For years the law moved slower than deepfakes. That gap is closing. Since May, the Federal Trade Commission has been enforcing a federal rule that makes online services pull down intimate images posted without consent, including AI-generated fakes, within 48 hours. Europe has banned the "nudifier" apps that make them. And a federal bill on cloned voices and faces is working its way through Congress. If you run any website or app where users can post, or if your brand has a recognizable face or voice, this is now your business.
What happened
The FTC announced that it began enforcing the Take It Down Act on May 19, 2026, the law's compliance deadline for platforms. Covered services must offer a way for people to request removal of intimate images shared without consent, and must take them down, along with known identical copies, within 48 hours of a valid request. The agency launched a complaint site, TakeItDown.ftc.gov, and says Chairman Andrew Ferguson sent warning letters the week before to companies including Alphabet, Amazon, Apple, Meta, Microsoft, Reddit, Snapchat, TikTok and X. Ferguson said that "In the age of AI, anyone can be targeted."
The law is not just for social media giants. Law firm WilmerHale explains that a "covered platform" is any public-facing website or app that mainly hosts user-generated content, which can include gaming sites and message forums. It says violations are treated like violations of an FTC rule, with civil penalties of up to $53,088 per violation, and that the law's removal duty covers AI-generated content as well as real images. People who knowingly publish such images face criminal penalties.
Europe went further on the tools themselves. According to Lewis Silkin, this summer's update to the EU AI Act added a ban on AI systems used to generate non-consensual intimate imagery and child sexual abuse material.
Voice cloning is the gap. The Take It Down Act covers intimate images, not cloned voices used to sell products or scam customers. The proposed NO FAKES Act would create a federal right over digital replicas of a person's voice and likeness. IIPLA reports that it has backing from music companies, SAG-AFTRA and several tech firms, while digital rights groups worry it could chill lawful expression and the video game industry has raised concerns. It is not law yet. For now, voice protection comes mostly from a patchwork of state right-of-publicity laws.
Why it matters for your business
This is not legal advice, but there are three practical angles.
If users can post on your site, check whether you are a covered platform. A community forum, a review section with photo uploads or a members' area could qualify. You need a working removal process and the ability to act inside 48 hours.
If you make content with AI, consent is the line. Using a real person's face or voice in marketing without written permission was risky before. With state laws spreading and a federal bill pending, it is a lawsuit waiting to happen.
If you handle money, cloned voices are a fraud tool. Scammers can use them to impersonate an executive or a family member on the phone. The legal fight over voice rights does nothing to stop a scammer today. Your process has to.
What we'd do
- Audit your upload points. Any place the public can post images or video needs a visible report button and a named person who can remove content fast.
- Write the 48-hour playbook. Who receives the report, who decides, who removes it, how copies are found and how it is logged. WilmerHale stresses keeping records.
- Get written consent before using any real person's likeness or voice in AI-made content, employees included. Spell out where it will be used and for how long.
- Add a callback rule for payments. Any request to move money or change bank details by phone or voice message gets confirmed on a known number. No exceptions for the boss.
- Label your AI content. It is required for many uses in Europe and builds trust everywhere.
Our view
Critics of this wave of laws worry about overreach: fast takedown deadlines can push platforms to remove lawful content just to be safe, and a broad voice-and-likeness right could tangle up parody and news. Those concerns are fair, and the safe harbors in these laws will need watching. But the harm here is real and lopsided. Victims of fake intimate images had few fast remedies before. A 48-hour rule is a reasonable ask of any business that hosts other people's content. Our advice is simple: build the takedown process now, get consent in writing, and treat every urgent voice request for money as suspect until you call back.
Want a system like this in your business?
A discovery conversation is where we map it: what to automate first, where the human checkpoints go, and what it would take.
Book a discovery conversation →