Deepfake Nudes and the Take It Down Act: A Parent’s 48-Hour Playbook
Bottom line up front
If someone has made or shared a fake nude of your child, or is threatening to, do not pay and do not reply, delete nothing and forward nothing, and file a removal request with every platform it is on. Since May 19, 2026, the Take It Down Act requires those platforms to take it down, along with known identical copies, within 48 hours of a valid request, and the FTC takes complaints when they don’t. Report the person to NCMEC’s CyberTipline at 1-800-843-5678, and stay close to your kid while you do it.
On October 1 the Federal Trade Commission put out a short note for parents. It is the fourth alert the agency has written about intimate images since early September, and the first aimed squarely at families. It mentions “nudify apps that create fake nude photos and videos of real people” in the same breath as cyberbullying and scams, which tells you where this has landed: it is now an ordinary hazard of having a phone in a school, not an exotic one.
The reason the FTC is writing about it now is a law most parents haven’t heard of. The Take It Down Act was signed in May 2025, and its platform rules switched on a year later. If an explicit image of your child is on a social app, a messaging service or a photo site, you can make that company take it down, and it has 48 hours to do it.
That’s a real change. Before it, getting an image removed meant hoping a trust-and-safety queue got to you. It is also narrower than it sounds, and the order you do things in during the first hour matters more than the law does. This guide covers both.
The first hour: six things to do
Whether the image is a fake built from a school photo or a real one someone was tricked into sending, the first hour looks the same.
- Tell your child they are not in trouble, before anything else. Say it out loud even if it seems obvious. Kids in this spot are often more afraid of their parents’ reaction than of the person threatening them, and a teen who feels judged tends to stop telling you things right when you need them to keep talking.
- Don’t pay, and don’t reply. If there is a demand for money, gift cards or more pictures, stop all contact. NCMEC puts it bluntly: “Cooperating or paying rarely stops the blackmail.” Payment tells the person on the other end that this account is worth working.
- Delete nothing, and forward nothing. Block the account, but don’t delete the conversation or your child’s profile, because NCMEC says those records can help stop the blackmailer. The FBI’s advice for parents is to take screenshots of the chats and of any shared images, and not to delete anything. Write down usernames, phone numbers and the web address of every place the image appears, too. The one thing never to do is pass the image on: not to friends, not to other parents, not to the school. Keep what you captured for the report, and follow the instructions of whoever takes it.
- File a removal request on every platform it’s on. Use each app’s report or removal form for intimate images, and keep a note of the date and time you sent each one. That timestamp starts the platform’s 48-hour clock.
- Hash it with NCMEC’s Take It Down service. At takeitdown.ncmec.org your child (or you, with them) creates a digital fingerprint of the image on your own device. The picture is not uploaded. Participating platforms use the fingerprint to find and block copies.
- Report it. Call NCMEC’s CyberTipline at 1-800-843-5678 or file at report.cybertip.org, and report the person threatening your child to the FBI at tips.fbi.gov. If you think your child is in danger right now, call 911.
If your child may be in crisis
Stay with them. Treat any talk of hopelessness, “everyone will see it,” or wanting to disappear as urgent. Call or text 988, the Suicide & Crisis Lifeline, free and open around the clock in the U.S., or call 911 if they are in immediate danger. Parents can call 988 too, just to talk through what to say.
Definition
The Take It Down Act is a 2025 federal law that makes it a crime to publish, or threaten to publish, intimate images of someone without consent, AI-made fakes included. Since May 19, 2026 it has also required social, messaging and sharing platforms to remove a reported image within 48 hours of a valid request.
What the Take It Down Act actually changed
There are two halves to the law, and parents mostly need the second one.
The first half is criminal. It is now a federal offense to knowingly publish an intimate image of someone without their consent, and the law treats a “digital forgery” the same way as a real photo. That term is defined as an intimate image of an identifiable person made with “software, machine learning, artificial intelligence, or any other computer-generated or technological means” that looks real. Publishing one of a minor carries up to three years in prison. Threatening to publish one is a crime too, if the point is “intimidation, coercion, extortion, or to create mental distress,” with up to 30 months when the fake depicts a minor and 18 months for an adult, according to the text of Public Law 119-12.
That second offense is the one that lines up with how sextortion works. The threat is the crime. Nobody has to post anything first.
The second half is about platforms. Any public website or app that mainly hosts user content had one year from the May 19, 2025 signing to build a way for people to request removal of non-consensual intimate images. Once a valid request arrives, the platform has to take the image down “as soon as possible, but not later than 48 hours,” and make “reasonable efforts” to find and remove known identical copies. The FTC enforces that half. Its May 2026 explainer says the requirement covers real images, digitally altered ones and AI deepfakes, and that a parent or guardian can file on behalf of a minor.
What the FTC can’t do is remove anything itself. “Only platforms can actually remove intimate photos and videos,” the agency says. Its job is to go after the companies that don’t.
How a fake gets made from an ordinary photo
A few years ago, a convincing fake took skill and time. Now it takes a clothed photo and an app. The photo is usually nothing: a team picture, a vacation shot, a selfie from a public account. The FBI warned about exactly this in a 2023 public service announcement, noting that the benign images are “typically captured from an individual’s social media account, open internet, or requested from the victim” before being turned into explicit content.
From there it tends to go one of two ways.
The extortion version
A stranger, often posing as someone your kid’s age, sends the fake to your child with a demand. The FBI describes two kinds: money or gift cards “with threats to share the images or videos with family members or social media friends,” or a demand that the victim send real sexual images. The second demand is the more dangerous one, because a real image gives the person far more to threaten with than a fake ever did.
This is the same machine we described in our parent’s guide to Snapchat sextortion, with one step removed. The scammer no longer needs your child to send anything first. NCMEC says its CyberTipline took 1.4 million reports of online enticement, which includes sextortion, in 2025, a 156% jump over 2024 (NCMEC).
The classmate version
The other version has no ransom note. Someone at school runs a classmate’s photo through a nudify app and drops the result in a group chat, sometimes as a “joke,” sometimes as revenge. NCMEC notes that this kind of fake “is often created by a child’s classmates.” In Thorn’s research, 16% of teens still said the images are “not real,” which is part of why they spread. They are not real photos. The harm is real, and the law now treats them as real images.
It’s worth saying plainly: an AI-generated sexual image of a minor is not a gray area. The FBI’s position, in a 2024 alert, is that child sexual abuse material made with generative AI “is illegal,” and federal law covers realistic computer-generated images. That matters if your kid is the one who receives it in a group chat, too. The right move is to tell an adult and not pass it on.
The volume is moving fast. NCMEC logged about 4,700 CyberTipline reports involving generative AI in 2023 and about 67,000 in 2024, according to its generative AI page. Its 2025 numbers are larger again, though NCMEC’s own pages count them in different ways, so we’d treat any single 2025 figure with some caution.
Writing a removal request a platform has to act on
The 48-hour clock only starts on a valid request, so it’s worth knowing what the law counts as one. Under Section 3, the request has to be in writing and include four things:
- A physical or electronic signature. For a child, that is the parent or guardian acting for them, which the FTC confirms is allowed.
- Enough information to find the image: the link, the post, the username of the account that put it up.
- A brief statement that you believe in good faith the image is not consensual.
- Your contact information, so the platform can reply.
Most large platforms have built a form that asks for exactly these things, usually tucked under “report” then something like “nudity” or “intimate image shared without consent.” Use that form rather than a general complaint, so there is no question about what you were asking for. If you can’t find one, the FTC’s September guide suggests the three-dots menu on the post or the platform’s help pages.
Then write down when you sent it. Honestly, this is the step people skip. A phone note with the platform, the link and the time is enough. If 48 hours pass and the image is still up, or the platform never answered, report it at TakeItDown.ftc.gov. The FTC’s form asks for the platform’s name and where the image was posted, and you can include as much or as little about yourself as you want.
Request contents and deadline: TAKE IT DOWN Act, Public Law 119-12, Section 3. Parent filing and FTC reporting: FTC consumer alerts, May and September 2026. Amber marks the attacker’s move, blue your move.
A small but useful detail: the platform has to go after “known identical copies” too. A re-upload of the exact same file should come down without a second request. A cropped, filtered or re-generated version may not count as identical, so if you see a variant, report that one separately.
Who does what: platform, NCMEC, FTC, police, school
Part of what makes this exhausting is that no single place handles all of it. Each one has a lane, and knowing which is which saves a lot of repeating yourself.
Sources: FTC (platform enforcement), NCMEC Take It Down and CyberTipline, StopNCII.org, FBI. Hash services only work on public or unencrypted platforms (NCMEC).
The platform removes the image. That’s the only party that can.
NCMEC’s Take It Down service works before and across platforms. It is for images taken when the person was under 18, and NCMEC says it covers images “whether real or GAI-created.” The hash goes on a list that participating sites use to block uploads. Two limits come straight from NCMEC: it only works on platforms that are public or unencrypted, and “online platforms may have limited capabilities to remove content that has already been posted in the past.” So use it alongside removal requests, never instead of them. If the image shows an adult (an older teen who has turned 18, or you), the matching service is StopNCII.org, which also hashes on your device and doesn’t take the image.
The FTC deals with platforms that miss the 48-hour deadline or don’t have a process. It doesn’t investigate the person who made the image.
NCMEC’s CyberTipline and the FBI deal with the person. A threat to publish is now a federal crime on its own, and a sexual image of a minor, fake or not, is a law-enforcement matter. Local police can take a report too, and in many cases that is quicker if the person is local.
The school deals with the hallway. If a classmate made or spread the image, the school has to know, both to stop it spreading on its own devices and networks and because the kid at the center of it still has to walk into class tomorrow.
When the person who made it is a classmate
This is the version parents find hardest, partly because it is personal and partly because the instinct is to handle it quietly. A few things we’d suggest, with the caveat that state laws and school policies vary a lot.
Go to the school in writing, and keep it factual: what was shared, on which app, roughly when, which students you believe were involved. Don’t send or show them the image itself; tell them where it is. Ask what the school will do about the students who shared it as well as the one who made it, and when you’ll hear back.
File the removal requests yourself anyway. A school can discipline students, but it can’t force an app to take a post down, and waiting for the school’s process uses up time the 48-hour rule would otherwise be working for you.
Think about whether to involve police. Publishing an intimate digital forgery of a minor is a federal crime under the new law, and some states have their own. That doesn’t mean every case belongs in court, and families make different calls here for good reasons. A report to the CyberTipline is a reasonable middle step: NCMEC sends reports to the right law enforcement agency, and it can help with getting images removed.
And if your own child turns out to be the one who made or forwarded the image? Take it as seriously as if it had happened to them. Get the image deleted from their phone and accounts, keep the conversation open, and get advice before you decide what to do next. Kids often don’t realize that what felt like a prank in a group chat is now a federal crime.
What the law won’t do
It’s a good law for a bad situation. It still has edges, and it helps to know them going in so a gap doesn’t feel like a failure.
- It can’t reach a private encrypted chat. If the fake is passing around in an end-to-end encrypted group, the app may not be able to see it, and NCMEC’s hash list only works on public or unencrypted services. That’s where the school and police matter most.
- It doesn’t pull an image off devices. Removal from a platform doesn’t delete copies people already saved.
- It doesn’t cover every website. The duty applies to public sites and apps that mainly host user content. A site run overseas that ignores U.S. law will be harder, and that is a job for NCMEC and law enforcement.
- It doesn’t make anyone pay you. The criminal penalties are fines and prison for the offender, and the FTC acts against platforms. Neither is a route to compensation.
One more edge, and it’s a scam in its own right. When people are desperate to make an image disappear, someone usually offers to do it for a fee: a “reputation” service, a person claiming to be a hacker, an account that says it can wipe the image “from the whole internet.” The FTC is clear that only platforms can remove images, and both the removal requests and NCMEC’s service cost nothing. Anyone charging to do what the platform must do for free deserves the same suspicion as the person who started this. It’s the same pattern as the recovery scams that follow a first loss.
Talking about it before it happens
The conversation is easier on an ordinary Tuesday than in a crisis. You don’t need to show your kid anything or go into detail. Something like this covers it:
“Some apps can make a fake naked picture of anyone from a normal photo. If anyone ever sends you one of you, or of someone you know, or says they’ll post one, you won’t be in trouble for telling me. We’ll get it taken down together. Don’t pay anyone and don’t send anything back.”
That last part does a lot of work. Thorn found that 62% of young people said they would tell a parent if they were targeted, but only 34% of the ones it had actually happened to did. The gap between those two numbers is mostly fear, and you can shrink it before anything happens.
The FTC’s advice for kids themselves is short: don’t make or share explicit images or deepfakes, even as a joke; say no when someone asks for an explicit picture; and tell a trusted adult about any explicit content of themselves or a friend. If your kids are younger, our guide on teaching kids about online scams covers how to pitch these conversations by age, and the broader tween and teen internet safety guide walks through privacy settings that make the raw photos harder to collect.
For something to keep on the fridge, our one-page guide to the scams that reach a teenager’s DMs includes sextortion alongside the fake job offer and the “just send me the code” trick, with a printable sheet.
Practice helps too. A family that has rehearsed a calm “stop, don’t pay, come get me” response once will run it better under pressure than one that only talked about it. That’s the whole idea behind a scam drill for the household: low-stakes practice so the real thing isn’t the first time.
What to do now
If this is happening right now, go back to the first-hour list and work through it in order. The single most important thing on it is the first one.
If it isn’t, three small things are worth doing this week. Find where the intimate-image report option lives on the two or three apps your kid uses most, so you aren’t hunting for it at midnight. Save 1-800-843-5678 in your phone as NCMEC. And have the two-minute conversation above, preferably in the car, where nobody has to make eye contact.
The law gives you a deadline you can hold a company to. It doesn’t give you a guarantee that every copy disappears. Between the two, the thing that most changes how this goes for a kid is whether an adult they trust hears about it in the first hour, and stays calm when they do.