Discovering an intimate image of yourself online can make every next step feel urgent and uncertain. The image may be real, altered, or entirely AI-generated. It may have been posted by an ex-partner, an anonymous account, an extortionist, or someone you do not recognize. None of that makes the abuse your fault.
The fastest useful response is not to argue publicly about whether the image is authentic. It is to start an intimate image removal request, preserve enough information to prove what happened, limit further distribution, and escalate if the platform does not act. A federal rule now gives people in the United States a clearer platform-removal path, but the phrase "48-hour rule" needs careful explanation. It is a deadline for covered platforms after they receive a valid request. It is not a promise that every copy will disappear from the internet in two days.
Table of Contents
Key Takeaways
- A covered platform must complete intimate image removal for a qualifying depiction as soon as possible, and no later than 48 hours after it receives a valid removal request.
- The federal process covers real intimate images, digitally altered images, and AI-generated deepfakes that depict an identifiable person.
- A valid request needs a signature, enough information to locate the content, a brief good-faith statement that the publication was nonconsensual, and contact information.
- The platform must make reasonable efforts to identify and remove known identical copies, but cropped, edited, re-encoded, or newly generated versions may require additional reports.
- Keep a private incident log with URLs, usernames, submission times, confirmation emails, and case numbers. Avoid downloading, forwarding, or reposting explicit material, especially when anyone shown was under 18.
- People depicted under 18 can use NCMEC's Take It Down service. Adults can consider StopNCII. These intimate image removal tools limit spread on participating services but do not erase material from the entire internet.
What the 48-Hour Rule Actually Requires
The federal TAKE IT DOWN Act created an intimate image removal duty for covered online platforms. The enacted Public Law 119-12 says a platform must provide a clear process through which an identifiable person, or an authorized representative, can report an intimate visual depiction published without that person's consent and request its removal.
After receiving a valid request, a covered platform must complete intimate image removal for the identified depiction as soon as possible and no later than 48 hours. It also must make reasonable efforts to identify and remove known identical copies. The Federal Trade Commission began enforcing this platform obligation on May 19, 2026.
The intimate image removal clock does not begin when you first see the image. It begins when the covered platform receives a valid request through its reporting process. That distinction matters. A vague abuse report, a public reply to the account that posted the image, or an email to an unrelated customer-support address may not qualify as the required request.
A valid intimate image removal request must include four basic elements:
- A physical or electronic signature from the person depicted, or from someone authorized to act for that person.
- Identification of the image or video and enough information for the platform to find it.
- A brief statement explaining the good-faith belief that the depiction was published without consent, including relevant context the platform can use to evaluate the request.
- Information the platform can use to contact the person making the request.
"Enough information to find it" will usually mean a direct post URL, image URL, video URL, account handle, group or channel name, and any visible date or post identifier. When a report form accepts attachments, use only what is necessary and safe. If the depicted person was under 18 when the media was created, do not screenshot, crop, download, forward, or otherwise copy the explicit depiction. Preserve the URL, username, timestamp, report menu, and non-explicit surrounding context instead. If you are unsure how to handle the file safely, contact NCMEC or use its CyberTipline support before taking another step.
The law's definition of a covered platform is broad enough to include many public-facing services that primarily provide forums for user-generated messages, images, videos, games, or audio. It also covers services whose regular business includes publishing or hosting nonconsensual intimate depictions. It excludes broadband internet access and email itself. A particular service's coverage can still depend on facts, so use the service's intimate image removal process first and preserve the response rather than trying to make a legal classification in the middle of a crisis.
What the Rule Does Not Promise
The federal intimate image removal requirement is powerful, but it is not a universal deletion button.
First, the intimate image removal duty applies to the covered platform that receives the valid request. If the same image appears on five unrelated services, each service may need its own report. A platform cannot delete a copy stored on someone else's server, in a private device backup, or on a service it does not control.
Second, the copy-removal duty focuses on known identical copies. A crop, mirror image, overlaid caption, altered frame, shortened clip, or newly generated deepfake may not be identical. Hash-matching systems can help, but no reader should assume one report will find every modified version.
Third, removing a result from a search engine is not the same as removing the source. Google's guidance on explicit-image removal explains that a removed search result can leave the underlying image available at the hosting website, through its direct URL, on social media, or through another search engine. Intimate image removal from the host and search de-indexing should be treated as parallel tasks.
Fourth, the rule does not replace a safety plan. If the posting is part of stalking, domestic abuse, coercion, or a credible threat of physical harm, getting to safety may be more urgent than perfecting a takedown form. If the poster is demanding money, more images, access to an account, or continued contact, treat it as extortion rather than a customer-service dispute.
Finally, removal does not answer every legal question. State criminal and civil laws vary. Copyright claims may be available in some situations, especially when the depicted person took the original photograph, but copyright is not the only route and may not fit an AI-generated image. A lawyer familiar with privacy, harassment, or image-based abuse can advise on a specific case.
First 30 Minutes: Stabilize and Preserve What You Need
Start the intimate image removal process by addressing risks that can grow while you are reporting the content.
If you believe the person who posted the image knows where you are, has threatened violence, has access to your home or accounts, or may contact your employer or family, reach a trusted person and consider local emergency or victim-support resources. Do not announce a location or safety plan in a channel the abuser may monitor.
Next, create a private incident log. Record:
- The direct URL of each post, page, image, or video.
- The platform name, account handle, display name, group, or channel.
- The date and time you found it, including your time zone.
- A short description that lets you distinguish one item from another.
- Any threat, demand, payment address, phone number, or contact method.
- The date and time of each report.
- Confirmation numbers, automated emails, and support replies.
During intimate image removal, preserve the surrounding context without increasing distribution. For adult content, a carefully limited record of the account, post URL, date, and report menu may help document what you saw without reproducing the intimate depiction. If the depicted person was under 18 when the media was created, do not screenshot, crop, download, forward, or otherwise copy the explicit depiction. Preserve URLs, identifiers, timestamps, confirmation records, threats, and non-explicit page context only. Contact NCMEC or its CyberTipline when you are unsure how to proceed. Avoid forwarding the material to friends for verification, and do not repost it to call attention to the abuse.
If the image came from a compromised cloud, social, or email account, secure the account in parallel with intimate image removal. Change the password from a trusted device, revoke unfamiliar sessions, review recovery email addresses and phone numbers, and turn on stronger authentication. The site's guide to passwords, passkeys, and two-factor authentication can help you make those changes without relying on a single password reset.
Do not pay an extortionist on the theory that payment guarantees deletion. Payment can confirm that you are reachable and may lead to more demands. Preserve the demand and the destination for payment, then report the account and contact law enforcement as appropriate.
How to Submit an Intimate Image Removal Request
For intimate image removal, look for a reporting option specifically labeled nonconsensual intimate imagery, intimate image abuse, sexual content posted without consent, synthetic sexual content, or deepfake sexual content. A general harassment report may not collect the details needed to start the 48-hour process.
If you are signed in, the correct tool may appear in a three-dot menu beside the post. If you do not have an account, search the platform's help center for its off-platform report form. The FTC's image-based abuse guidance says you can report a platform to the FTC if it requires you to create an account simply to make the intimate image removal request, if you cannot find the process, or if the process is broken.
Complete every required field in the intimate image removal report. Use the exact location of the material, not just the poster's profile page. If there are multiple posts, list each URL when the form allows it or submit a separate request for each one. State plainly that you are identifiable and that publication was without your consent. For a deepfake, state that the content falsely depicts you in an intimate or sexually explicit situation and was published without your consent.
Ask the platform to remove known identical copies. The platform has that obligation under the federal process, but explicitly including the request helps create a clear record.
After submission, save the confirmation page and email. Note the platform's received time, not merely the time you began filling out the form. Add 48 hours using the same time zone. If the platform does not provide a timestamp, record your submission time and retain any browser confirmation or sent message that supports it.
Do not repeatedly submit the same intimate image removal report every few minutes. Duplicate tickets can make your record harder to follow. Submit a complete request, preserve proof, and use the platform's escalation channel if the deadline passes or if the report is rejected for a correctable reason.
A Practical Removal Request Template
Use the platform's dedicated intimate image removal form whenever possible. Follow its required physical or electronic signature mechanism. Do not assume that typing a name into an unrelated support message will satisfy the platform's process. If the dedicated form offers a free-text field, the following language includes the core information without turning the report into a long narrative:
> I am requesting intimate image removal for the intimate image or video at [direct URL or post ID]. I am the person depicted, and I have a good-faith belief that this depiction was published without my consent. [If applicable: The depiction is digitally altered or AI-generated and falsely shows me in an intimate or sexually explicit situation.] Please remove the identified depiction and make reasonable efforts to identify and remove known identical copies. You may contact me at [contact information]. I electronically sign this request as [full name or authorized representative's name].
Add only the context needed to evaluate consent and find the item. For example, you can say that an image shared privately with one person was never authorized for public posting. You do not need to prove that you made every possible privacy choice correctly. Consent to create an image, or to share it privately with one recipient, is not consent for public distribution.
If someone is acting for you, identify that person as your authorized representative and follow any authorization steps required by the form. The Act permits an authorized person to submit the intimate image removal request, which can be useful when completing the report yourself would be unsafe or overwhelming.
Real Image, Altered Image, or AI Deepfake
Intimate image removal is not limited to a stolen photograph. Federal and FTC guidance includes real images, digitally altered images, and deepfakes generated with artificial intelligence. The practical question is whether the content depicts an identifiable person in an intimate way and was published without that person's consent.
For a real image, describe the lack of publication consent. For an altered image, identify the alteration if you can do so briefly. For a fully synthetic image, state that it uses your recognizable face, body, name, voice, or other identifying characteristics to falsely depict you.
Do not let the poster shift the dispute into a public argument over whether the image is "technically fake." A fabricated sexual image can cause the same privacy, reputation, safety, and coercion problems as a stolen one. The relevant intimate image removal report should focus on identification, intimacy, nonconsensual publication, and the exact location.
If you are also dealing with fake voice clips, messages, or impersonation outside the intimate-image context, the AI Fraud and Deepfakes hub provides a broader verification and response framework. Keep those related impersonation reports separate enough that the platform can understand which content is subject to the intimate-image request.
If You Were Under 18 in the Image
The age that matters for the hashing tool is your age when the image or video was taken, not your age today. Someone who is now an adult can still use the minor-specific route for material created when they were under 18.
For material created when the depicted person was under 18, NCMEC's Take It Down service can support intimate image removal by creating a digital fingerprint, called a hash, on your device. The service is free, and the image or video does not leave the device. NCMEC shares the hash with participating public or unencrypted platforms, which can use it to detect matching files and take action.
Use the service only for a file already on your device. NCMEC specifically warns people not to download, forward, or share an explicit image just to submit it. If you do not already have the file, use NCMEC's CyberTipline or seek help through its support resources instead of creating a new copy.
Take It Down supports intimate image removal, but it is not a substitute for the direct platform request. A participating service may detect an exact match, but an existing post may still need a report. The tool does not scan encrypted surfaces, every website, or every device.
If a child or teenager tells you this happened, avoid blame and interrogation. Help preserve URLs and threats without asking the child to send you the explicit image. A trusted adult can assist with the platform request, and reports involving minors can also go to NCMEC and law enforcement.
If You Were 18 or Older in the Image
Adults pursuing intimate image removal who already possess the image or video can consider StopNCII's on-device hashing process. The service creates a hash on the device and sends the hash, not the intimate media, to its system. Participating platforms can compare uploads against that fingerprint and act when a match violates their policies.
Save the case number and PIN. StopNCII says the credentials cannot be recovered if lost, and you need them to check the case or withdraw it.
StopNCII does not remove an image from the entire internet. Its reach depends on participating platforms, and exact or detectable matches are easier to catch than heavily transformed copies. Use it alongside direct intimate image removal reports, not instead of them.
Be careful with any private company that promises guaranteed worldwide deletion for an urgent fee. Verify who operates the service, what data it collects, whether you must upload the actual media, which platforms participate, and what happens to your information. The Privacy and Identity Protection hub offers a useful lens for evaluating what personal data a recovery service asks you to provide.
Remove Search Visibility Separately
After requesting intimate image removal from the host, check whether the post appears in search results for your name, username, or the page title. Search removal can reduce discovery while the source report is pending.
Google accepts requests involving real personal sexual content and fake sexual or nude content that depicts an identifiable person. A person shown in the content or an authorized representative can submit the request. Keep a list of the exact search-result and image URLs included in the submission.
Remember the boundary: search removal can support intimate image removal, but it does not delete the source file. Continue pursuing the hosting platform or site owner. If the host removes the content but an old result remains, use the search engine's outdated-content refresh process.
During intimate image removal, avoid repeatedly conducting broad image searches in a way that exposes you to the material. A trusted representative can help monitor specific URLs. Set a limited schedule for checking results rather than making the search a continuous task.
When the Platform Misses 48 Hours
At the intimate image removal deadline, first verify the record. Confirm that the platform received a request containing the signature, exact content location, good-faith nonconsent statement, and contact information. Check whether it sent a request for missing information and whether you answered it.
If the platform has not completed the required intimate image removal, including its reasonable efforts concerning known identical copies, use the FTC's TAKE IT DOWN Act complaint route. You can also report a missing or broken request process. Include the platform name, content location, date and time of the original request, confirmation number, and the status you observed after the deadline.
An FTC report helps the agency enforce the platform obligation. It does not itself delete the image in real time, so continue the platform escalation and keep logging responses.
If copies are spreading to new services, open a separate entry for each host. Reuse the factual core of your request, but update the URLs, account identifiers, and received times. This creates a manageable incident map rather than one undifferentiated list.
For complex intimate image removal cases involving state-specific rights, restraining orders, subpoenas, civil claims, or questions about preserving evidence for litigation, consult a qualified lawyer or victim-support organization. This guide explains a general federal removal process and is not individualized legal advice.
If There Are Threats, Blackmail, or Immediate Danger
Intimate image removal and perpetrator reporting are separate. The FTC advises reporting perpetrators to local criminal law enforcement and the FBI. If someone threatens to distribute an image unless you pay, send more content, provide passwords, or continue a relationship, preserve the threat and report it.
Do not promise secrecy to a minor who is being extorted. Explain that you will involve only people who need to help keep them safe. Report exploitation involving a minor through NCMEC's CyberTipline and appropriate law enforcement.
Protect connected accounts. Review logged-in sessions, recovery contacts, forwarding rules, shared cloud albums, and app access. If personal documents or identity information were also exposed, use the Identity Theft Response Checklist to separate image-removal work from financial and identity recovery.
Consider whether the abuser can see your location, shared calendars, family plans, or device notifications. Turn off unsafe sharing only from a device the abuser cannot monitor. In a coercive-control situation, abrupt account changes can sometimes alert the abuser, so a local victim advocate can help plan the safest sequence.
A Two-Day Removal Checklist
Hour 0: Find the exact location
- Record the direct URL, platform, account, date, and time.
- Preserve threats and reporting context without redistributing the image.
- Address immediate physical safety.
Hour 1: Start the formal requests
- Use the platform's dedicated intimate image removal process.
- Include all four elements of a valid request.
- Save the received time and case number.
- Report search results separately when appropriate.
Day 1: Limit additional spread
- For an image made when you were under 18, consider NCMEC Take It Down without downloading or sharing a file you do not already possess.
- For an adult image already on your device, consider StopNCII.
- Secure compromised accounts and revoke unfamiliar sessions.
- Report threats, extortion, or exploitation through the appropriate channels.
Hour 48: Check and document
- Revisit the exact reported URLs.
- Record what was removed and what remains.
- Save platform replies and rejection reasons.
- Report a missed deadline, missing process, or broken process to the FTC.
After 48 hours: Continue by location
- Report new hosts and meaningfully altered copies separately.
- Refresh stale search results after host removal.
- Keep a private incident log and avoid repeated public engagement.
- Seek legal or victim-support assistance when the situation involves ongoing harm, threats, or complex jurisdictional questions.
Conclusion
The 48-hour rule gives victims a concrete intimate image removal deadline and gives the FTC a way to hold covered platforms accountable. Its value is greatest when the request is complete and the response is documented.
Use a layered intimate image removal approach: request removal from the host, contain matching copies with the age-appropriate hashing service, reduce search visibility, secure compromised accounts, and report threats or noncompliance through the right channel. You do not have to prove the image is real to deserve help, and you do not have to manage every step alone.
For practical updates on AI-enabled abuse, privacy, and account recovery, subscribe at Quantum Cyber AI.
FAQ
Does the platform have 48 hours from when I discover the image?
No. For intimate image removal, the period begins when a covered platform receives a valid removal request. Preserve the submission confirmation and received time. A request should include a signature, enough information to locate the content, a good-faith statement that publication was nonconsensual, and contact information.
Does the rule cover AI-generated nude deepfakes?
Yes. FTC guidance says the process applies to real images, digitally altered images, and AI-generated deepfakes. State that the depiction is fabricated, identifies you, shows you in an intimate or sexually explicit situation, and was published without your consent.
Will one request remove every copy from the internet?
No. The platform must remove the identified depiction and make reasonable efforts regarding known identical copies. Other hosts, private copies, encrypted channels, and altered versions may require separate action.
Should I download the image to preserve evidence?
Avoid creating or distributing unnecessary copies. Record URLs, account information, timestamps, report confirmations, and surrounding context. If the image shows someone who was under 18 when it was made, do not download or forward it just to use a hashing service. Use NCMEC's reporting and support routes.
What if the platform asks me to create an account?
Look for an off-platform help-center form. FTC guidance says a platform can be reported if it requires account creation to submit the intimate image removal request, if the process cannot be found, or if the process is broken.
Can someone submit the request for me?
Yes. The federal process allows an authorized person to act for the individual depicted. The representative should identify the authorization and follow the platform's verification steps.