How to handle a takedown request in 48 hours

Step 1: Make sure you notice the request immediately

Most missed deadlines happen because a request sat unread in a general inbox over a weekend.

• Send requests to an address or tool that alerts a person, not a shared inbox nobody watches.
• Name a backup person for weekends and holidays.
• Set reminders before the deadline, for example at 24 hours and 6 hours left.

Step 2: Confirm receipt and give a reference number

Reply straight away with a reference number and what happens next. People reporting intimate images are often in distress; a quick, human confirmation matters, and the FTC recommends tracking numbers.

Step 3: Check that the request is valid

A valid request includes a signature, enough information to find the content, a good-faith statement that it was shared without consent, and the requester's contact information.

• If something is missing, ask for it quickly. Don't let an incomplete request sit.
• Don't demand proof of identity beyond what's reasonable, and don't ask the person to send you the image.
• When the content appears to be non-consensual, removing it in good faith is protected under the Act, even if it later turns out otherwise.

Step 4: Remove the content, and the copies

• Remove or disable access to every reported item.
• Make reasonable efforts to find known identical copies: re-posts, quotes, attachments, galleries, cached thumbnails.
• Fingerprint (hash) the images before deleting them, so re-uploads can be caught automatically.
• Look at the account that posted it: repeat offenders may need a ban under your rules.

Step 5: If a minor may be involved

Treat it as the top priority. Remove it at once, do not download or forward the content, and remember that US providers have separate legal duties to report apparent child sexual abuse material to NCMEC's CyberTipline. Get legal advice.

Step 6: Tell the requester the outcome

Say what you removed, or clearly explain why you didn't and what they can do next. The FTC recommends telling requesters the status, and it stops the same person having to report again.

Step 7: Record everything

For each request keep: when it arrived, when you acted, what you decided, what you told the requester, and who handled it. Timestamps are your evidence that you met the 48-hour window.

Automate the boring parts

TakeDown Kit runs this process for you: a hosted request form, instant alerts, a live 48-hour countdown, reminder emails, automatic replies to requesters, re-upload blocking, and a timestamped audit trail you can export. The core is free.