Analysis
Manhattan District Attorney Alvin Bragg seized twelve websites hosting AI-generated non-consensual sexual imagery, in what his office called the largest seizure of such sites in history, 404 Media reported. The sites depicted roughly 1,200 people -- actors, politicians, athletes, musicians, advocates and influencers, including the first ladies of multiple countries. The action relied on New York's 2023 statute criminalizing sexually explicit deepfakes.
Enforcement has accelerated sharply over eighteen months. MrDeepfakes.com, the category's largest site, shut down in May 2025. The DOJ and DHS seized two domains in June 2026. On September 9 this year, the first conviction under the federal Take It Down Act produced a fifteen-year sentence. What began as a civil-liability and platform-moderation problem is now a criminal-prosecution pipeline with case law behind it.
“MrDeepfakes.com, the category's largest site, shut down in May 2025.”
The pattern in these takedowns is that the sites are rarely running novel technology. They wrap open-weight image models with a payment processor and an affiliate funnel. That is why the enforcement vector is domains, hosting and payments rather than the models themselves -- the capability is unrestrictable once weights are public, and the distribution is very restrictable because it needs a card processor.
That structure explains why Microsoft's newly published AI code of conduct lists deepfake generation among its absolute constraints, alongside cyberattacks and nuclear weapons assistance. The firms shipping image generation at consumer scale are drawing the line themselves, partly because the alternative is a state attorney general drawing it for them with a subpoena attached.
For anyone building in generative media, the compliance surface is now concrete rather than hypothetical: provenance metadata, likeness consent workflows, and a takedown process with a response-time commitment. Those requirements arrive through customer contracts and payment processors long before they arrive through legislation, and a company that cannot answer them loses its processor, which ends the business faster than any prosecution.
