Federal protections

A federal law requires covered online platforms to give you a way to ask them to remove intimate photos or videos of you shared without your consent, whether real or AI-generated, and to remove them, and known identical copies, within 48 hours of a valid request. The FTC has enforced this since May 19, 2026.

Who or what it protects

People shown in intimate images or videos shared online without their consent, including images that are fake or AI-generated, and children whose images are shared. It covers certain online platforms, such as social media, gaming apps and photo and video sharing sites, not every website, subject to the law's definitions and exceptions.

What you can do

First, use the platform's own process to ask it to remove the image; covered platforms must offer an easy way to ask. If the platform doesn't remove it within 48 hours of a valid request, or offers no way to ask, report the platform to the FTC at TakeItDown.ftc.gov. Sharing intimate images of someone without their consent, especially of a child, is a federal crime.

Limits and eligibility

The FTC's role is to hold covered platforms to the law: its site takes complaints about platforms that fail to act on a valid request or offer no way to make one. The 48-hour removal duty applies to covered platforms only.

Who oversees it

Federal Trade Commission

The law

TAKE IT DOWN Act (Public Law 119-12)

An Identity Protection PIN (IP PIN) is a six-digit number from the IRS that prevents someone else from filing a tax return using your Social Security number or ITIN. It is known only to you and the IRS.

Who or what it protects

Anyone who has a Social Security number or individual taxpayer identification number (ITIN) and can verify their identity. Parents and legal guardians can also request one for dependents. You don't have to be a victim of tax identity theft to get one.

What you can do

Request an IP PIN through your IRS online account, the fastest way. If you can't set up an online account, you may be able to apply with IRS Form 15227 if your income is below the IRS limit, or verify your identity in person at a Taxpayer Assistance Center. Use your IP PIN when you file your tax return. A new one is generated each calendar year.

Limits and eligibility

An IP PIN is valid for one calendar year. For anyone under 18, use one of the IRS's other ways to enroll, not the online account. The IRS sets who qualifies and how identity is verified.

Who oversees it

Internal Revenue Service

Federal law, mainly the Fair Credit Reporting Act, gives you free ways to stop new credit being opened in your name and rights to clean up your credit reports after identity theft.

Who or what it protects

Anyone can freeze their credit and anyone who is or may be affected by identity theft can place an initial fraud alert. Some rights, such as an extended fraud alert and blocking information that resulted from identity theft, are for people who have experienced identity theft and have an identity theft report.

What you can do

Freeze your credit for free at each of the three nationwide credit bureaus (Equifax, Experian and TransUnion); a freeze lasts until you lift it and doesn't affect your credit score. Place a free fraud alert by contacting one bureau, which must tell the other two: an initial alert lasts one year, and with an FTC identity theft report or police report an extended alert lasts seven years. A fraud alert lets you get free copies of your credit reports. You can ask a bureau to block information in your report that resulted from identity theft, and ask businesses for copies of applications and records for accounts opened in your name.

Limits and eligibility

A credit freeze stops new credit accounts in your name; it doesn't stop misuse of accounts you already have. For an extended alert or a block, the bureaus will ask for proof of your identity and an identity theft report, and a bureau can refuse or cancel a block in some cases. Businesses may ask for proof before giving you account records.

Who oversees it

Federal Trade Commission, Consumer Financial Protection Bureau

The law

Fair Credit Reporting Act

The Children's Online Privacy Protection Act Rule puts parents in charge of the personal information that websites, apps and online services collect from children under 13. A covered site must get a parent's consent before collecting, using or sharing a child's personal information.

Who or what it protects

Children under 13 and their parents. It covers sites and services, including apps, that are directed to children under 13, and general audience sites that know they are collecting personal information from a child that age. It is not a general privacy law for teenagers.

What you can do

Read the site's notice and decide whether to consent. You can agree to collection but refuse to let the site share your child's information with others. You can review the information a site collected about your child, withdraw your consent at any time, and have the information deleted. If you think a site or service is breaking the rules, report it to the FTC at ReportFraud.ftc.gov.

Limits and eligibility

If a site or service doesn't collect your child's personal information, COPPA doesn't apply. A site must confirm that you are the parent before it gives you access to your child's information.

Who oversees it

Federal Trade Commission

The law

Children's Online Privacy Protection Act / COPPA Rule (16 CFR Part 312)

FERPA gives parents rights over their children's education records at schools and colleges that receive U.S. Department of Education funds. The rights pass to the student at 18 or when the student enters a college or other postsecondary school.

Who or what it protects

Parents, and eligible students (18 or older, or attending a postsecondary institution at any age), at schools, school districts, colleges and universities that receive Department of Education funds.

What you can do

Inspect and review the student's education records; the school must let you within 45 days of your request. Ask the school to amend records you believe are inaccurate. Decide whether personal information from the records can be disclosed, except where the law allows disclosure without consent. If you believe your rights were violated, you can file a complaint with the Department of Education's Student Privacy Policy Office.

Limits and eligibility

FERPA applies only to schools and institutions that receive Department of Education funds, and the law allows some disclosures without consent. Once the rights pass to the student, they are the student's.

Who oversees it

U.S. Department of Education

The law

Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. §1232g; 34 CFR Part 99)

The HIPAA Privacy Rule gives you rights over health information held by health plans, most health care providers and the companies that work for them, including the right to see and get a copy of your health records.

Who or what it protects

People whose health information is held by health plans (including health insurers, HMOs, company health plans, Medicare and Medicaid), most health care providers, and health care clearinghouses, and by the business associates that work for them.

What you can do

Ask to see and get a copy of your health records; have corrections added; get a notice of how your information may be used and shared; decide whether to give permission before your information is used or shared for certain purposes, such as marketing; ask for limits on how it is used or shared; and get a report of when and why it was shared for certain purposes. If you believe your rights were denied, you can complain to your provider or health insurer and file a complaint with HHS.

Limits and eligibility

HIPAA covers only these organizations. Many others that have health information about you do not have to follow it, such as life insurers, employers, workers' compensation carriers, most schools and school districts, many state agencies such as child protective services, most law enforcement agencies, and many municipal offices.

Who oversees it

HHS Office for Civil Rights

The law

HIPAA Privacy Rule (45 CFR §164.524 (individual access right))