The tools to fabricate anyone’s sexual likeness now fit in a smartphone. The law, the platforms, and the industry itself are only beginning to reckon with what that means.
She has spent years navigating the particular risks that come with being a woman whose face and body are publicly visible online… Morgpie has won multiple Pornhub awards and built a substantial following across free onlyfans and Twitch.
But when users on X began prompting Elon Musk’s Grok AI to generate explicit images of real women without their consent, the scale of what she was watching felt different.
“With deepfakes, you can make anybody do anything,” she told KQED’s Close All Tabs podcast in May 2026. “So you have the control over this other person.”
Control is exactly the right word. Deepfake technology did not create non-consensual intimate imagery — the theft and misuse of sexual images long predates AI. But it severed the last remaining barrier: the requirement that the victim have been photographed at all.
The Numbers Behind a Gendered Crisis
The scale of the problem is not in dispute, even if its precise contours are difficult to pin down. According to data compiled by cybersecurity firm DeepStrike and cited by KQED, roughly 97% of all deepfakes online fall under non-consensual intimate imagery. The victim profile is not random.
Between 99% and 100% of deepfake pornography victims are women, according to multiple independent analyses reviewed by The Global Statistics — a figure that has held consistent across years of research.
The volume has grown at a pace that outstrips any reasonable enforcement model. From an estimated 14,000 videos in 2019, deepfake content reached approximately 500,000 files shared on social platforms in 2023 alone, according to detection firm DeepMedia — with projections placing the 2025 figure at 8 million files.
Deepfake pornography volume specifically rose 464% between 2022 and 2023, according to figures reviewed by The Global Statistics.
In early 2025, the UK Internet Watch Foundation detected 1,286 illegal AI-generated child sexual abuse videos in a single reporting period.
The 2024 International AI Safety Report, compiled by researchers across multiple institutions and reviewed by a panel of AI experts, found that 15% of UK adults reported having seen deepfake pornographic images — a figure that, if representative, translates to millions of people encountering fabricated sexual content of real individuals as a routine part of their online experience.
A peer-reviewed survey of over 16,000 respondents across 10 countries, published in the ACM CHI Conference proceedings in 2024, put the self-reported victimization rate at 2.2%.
The same study found that existing legislation in countries with specific laws had not meaningfully deterred perpetration — respondents reported similar rates of both creating and experiencing deepfake pornography regardless of whether they lived in jurisdictions with legal prohibitions.
What the Law Now Says — and What It Cannot Do
For most of the technology’s existence, victims in the United States had to rely on a patchwork of state statutes that varied enormously in scope, definition, and enforcement.
That changed on May 19, 2025, when President Trump signed the TAKE IT DOWN Act — the first federal law specifically targeting non-consensual intimate imagery, including AI-generated deepfakes.
The law passed with near-unanimous bipartisan support: 409-2 in the House, unanimous in the Senate. It criminalizes the knowing publication of non-consensual intimate visual depictions and deepfakes intended to cause harm, with penalties of up to two years’ imprisonment for content involving adults and three years for minors.
Critically, it requires covered platforms — public websites and mobile applications that host user-generated content — to implement notice-and-takedown systems and remove flagged content within 48 hours of a valid report. That platform compliance requirement came into force on May 19, 2026.
The first conviction under the law came in April 2026. An Ohio man was found guilty of using AI to create and distribute non-consensual intimate imagery targeting adults and children in his neighborhood — a case that revealed, in the words of First Lady Melania Trump, who had championed the legislation, exactly the kind of community-level harm the law was designed to address.
What the law does not do is prevent the tools from existing. The AI systems capable of generating non-consensual intimate imagery remain legal to build, distribute, and operate.
The TAKE IT DOWN Act addresses the publication and distribution of the resulting content — not the upstream generation pipeline.
As MultiState noted in its 2026 deepfake policy analysis, legislators are now expected to broaden their approach to target generative AI platforms, payment processors, and hosting services — but that expansion remains prospective.
Civil remedies lag further still. The DEFIANCE Act — which would give victims a federal cause of action with statutory damages up to $250,000 — was reintroduced in May 2025 after failing to pass the House in 2024. As of mid-2026, it has not passed.
Platforms: Policy Without Infrastructure
OnlyFans, whose model is built on verified human creators selling access to their own content, updated its policies in 2026 to explicitly ban deepfakes, require AI content disclosure, and introduce annual creator re-verification.
The platform claims its automated detection system identifies deepfakes with 95–98% accuracy at upload, according to The Creator Report’s analysis of the policy rollout.
The gap between that claim and real-world conditions is worth examining. Independent research reviewed by the World Economic Forum found that AI deepfake detection tools drop 45–50% in performance when applied to real-world content outside controlled laboratory conditions.
The same research literature that underpins platform confidence in AI moderation also documents that deepfake creation tools are improving faster than detection systems — a dynamic that cybersecurity researchers have characterized, bluntly, as a cat-and-mouse game that the cats are currently losing.
Futurism’s reporting documented a case that illustrated the gap in practice: a UK-based OnlyFans creator named Bunni discovered that a scammer had stolen her content, used deepfake tools to swap her face for an AI-generated one, and built an entirely new fraudulent persona — “Sofía,” supposedly a 19-year-old in Spain — selling fake subscriptions and deceiving subscribers.
The theft was not of Bunni’s intimate images; it was of her body, monetized under someone else’s synthetic face. No deepfake detection system caught it.
The Consent Question That Precedes the Legal One
An academic paper published in New Bioethics in 2025 raised a question that the legislative conversation tends to sidestep.
Philosopher J.R. argued that accepting consensual online sex work while condemning non-consensual deepfake pornography contains a tension that neither side of the debate has fully resolved.
The paper does not defend deepfakes — it explicitly declines to — but it surfaces something real: that the ethical foundation of the adult content industry is consent, and that consent has never been reliably enforced by the market structures that profit from sexual content online.
Adult creators have been making this argument themselves, in more practical terms, for years. Morgpie’s observation — that the rise of platforms like OnlyFans represented women reclaiming control over their own images and their own revenue — is consistent with how many sex workers frame the value of creator platforms.
Deepfakes attack that framework directly, not just as illegal conduct but as a structural assault on the premise that consent is the organizing principle of online sexual content.
Zander Small, a cosplayer and software engineer who co-founded the creator protection tool Fanlock after his girlfriend experienced a deepfake attack, described the problem similarly to KQED: the harm extended well beyond professional adult content creators. His girlfriend made safe-for-work content. The deepfakes appeared anyway.
What Enforcement Actually Looks Like in 2026
The FTC entered the May 2026 platform compliance deadline with, in the words of StackCyber’s deepfake legislation tracker, an aggressive posture — issuing formal warning letters to major platforms and stating a willingness to pursue civil penalties.
What its first enforcement actions will look like is unknown; the legal framework is new enough that no precedent yet exists for how courts will interpret the TAKE IT DOWN Act’s platform obligations.
Internationally, the picture is more varied. The EU AI Act’s Article 50 requirements — mandating machine-readable labeling of all AI-generated content, with fines reaching €35 million or 7% of global annual turnover for violations — came into force in mid-2025 and apply to any company operating in Europe.
South Korea enacted what researchers have described as the world’s most comprehensive deepfake criminal law, criminalizing not only creation and distribution but also possession and viewing of sexual deepfakes, with a maximum prison term of seven years.
The UK’s Online Safety Act places legal duties on platforms to proactively detect and remove non-consensual deepfake content. France criminalized non-consensual sexual deepfakes with up to two years’ imprisonment and €60,000 fines.
The United States, by contrast, remains without a comprehensive AI governance framework. The TAKE IT DOWN Act is targeted and significant — but it is a single statute addressed at a specific harm, not a regulatory architecture for synthetic media.
The Infrastructure No One Is Regulating
Perhaps the most important structural gap in the current legal landscape is the one that legislators are only now beginning to acknowledge: the tools themselves.
As of mid-2026, “nudify” applications — software that generates synthetic nude images from clothed photographs of real people — remain widely available. A WIRED investigation found that Telegram-hosted nudify bots had reached approximately 4 million monthly users globally by late 2024.
The AI models powering them are open-source, trainable on consumer hardware, and distributed through channels that exist entirely outside platform terms of service.
A 2026 research paper reviewed by detection researchers at Adaptive Security noted that demographic bias compounds the detection gap: accuracy varies measurably by skin tone and gender, with darker-skinned subjects systematically underdetected across leading benchmarks.
The people most likely to be victimized, and least likely to have political leverage to demand protection, are also the people least well-served by the technical systems deployed in their name.
The legislative trajectory points toward expanding liability upstream — toward the platforms, payment processors, and cloud providers that make deepfake production economically viable at scale.
Whether that expansion arrives before the technology makes individual enforcement irrelevant is the question that the current round of legislation, for all its genuine significance, does not answer.
