requirements operators most often miss, is in the compliance checklist. What makes a submitted report a valid request, and therefore what starts the 48-hour clock, is in the four fields guide. What the FTC has actually done since enforcement began is in the enforcement guide.
Where TrustDesk fits
TrustDesk is a hosted NCII report intake form with the 48-hour clock and an append-only evidence log behind it. For an operator who has just worked out that a small forum, messaging product or game is inside the definition, the practical problem is that the statute asks for a process, a public notice and a record, and a platform of that size has none of the three. The hosted desk supplies the form and the log; the policy text that has to be published alongside it is free, with no account, from the generator on the pricing page. Whether to build that yourself, hand it to counsel, or host it is compared in counsel, build, or hosted desk.
The definition and the exclusions on this page are quoted from the enrolled text of Public Law 119-12 §4(3) as published by the Government Publishing Office, read on 2 August 2026: the TAKE IT DOWN Act, full text. The description of which platform categories are covered, the penalty figure and the scope of the FTC complaint portal are from the FTC’s business guidance, read the same day. This page sets out what the statute says and is not legal advice about a particular platform.