Security 1 publisher2 min readPublished September 19, 2026 at 9:48 AM PDT

TAKE IT DOWN Act gives platforms 48 hours to remove a reported AI nude

ESET's guidance puts the US removal deadline at 48 hours from a valid request, and the study it cites counts 181 nudify sites drawing 40 million visits a month, so the filing path has to exist first.

The Watch · Security desk

Illustration accompanying TAKE IT DOWN Act gives platforms 48 hours to remove a reported AI nude

What happened

The TAKE IT DOWN Act lets a victim of non-consensual intimate imagery, including AI-generated images, require a platform to remove it within 48 hours of a valid request.
The Institute for Strategic Dialogue and the AI Security Institute counted 40 million unique visitors a month across the nudify sites they identified.
Nearly half of US teens said in a 2025 report that they had seen AI-generated explicit material.

Compiled by The WatchSomething wrong?How this is made

Why it matters

constraint The deadline is counted in hours, not business days, so the person who files and chases the request has to be reachable on a weekend.
exposure Anyone whose photographs are publicly reachable online is in range of these tools without any account compromise or access to a device.
decision Because the remedy runs on the victim's request, an employer's only useful preparation is deciding in advance who sits with the person depicted while they file.
precedent Once the EU directive is transposed, a targeted person in Europe also gets a criminal route, and its terms will depend on which member state they are in.

The 48-hour window in the TAKE IT DOWN Act begins when a valid request reaches the platform ^[1]. ESET's guidance repeats the statutory condition that the request be valid, and does not define validity ^[19]. The hours before that belong to the person depicted: finding the copies, then keeping the messages, usernames, URLs, screenshots and dates ^[8].

The Institute for Strategic Dialogue and the AI Security Institute identified 181 websites offering these tools ^[5], drawing 40 million unique visitors a month ^[6]. That averages about 221,000 visitors per site ^[17]. Four social platforms sent 4.255 million more: YouTube 1.8 million, X 1.3 million, Reddit 691,000 and Facebook 464,000 ^[7]^[16].

ESET tells targets never to engage with the person making the threat, on the grounds that engagement emboldens further demands or triggers wider sharing ^[9]. The takedown requests go to each platform or site hosting the image ^[20]. StopNCII.org alerts its member platforms by creating and sharing a unique hash of the image ^[10], and NCMEC's Take It Down service does the same for images of children ^[11].

In the US, no federal law explicitly prohibits the apps; the legal exposure attaches to the images they are used to create and distribute ^[2]. State laws vary ^[3]. Nudified images of children are classed as child sexual abuse material under Title 18 of the United States Code and can be reported to the Cyber Tipline ^[4]. The EU directive on combating violence against women and domestic violence will criminalise making and distributing non-consensual intimate imagery, including AI-generated images, but member states have to transpose it, so the offence, the terminology, the reporting mechanism and the penalties will differ by country ^[12].

The advice itself is written for individuals and families: restrict who can view your photos, review what images of you are public beyond social media, talk to your children about the apps ^[13]. Nearly half of US teens told a 2025 report they had seen AI-generated explicit material, and a quarter of those who had seen AI pornography said it depicted themselves or someone they know ^[14]^[15]. The same removal path applies when the person depicted is an employee or an executive, and as the statute is described here the request is the victim's to make ^[1]. An employer that wants the 48 hours to count needs the evidence preserved and the filing route known before the first report arrives.

What to watch

Whether a published case sets out what counts as a valid TAKE IT DOWN request, which is the trigger for the 48 hours.
Which EU member states transpose the directive first, and what reporting mechanism each one names.
Whether a repeat of the ISD and AISI count moves the 181 sites and the 40 million monthly visitors up or down.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The TAKE IT DOWN Act empowers victims of non-consensual intimate imagery, including AI-generated images, to request that the platform remove it within 48 hours, as long as the request is valid.
ReportedSupportedView cited source
[2]
In the US there is no federal law explicitly prohibiting 'nudify' apps; the legal question concerns the images they can be used to create and distribute.
ReportedSupportedView cited source
[3]
US state laws on this vary.
ReportedSupportedView cited source
[4]
Images that nudify children are classed as child sexual abuse material, governed by Title 18 of the United States Code, and can be reported to the Cyber Tipline.
ReportedSupportedView cited source
[5]
A study from the Institute for Strategic Dialogue and the AI Security Institute identified 181 websites offering nudify tools.
ReportedSupportedView cited source
[6]
Those 181 sites received 40 million unique visitors per month.
ReportedSupportedView cited source
[7]
Millions more visitors came from social media platforms: YouTube 1.8 million, X 1.3 million, Reddit 691,000 and Facebook 464,000.
ReportedSupportedView cited source
[8]
ESET advises preserving evidence by keeping any relevant messages, usernames, URLs, screenshots and dates.
ReportedSupportedView cited source
[9]
ESET advises never engaging with the person threatening you with nudified images, because it will only embolden them to continue with their demands, or potentially trigger them into sharing the image more widely.
ReportedSupportedView cited source
[10]
Third-party services such as StopNCII.org can alert their members when there is an issue with an AI-generated nude, by creating and sharing a unique hash with them.
ReportedSupportedView cited source
[11]
NCMEC's Take It Down service does the same hash-sharing for images of children.
ReportedSupportedView cited source
[12]
In the EU, a directive on combating violence against women and domestic violence will make it a criminal offence to make and distribute non-consensual intimate imagery including AI-generated images, but member states must transpose the directive into national law, so the precise offence, terminology, reporting mechanisms and penalties will vary.
ReportedSupportedView cited source
[13]
ESET's risk-reduction advice includes restricting who can view your photos and contact details on social media, reviewing what images of you or your family are publicly available online beyond social accounts, using unique passwords, 2FA and automatic updates, not uploading images to AI or other apps unless essential, and talking to children about nudify apps.
ReportedSupportedView cited source
[19]
ESET's account of the TAKE IT DOWN Act conditions the 48-hour removal on the request being valid and does not define what makes a request valid.
ReportedSupportedView cited source
[20]
ESET advises contacting the platforms or websites on which the image has appeared and requesting that it be taken down.
ReportedSupportedView cited source
[16]
The four named social platforms account for 4.255 million visits a month to nudify sites.
DerivedSupported1 source— sign in to open
[17]
The 181 identified sites average about 221,000 unique visitors a month each.
DerivedSupported1 source— sign in to open
[14]
According to one 2025 report, nearly half of US teens claim to have seen AI-generated explicit material.
ReportedInsufficientView cited source
[15]
A quarter of those who have seen AI pornography admitted it depicted themselves or someone they know.
ReportedInsufficientView cited source

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

For anyone running a surface that accepts user uploads, the usable parts here are mechanical: a 48-hour removal clock that starts on a valid request, and two hash-matching services that hand a platform a detection signal without the image itself changing hands — StopNCII.org for adults, NCMEC's Take It Down for minors. ESET did not look at how the 181 nudify sites are built, hosted or paid for, so there is no supply-side detail to work with.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence45

0100

One vendor post, two uncited studies

Every figure and every legal reading in this story arrives through ESET's own blog. The 181 sites and the 40 million monthly visitors are credited to the Institute for Strategic Dialogue and the AI Security Institute, relayed without a link or a date, and the teen-exposure numbers to "one 2025 report" with no title attached. The statutory points are the sturdier half: the TAKE IT DOWN Act, Title 18 for material involving children and the EU directive's transposition requirement are all checkable against the texts, but no second outlet in our coverage has checked them.

Adoption45

0100

Traffic measured on the tool side only

The traffic figures here measure the nudify sites themselves: 181 sites, 40 million unique visitors a month, and 4.255 million further visits referred by four large platforms. Evenly divided, that is roughly 221,000 visitors per site per month. ESET did not disclose how that traffic breaks down by site, nor any figures for the other side of the ledger -- requests filed under the Act, deadlines met, or hashes propagated through StopNCII.org and NCMEC.

Hype gap+15