The Law Changed. The Internet Didn't.
On May 19, 2025, the Take it Down Act was signed into law, creating federal criminal penalties for sharing nonconsensual intimate images, including AI-generated sexual deepfakes, and requiring covered platforms to remove reported content within 48 hours. The law, formally known as the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, passed with overwhelming bipartisan support and was widely celebrated as a long-overdue victory for survivors of image-based sexual abuse.
Image-based sexual abuse refers to the creation, sharing, or threatened sharing of intimate images without a person's consent. This can include authentic photographs and videos as well as AI-generated content designed to depict someone in sexually explicit or intimate imagery they never agreed to create. One increasingly common form of image-based sexual abuse involves deepfakes. A deepfake is an image, video, or audio recording that has been digitally created or manipulated using artificial intelligence to appear authentic. In cases of sexual exploitation, deepfake technology is often used to create nonconsensual sexually explicit content featuring real people.
Image-based sexual abuse is often dismissed as a technology issue, but its impact is deeply personal. Survivors may experience anxiety, depression, fear, reputational harm, social isolation, and a loss of control over their own image and identity. The effects can be especially devastating because digital content can be copied, saved, and redistributed indefinitely, creating ongoing uncertainty about who has viewed or shared the material.
The law represents meaningful progress. For years, survivors were told there was little that could be done when intimate images were shared without their consent. As technology evolved, legal protections struggled to keep pace. The Take it Down Act finally acknowledges what survivors and advocates have argued for years: image-based sexual abuse causes real harm and should be treated as more than a technology issue. At the same time, the law raises an important question. What happens when legal protections struggle to keep pace with rapidly evolving technology?
Technology has evolved at a pace that far exceeds the systems created to regulate it. In 2025, Hawkins, Russell, and Mittelstadt identified nearly 35,000 publicly downloadable deepfake-generation tools online that had been downloaded almost 15 million times. Their research found that 96% targeted women and that many were specifically designed to create nonconsensual intimate imagery. In other words, these tools allow users to take photographs of a real person and generate realistic-looking sexual images or videos that never actually occurred. The concern is no longer whether deepfakes can be created. It is how easy the technology has become to access and use. What once required specialized technical knowledge can now be accomplished with readily available software, a handful of photographs, and minimal effort.
The Take it Down Act requires platforms to remove reported content within 48 hours. While that requirement represents a significant improvement over previous reporting systems, it also highlights the reality of how quickly content moves online. Once an image is posted online, it can spread rapidly across platforms, making it difficult to contain even when removal requests are successful. By the time one copy is removed, additional copies may already exist elsewhere.
Research by Cuevas and Horta Ribeiro (2026) illustrates this challenge. After the passage of the Take It Down Act and the shutdown of MrDeepFakes, one of the internet's largest deepfake pornography websites, activity involving deepfake pornography did not disappear. Instead, it shifted. Their findings suggest that regulatory action and deplatforming often redistribute abuse rather than eliminate it entirely.
This is one of the central limitations of removal-based approaches. The law can require content to be taken down, but it cannot guarantee that content will disappear. Many survivors continue living with uncertainty long after an image is removed, never knowing who viewed it, saved it, or shared it elsewhere. The violation does not necessarily end when the post is deleted.
The law is also largely reactive. Survivors are often left to navigate the reporting process themselves, requiring them to locate the content, document the abuse, and repeatedly revisit a deeply harmful experience in order to seek removal. While stronger protections are important, much of the burden still falls on the person who was harmed.
None of this diminishes the significance of the Take it Down Act. Strong legal protections are necessary, and platforms have a responsibility to respond when abuse occurs. AI-generated sexual exploitation should not exist in a legal gray area simply because the technology is new. However, legislation alone cannot solve a culture that continues to treat consent as optional once technology enters the equation.
Technology did not create sexual violence, but it has expanded the ways harm can occur and increased the speed at which that harm can spread. The Take it Down Act is an important step forward, but it should not be mistaken for a complete solution. The law has changed. The internet has not.
Sources
Cuevas, A., & Horta Ribeiro, M. (2026). Deepfake Pornography is Resilient to Regulatory and Platform Shocks. arXiv.
Hawkins, W., Russell, C., & Mittelstadt, B. (2025). Deepfakes on Demand: The Rise of Accessible Non-Consensual Deepfake Image Generators. arXiv.
Leibert, D. (2025, August 26). Congress's Attempt to Criminalize Nonconsensual Intimate Imagery: The Benefits and Potential Shortcomings of the TAKE IT DOWN Act. National Association of Attorneys General.
U.S. Congress. (2025). Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks (TAKE IT DOWN) Act. U.S. Government Publishing Office. https://www.govinfo.gov/app/details/PLAW-119publ12