Maurice St Matthews
University of New Haven
AI-generated image-based sexual abuse (AI-IBSA) is an advancing form of technological gender-based violence with victims documenting psychological, professional, and safety concerns (Lazard et al., 2025; Henry et al., 2026). In 2023, deepfake pornographic content online increased by 550% since 2019, with 98% classified as non-consensual intimate imagery (NCII), and 99% targeting women (Security Hero, 2023). Nevertheless, the United States lacks a federal framework that requires online platforms to preemptively respond to AI-IBSA. Current state laws are jurisdictional but fragmented and have existed before the popularization of generative artificial intelligence (GenAI). The TAKE IT DOWN Act (2025) criminalizes NCII but an absence of proactive compliance requirements for online platforms remains. The Digital Service Act (DSA) implemented within the European Union (EU) demonstrating criminal liability for AI-IBSA has no United States counterpart. This brief recommends that the Senate Judiciary Subcommittee on Privacy, Technology, and Digital Services develop legislation for implementing a conditional accountability model, effectively requiring online platforms to comply with federally defined standards in AI-IBSA detection and reporting to maintain their Section 230 immunity. This approach draws from the proven effectiveness of mandatory child sexual abuse material (CSAM) reporting requirements led by the National Center for Missing and Exploited Children (NCMEC) while maintaining immunity through the proportional approach of the EU’s DSA model.
Background of the Problem
AI-based sexual abuse (AI-IBSA) refers to the generation or the distribution of sexual or intimate imagery, often depicting an identifiable individual using artificial intelligence tools, such as generative diffusion models, face-swapping software, and commercial nudification software (Umbach et al., 2024). The key distinction between technological-facilitated sexual violence (TFSV), such as AI-IBSA and traditional image-based sexual abuse (IBSA) is the latter involves authentic media shared without consent (Flynn et al., 2025). The realism of AI-generated images has increased the production of deepfakes, broadly defined as fabricated media that “plausibly depict a real, identifiable person saying or doing something they did not say or do” (Henry et al., 2026, p. 1). Simply, an authentic intimate image of a victim does not have to exist because full artificial construction employs the victim’s likeness.
This distinction is necessary given that AI-IBSA victims cannot dispute an image as fake due to its hyper-realism (Security Hero, 2023). McGlynn and Rackley (2017) theoretically frame IBSA as all non-consensual production and distribution of intimate imagery. The researchers contend that infringements of dignity, privacy, and sexual autonomy unite to produce a form of cultural harm beyond the individual, thus reinforcing the broader concerns of gender inequality (McGlynn and Rackley, 2017). AI-IBSA harm does not imply that the perpetrator will be a technology expert, necessarily use victims’ authentic intimate images, nor do they need to be in the same place as the target (McGlynn & Rakley, 2024; Umbach et al., 2024).
Scale and Prevalence
AI-IBSA has increased dramatically along with the use of GenAI. Hawkins and colleagues (2025) assert that the elevated use of AI models caused a direct increase in their misuse, such as an 87% year-over-year increase in sexually explicit deepfake production from 2022 to 2023. Security Hero (2023) found there are 95,820 deepfake video online a gross 500% increase since 2019, wherein 98% were non-consensual media, and 99% targeted solely women. In 2025, an estimated eight million deepfakes have been shared, significantly higher than the 500,000 shared in 2023 (Negreiro, 2025). A survey of 16,000 respondents from 10 countries conducted by Umbach and colleagues (2024) found that 2.2% reported non-consensual intimate image (NCII) victimization. Similarly, Henry and colleagues’ (2026) survey of 7,231 respondents in the U.S., U.K., and Australia found that 3.1% of individuals reported creating AI-generated sexual imagery of themselves. Non-consensual imagery perpetration and its victimization online are rising, and concerns of consent are necessary in addressing its prevalence (Henry et al., 2026; Negreiro, 2025; Umbach, 2024).
Perpetrators and the Victims
Women who are public figures, journalists, and minors are disproportionately the victims of AI-IBSA (Lazard et al., 2025). When McGlynn and colleagues (2021) interviewed IBSA victims they identified five categories of harm: social rupture, harm constancy, existential threat, isolation, and constrained liberty. Such harms not only produce depression, anxiety, reductions in activities of public life, and workplace consequences, but do not require the victim to have seen the imagery (Henry et al., 2026; Lazard et al., 2025). While women are typically victims of AI-IBSA, men under the age of 35, those who are BIPOC, and those with disabilities were significantly more likely to perpetrate such behaviors are more likely to be the perpetrators (Henry et al., 2026; Umbach et al., 2024).
Flynn and colleagues (2025) interview NCII perpetrators and identified motivations for creating NCII, such as curiosity in the technology and taking revenge either against former partners or for unrequited romance. Yet, this harm is not unique to private individuals. According to the American Sunlight Project (2024), there were more than 35,000 references of NCII portraying twenty-five congresswomen and one congressman, demonstrating that one in six congresswomen are victims of AI-IBSA. Both members of the Senate Judiciary Subcommittee, their staff, and private citizens are all potential targets. Puglielli and Craanen (2025) report that nudification AI software is advertised on popular social media platforms and can be found on search engines such as Google. Given this, platforms are more than passive hosts of sexual abuse content but active participants in their production as social media promotion of these programs allow mutual profit by corporations over private and public citizens (Flynn et al., 2025).
Policy Gap
Currently, the U.S. does not require online platforms to proactively monitor, identify, remove, and report AI-IBSA. Rather, each state possesses some form of non-consensual pornography statutes, often passed before the advent of GenAI (Umbach et al., 2024). Many of these laws require prosecutors to prove intent to perpetrate, but they do not hold the platforms accountable for the distribution of NCII (Umbach et al., 2024). The Communications Decency Act’s (1996) Section 230 gives immunity to online platforms from being liable for the content posted by their users, thus giving platforms little incentive to actively monitor or remove harmful content beyond what violates their terms of service (Brannon & Holmes, 2024). The TAKE IT DOWN Act (2025) is a meaningful step to address this concern as it criminalizes NCII creation and sharing, and it requires platforms to follow takedown requests within a 48-hour period. Despite this there are no true legal consequences for failing to follow these requests given platform immunity nor are platforms forced to preemptively find and remove NCII (Qiwei et al., 2025). As platforms bare no liability for implementing measures to detect AI-IBSA, victims are largely responsible for protecting themselves (Sundberg, 2025).
Pre-Existing Policies
Section 230 of the Communications Decency Act (1996)
The Communication Decency Act (1996) explains that online platforms are not the publisher of the content uploaded by their users. This provided an incentive to the early internet community to self-regulate with minimal fear of being liable for online publishing (Brannon & Holmes, 2024). Legal interpretation of the act states that online platform immunity applies even when they are notified of harmful or potentially illegal content, simply, platform inaction is legitimate. Moreso, the absence of AI-IBSA centered policy provides a contemporary legislative oversight that must be updated to combat this increasing harm (Sundberg, 2025). Since immunity applies even after platforms are made aware of specific harmful content, any update design must encourage platforms to invest in methods that proactively detect harmful content and support victims throughout the process (Shaheen, 2024). Brannon and Holmes (2024) explain that legal scholars and jurists have voiced concerns that Section 230’s immunity goes beyond what the law has intended, thus providing further reason to consider a legislative review.
FOSTA-SESTA (2018)
At the time of writing, the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA-SESTA) is an exception to Section 230’s immunity, as platforms can be held liable in sex trafficking cases (Albert, 2022). FOSTA-SESTA demonstrates that Section 230’s immunity can be amended but compels us to consider errors when legal reforms are implemented. Goldman (2022) highlights this through FOSTA’s unintended consequence wherein connecting what platforms know about online content to criminal liability only incentivizes them to monitor less, effectively deflecting responsibility. Additionally, mainstream platforms began to employ umbrella deflections, leading to the removal of legitimate content while perpetrators migrated to platforms who remained unaccountable for third-party content (Delacey, 2022). Jurecic (2022) notes that while excessive content removal or over-filtering was a response to FOSTA, harmful services merely moved to other areas outside its jurisdiction. Advocacy groups have recorded over-filtering, along with FOSTA, negatively affected consensual sex workers as opposed to sex traffickers, and found the act was seldom used for prosecution. (Fuentes, 2025; Musto, 2021).
State Non-Consensual Pornography Laws
Each state, along with DC, has some form of NCII legislation. However, due to their legal diversity and specific to the needs of their respective state, there are gaps in coverage and enforcement. Similar to Section 203, most of these state laws were carried out before the popularization and commercial use of GenAI, nor do they specifically address AI images. Many of these laws require proof of intent to harm, which is difficult to ascertain as NCII creation can be for aesthetic purposes not injury (Viola & Voto, 2023). Furthermore, state laws do not hold the platform accountable and are jurisdictionally limited, as a perpetrator, victim, and the server of the platform can be found in different locales that would go beyond a single state’s power making enforcement difficult (Sundberg, 2025).
TAKE IT DOWN Act (2025) & DEFIANCE Act (2025)
The TAKE IT DOWN Act (2025) is a significant federal law in efforts to combat form of NCII, such as AI-IBSA. With almost unanimous votes in both chambers, there is strong bipartisan support in developing responses to NCII (Killion, 2025). TAKE IT DOWN (2025) criminalizes authentic and constructed NCII, requiring its online removal within 48-hours after a victim reports it (Killion, 2025). While the law recognizes the importance of addressing NCII, it possesses some structural limitations to hold platforms accountable. For instance, if a platform neglects to comply with the 48-hour removal requirement, they may face FTC sanctions, but their immunity will remain. (Brannon & Holmes, 2024). TAKE IT DOWN (2025) does not require proactive detection to combat AI-IBSA as the notice and removal condition shifts the burden of reporting on the victims themselves. The DEFIANCE Act (2025) would permit victims to take legal action against the actual person who produces or distributes NCII. Similar to the TAKE IT DOWN Act, the DEFIANCE Act (2025) does not have platform compliance rules, nor is their immunity impacted by their behavior. These existing laws represent tremendous steps toward combatting NCII and AI-IBSA but fall short as they do not hold the online platforms as structurally accountable.
Current Policy Options
Cohen and Felson’s (1979) Routine Activities Theory (RAT) is suitable in assessing the accountability of platforms. Based on this theory, changes in social routine activities influence the convergence of a motivated offender, a suitable target, and the lack of capable guardianship, which affect crime rates (Cohen & Felson, 1979). AI-IBSA in cyberspace reflects increased opportunities for harm perpetrated by online users against others as platforms are incapable guardians due to the absence of preemptive NCII monitoring (Laskovtsov & Boyle, 2025). Reducing the opportunity to perpetrate digital harm would require increasing proactive platform obligations over reactive victim-initiated solutions.
Option 1: Remove Section 230 Immunity
Eliminating Section 230 immunity for online platforms will make them directly vulnerable to lawsuits from NCII victims regardless of whether the platform generated the content as outlined by FOSTA-SESTA. The success of FOSTA-SESTA demonstrates that Section 230 immunity can be adjusted when it comes to harmful content. As online platforms move from passive and permissive spaces to accountable guardians, incentives for stronger content moderation will increase to deflect legal complications (Laskovtsov & Boyle, 2025). However, documented failures of FOSTA-SESTA imply this approach should not be the sole solution (Albert, 2022). Moreso, platforms may over-filter by removing non-harmful material driving online sex workers, into riskier offline environments and perpetrators to other online platforms to avoid legality (Delacey, 2022).
Option 2: Mandatory Standards
Another option would require platforms above a specified threshold (monthly active users or annual revenue) to set up AI detection tools specifically for AI-IBSA in addition to maintaining victim reporting portals. Non-compliance with reporting requirements would initiate civil penalties without eliminating immunity. This approach is structurally similar to the current reporting procedure for CSAM to the NCMEC. NCMEC’s online tipline received 20 million reports in 2024, signifying reporting at large scales is feasible and can provide actionable intelligence for law enforcement (NCMEC, 2024). Since the NCMEC CSAM reporting model has existed for decades and is well-integrated with compliance systems, this option would enhance victim focused frameworks, which is a feature that retains Section 230 immunity. However, detecting AI-IBSA is more difficult than detecting known CSAM because the uniqueness of GenAI imagery cannot be matched against a database of pre-identified content if it never existed (Steinebach, 2023). Moreso, a compliance threshold based on size would only motivate perpetrators to move to platforms that fall under the threshold.
Option 3: Compliance for Immunity
This brief recommends the option of establishing a conditional immunity framework where platforms can preserve immunity if they undergo certification and maintain compliance with federal minimum standards. Platform certification must follow specific stipulations: (1) a takedown process necessitating online platforms to address confirmed cases of AI-IBSA within the original 48 hour period as consistent with the TAKE IT DOWN Acts’ existing framework (TAKE IT DOWN ACT, 2025); (2) A proactive detection where NCII AI detection tools are scaled to the platform, with large platforms having more stringent standards similar to what the EU Digital Services Act requires for Very Large Online Platforms (VLOP) (Wolters & Zuiderveen Borgesius, 2025); (3) Agreeing to have a compliance officer to enforce AI-IBSA standards; (4) Lastly, platforms must provide yearly reports on victims-initiated requests for removals, the platform response time, and information about the content removed.
Continuous fulfillment of these requirements allows the platform to preserve immunity. Platforms failing to satisfy these requirements become liable for AI-IBSA content whether through detection or victim-initiated reporting. Small platforms will have proportional requirements as an attempt to avoid favoring larger platforms that can easily afford compliance penalties. Enhancing the platform’s guardianship capabilities will disrupt further opportunities to perpetrate digital harm, with the added benefit of victim protection (Cohen & Felson, 1979).
Advantages and Disadvantages
The table below provides a concise comparison of the specified policy options regarding their advantages and disadvantages:
| Option 1: Section 230 Removal | Option 2: Mandatory Standards | Option 3: Conditions for Immunity | |
| Advantages | Congress’ precedent, FOSTA-SESTA, allows suspension of immunity given harmful content (Albert, 2022). Represents a robust financial deterrent as platforms subject to civil suits to produce incentives to implement safeguards. No new regulation framework is needed as legal liability is introduced, not adherence to standards. | Follows NCMEC CSAM required reporting, with proven implementation on large scales (NCMEC, 2024). Centers the victim as the foundation for the infrastructure with measures of accountability (DEFIANCE ACT, 2025; Shaheen, 2024) Retains immunity but gives penalties to platforms for failing to comply with reporting procedures. | Conditional immunity is based on proactive victim protection system and preventing the known harms of FOSTA-SESTA (Jurecic, 2022). Preemptive platform monitoring along with victim-based reporting (DEFIANCE ACT, 2025; Shaheen, 2024). Adopts EU DSA scalable and proportional tiered approach (European Commission, 2026). |
| Disadvantages | Weak evidence base given FOSTA-SESTA outcomes (e.g., over-filtering) (Jurecic, 2022; Goldman, 2022). “Moderators’ dilemma” makes liability based on what the platforms know about harmful content, thus motivates platforms to reduce moderation (Goldman, 2022). Victims must initiate civil suits (DeLacey, 2022). | Technological NCII detection is difficult as PhotoDNA hash matching only works with known images, not unique AI images (Steinebach, 2023). Size thresholds motivate perpetrators to move to smaller platforms without them. Large platforms with financial capital can pay civil penalties, making penalties a weak motivator in combatting AI-IBSA (Wolters & Zuiderveen Borgesius, 2025). | Requires a strong enforcement system, one that clearly defines certification standards. Technical limitations in proactive detection of AI-IBSA (Steinebach, 2023). |
Evidence-based Assessment
Option 1 is only partially supported by evidence. While amending Section 230 is possible through legislation, the outcomes of FOSTA-SESTA as shown by research suggest that this approach is a weak model for combatting AI-IBSA on online platforms (Albert, 2022; Fuentes, 2025; Jurecic, 2022). Moreso, removing immunity may allow victims to bring civil or criminal suits against online platforms, but this forces victims to initiate litigation.
Option 2 is substantially evidence-based. The NCMEC model employs a successful reporting model based on evidence from the EU DSA’s proportional platform regulation framework (European Commission, 2026; NCMEC, 2024). While it preserves immunity, this option allows for civil penalties. The limitations of image hashing for AI-based images and false positives make AI-IBSA detection technology inaccurate, which is a developing area (Steinebach, 2023). Yet, these penalties may be inefficient for larger platforms who can afford costs and size thresholds will merely motivate perpetrators to smaller platforms.
Option 3 takes the most effective parts of NCMEC mandatory reporting and the EU DSA which are both known to work in practice (European Commission, 2026; NCMEC, 2024). This option is victim-centered and is politically feasible (NCMEC, 2024). Similar to option 2, the accuracy in detecting technology needs to be resolved and for option 3 to be successful, the certification standards need to be clearly defined in implementation and not with the policy.
Recommendation
The present brief recommends that the Senate Judiciary Subcommittee on Privacy, Technology, and the Law propose a law for online platforms to undergo conditional immunity certification and compliance as a response to combatting AI-IBSA. Option 3 represents the best evidence informed option as mandatory reporting requirements can be implemented on a large scale as shown with the EU DSA VLOP (European Commission, 2026; NCMEC, 2024). This united approach prevents the known failures of FOSTA-SESTA (Jurecic, 2022; Goldman, 2022). By strengthening online governance, it moves platforms from online passivity to victim support systems, which will reduce the likelihood of perpetration (Cohen & Felson, 1979). By making online platforms maintain standard reporting portals, promptly respond to victim notices in the 48-hour frame, and implement proactive monitoring relative to the platforms’ size. This minimizes, if not fully remove, victims as responsible for reporting their own victimization while addressing McGlynn et al.’s (2021) structural asymmetry and the burdens victims experience with reporting (DeLacey, 2022).
There was almost full agreement when it came to passing the TAKE IT DOWN Act (2025). This demonstrates that there are strong bipartisan support and recognition of NCII, and AI-IBSA by extension, as a critical problem. Setting certification and compliance as a prerequisite to immunity avoids the pitfalls of complete erasure. Since implementation is scalable, the tiered standards help stop large platforms from having an unfair fiscal advantage. These regulations help ensure that larger platforms, who may have hosted the most NCII and generate the most money from high user engagement, will face the most stringent compliance regulations (European Commission, 2026; Wolters & Zuiderveen Borgesius, 2025).
The FTC should be the main enforcement agency, with the DOJ as a supporting agency. To ensure platforms are eligible and compliant with conditional immunity, platforms should submit annual reports to the FTC regarding the number of reports received and the number resolved. Serious reports of AI-IBSA should be escalated to federal law enforcement in accordance with other laws, such as FOSTA-SESTA. While real-time detection technology is a limitation, submitting annual reports to the FTC would require more feasible platform monitoring. For instance, failing to comply with the TAKE IT DOWN ACT (2025) would initiate an FTC response but will keep their immunity. For conditional immunity, platforms that fail to meet requirements will similarly face FTC penalties, along with risking immunity revocation. This aligns with managerial regulation wherein self-reports by agencies need independent auditing to ensure that an agency is compliant with specific stipulations (Coglianese & Lazer, 2003).
Annotated Bibliography
Albert, K. (2022). Five reflections from four years of fosta/sesta. SSRN Electronic Journal. https://doi.org/10.2139/ssrn.4095115
Albert (2022) critically analyzes the consequences of FOSTA/SESTA, referring to it as a “one two punch,” meaning it is a combination of federal criminal liability and minimal amendments to Section 230. The amendments allow the removal of legitimate content, which moves sex workers from safe online spaces to more dangerous ones. This supports the observation that online platforms leverage legal risk as a cover to remove content, which was motivated by concerns of sexual promiscuity than what is legally necessary.
American Sunlight Project. (2024). 1 in 6 congresswomen targeted by AI-generated sexually explicit deepfakes. The Markup. https://themarkup.org/artificial-intelligence/2024/12/11
This is investigative report that found that there were more than 35,000 uses of NCII from 11 popular deepfake platforms, which used the likeness of 26 (25 woman and 1 man) members of Congress. NCII and AI-IBSA are not harmful to only private citizens but to members of Congress as well.
Brannon, V., Holmes, E. (2024). Section 230: An Overview. Library of Congress. https://www.congress.gov/crs-product/R46751
Provides an overview of Section 230; information about its enactment, how the court interprets the immunity provided by this law, and what has been proposed for reforming it. This reform contains the concern that immunity goes beyond what the law intended, contributing to discussion of this law and its implications for policy.
Coglianese, C., & Lazer, D. (2003). Management-Based Regulation: Prescribing Private Management to Achieve Public Goals. Law & Society Review, 37(4), 691–730. https://doi.org/10.1046/j.0023-9216.2003.03703001.x
Regulations for management require organizations to plan according to goals. Coglianese and Lazer (2003) find that management-based regulation is best when businesses, such as online platforms, are different from one another.
Cohen, L. E., & Felson, M. (1979). Social change and crime rate trends: A routine activity approach. American Sociological Review, 44(4), 588-608.
Cohen and Felson’s (1979) Routine Activities Theories (RAT) explain that crime occurs when a motivated offender, a suitable target, and the lack of capable guardianship converge. Changes in social routines are changes in opportunities that affect the convergence of the elements and thus the occurrence of crime. Applying RAT to platform accountability means opportunities to perpetrate NCII, and victimization is the consequence of platforms’ weak governance (the same as a lack of suitable guardianship).
DeLacey, H. (2022). A critical analysis of the enactment of the allow states and victims to fight online sex trafficking act of 2018. International Journal of Gender, Sexuality and Law, 2(1), 100–139. https://doi.org/10.19164/ijgsl.v2i1.1257
DeLacey (2022) explains that automatic moderation has a high level of error and that it specifically has difficulty in detecting suggestive language. Euphemism detection is hard to accomplish and creates over-censoring. The article shows that these concerns existed before passing FOSTA-SESTA but were largely neglected by lawmakers.
European Commission. (2026). The digital services act. European Commission. https://digital-strategy.ec.europa.eu/en/policies/digital-services-act
The Digital Service Act (DSA) is proof of a regulatory framework for online platforms within the European Union and efficacy of a tiered conditional liability framework that requires platforms, based on their size, to address abuse when they become aware of it. This demonstrates that conditional immunity, scaled by platform size, is possible and viable.
Flynn, A., Powell, A., Eaton, A., & Scott, A. J. (2025). Sexualized deepfake abuse: Perpetrator and victim perspectives on the motivations and forms of non-consensually created and shared sexualized deepfake imagery. Journal of Interpersonal Violence. https://doi.org/10.1177/08862605251368834
Flynn and colleagues (2025) noted that there are differences in the perpetrators and victim relationships. There are four motivations for IBSA: sextortion, curiosity, causing harm, and peer reinforcement. This article helps build an idea of who AI-IBSA victims and perpetrators are, and what the motivations for committing NCII may be.
Fuentes, K., Levitt, L., Soriano, K. et al. SESTA/FOSTA as de Facto Hate Policy: Combatting Carceral Investments and Uplifting Community-Based Solutions. Sex Res Soc Policy 22, 1705–1716 (2025). https://doi.org/10.1007/s13178-024-01075-3
Fuentes and colleagues (2025) conduct a systematic literature review of nine empirical studies examining the impacts of FOSTA-SESTA. They argue it functions as a hate policy towards the LGBTQ+ community and other minoritized groups because it neglects harms that were initially raised. This strengthens the argument that having less access to online spaces shifted online workers to physical spaces, thus increasing their contact with physical harm.
Goldman, E. (2022). The complicated story of fosta and section 230. First Amend Law Review. https://scholarship.law.unc.edu/falr/vol17/iss2/8/
Goldman (2022) evaluates FOSTA’s consequences in a legal and operational frame, presenting the “moderators dilemma,” where making platforms criminally liable for the harm they know only motivates them to minimize their own moderation. Goldman (2022) makes the argument that FOSTA only re-produced the concerns that Section 230 was argued to have solved, only proving the need for stronger policy design.
Hawkins, W., Mittelstadt, B., & Russell, C. (2025). Deepfakes on Demand: The rise of accessible non-consensual deepfake image generators. Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency, 1602–1614. https://doi.org/10.1145/3715275.3732107
Hawkins and colleagues (2025) conduct a metadata on two big AI model repositories: Civitai and Hugging Face, finding over 30,000 publicly available deepfake models that have nearly 15 million downloads since 2022. The researchers find that 96% of the AI models target women and signal the ability to create sexual NCII. AI-IBSA is a growing harm and requires enforcement.
Henry, N., Umbach, R., Shelby, R., Beard, G., & Given, L. M. (2026). ‘It’s still abuse’: community attitudes and perceptions on AI-generated image-based sexual abuse. Information, Communication & Society, 1–21. https://doi.org/10.1080/1369118X.2026.2613437
Henry and colleagues (2026) conduct a survey (n = 7,231) in the U.K. U.S., and Australia, and find that 3.1% of respondents reported creating GenAI sexual images of themselves. Researchers also found that men, individuals under 35, and individuals who have disabilities were more likely to report being perpetrators. This article further helps build an idea of how NCII is used.
Jurecic, Q. (2022). The politics of Section 230 reform: Learning from FOSTA’s mistakes. Brookings Institution. https://www.brookings.edu/articles/the-politics-of-section-230-reform-learning-from-fostas-mistakes/
This explains the history, implementation, and impact of FOSTA SESTA. Jurecic (2022) found that after its passing, online platforms began to over-filter. The Government Accountability Office and advocacy organizations found that FOSTA-SESTA harmed populations, namely sex workers, it was made to protect. The findings support the recommended approach.
Laskovtsov, A., & Boyle, K. M. (2025). Explaining Image-Based Sexual Abuse: An Application of Cyber Routine Activity Theory. Victims & Offenders, 20(5–6), 1059–1085. https://doi.org/10.1080/15564886.2025.2485125
Laskovtsov and Boyle (2025) apply RAT to IBSA victimization. They conduct a survey of adult women from 18 to 24 in the U.S. and test RAT on elements (e.g., creation, dissemination, threats, and sextortion). After using logistic regression, they found that spending time online and sexting can significantly predict IBSA victimization validating core RAT elements.
Lazard, L., Capdevila, R., Turley, E. L., Gilfoyle, K., & Stavropoulou, N. (2025). Deepfake technology and gender-based violence: A scoping review. Trauma, Violence, & Abuse, 15248380251384271. https://doi.org/10.1177/15248380251384271
Lazard and colleagues (2025) support viewing AI-IBSA as gendered-based violence given NCII victims are largely women. They highlight that deepfake abuse silences women who go against cultural and religious beliefs while NCII is used to reinforce patriarchal power. This further highlights women as victims of AI-IBSA but demonstrates it is systemic.
McGlynn, C., Johnson, K., Rackley, E., Henry, N., Gavey, N., Flynn, A., & Powell, A. (2021). ‘It’s torture for the soul’: The harms of image-based sexual abuse. Social & Legal Studies, 30(4), 541–562. https://doi.org/10.1177/0964663920947791
Based on the first cross-national study on AI-IBSA victimization and interviews with victim survivors from three different countries (U.K., Australia, and New Zealand), McGlynn and colleagues (2021) identify five categories of harm: social rupture, constancy, existential threat, isolation, and constrained liberty. McGlynn and colleagues (2021) demonstrate that harm is critical to warrant preemptive platform obligations and not victim-initiated solutions.
McGlynn, C., Rackley, E., & Houghton, R. (2017). Beyond “revenge porn”: The continuum of image-based sexual abuse. Feminist Legal Studies, 25, 25–46.
McGlynn and colleagues (2017) present the concept of IBSA as a model to understand non-consensual creation and sharing of explicit imagery, contending that this type of harm spans physical, mental, sexual, and dignity. This further supports the argument that AI-IBSA is a form of gendered violence, which needs a proactive response.
Musto, J., Fehrenbacher, A. E., Hoefinger, H., Mai, N., Macioti, P. G., Bennachie, C., Giametta, C., & D’Adamo, K. (2021). Anti-trafficking in the time of fosta/sesta: Networked moral gentrification and sexual humanitarian creep. Social Sciences, 10(2), 58. https://doi.org/10.3390/socsci10020058
The researchers examine FOSTA-SESTA arguing that while it intended fight against online sex trafficking it actually harmed victims. They draw from ethnographies and interviews with sex workers and argue that FOSTA-SESTA creates a “networked moral gentrification” wherein moral values are placed on minoritized groups through online governance. Demonstrates that laws intended to achieve safety can have a backfire effect, and too much immunity can lead to removing legal sexual expressions.
National Center for Missing and Exploited Children. (2024). CyberTipline 2024 report. NCMEC. https://www.missingkids.org/gethelpnow/cybertipline/cybertiplinedata
The CyberTipline (2024) reports the operation and amount of mandatory online platform reporting systems for CSAM, including the reports received. NCMEC is responsible for CSAM reporting and support evidence for recommending mandatory platform reporting requirements as fulfillment for conditional immunity.
Negreiro, M. (2025). Children and deepfakes. European Parliamentary Research Service. https://www.europarl.europa.eu/thinktank/en/document/EPRS_BRI(2025)775855
The European Parliamentary Research (EPR) (2025) explains an excessive growth in deepfakes, explaining that eight million deepfakes were shared in 2025, 98% were pornographic, and 17% were fabricated explicit content of minors. Negreiro (2025) explains how detection technology is underdeveloped compared to the GenAI tools itself, with no present solution existing. This supports the logic of stronger online platform design and governance in lieu of real-time detection.
Puglielli, C., Craanen, A. (2025). The ecosystem of nonconsensual intimate deepfake tools online. Institute for Strategic Dialogue Global. https://www.isdglobal.org/digital-dispatch/the-ecosystem-of-nonconsensual-intimate-deepfake-tools-online/
This report examines the online environment of instruments used to generate NCII. The report identifies 31 websites and notes that X makes up for over 70% of the advertisements for these platforms, which are easily accessible through search engines like Google. Attempts to monitor the platform are subpar. The harms of AI-IBSA and NCII are very diverse, encompassing PTSD, job loss, reclusion from online spaces, and in some cases suicide, demonstrating the proactive platform blocking.
Qiwei, L., Kennon, K., Bedera, N., Eaton, A. A., Gilbert, E., & Schoenebeck, S. (2025). Platforms as crime scene, judge, and jury: How victim-survivors of non-consensual intimate imagery report abuse online. arXiv. https://doi.org/10.48550/ARXIV.2512.13500
Qiewei (2025) explains that the process for taking down NCII is a lot of work, especially for the victims as they must provide evidence of their victimizations themselves. In fact, the victims are forced to file multiple reports on multiple platforms, which vary in reporting requirements. There is no existing tool that ensures that duplicated NCII can be found and removed for the victims, even when the offender suffers legal action.
S.146 – 119th Congress (2025-2026): TAKE IT DOWN Act. (2025).
Provides an overview of the TAKE IT DOWN Act; it provides information about criminal repercussions of generating and distributing NCII. Stipulates that when victims request the removal of media, platforms must comply within 48 hours. Supports the recommended option because the act has existed for decades, demonstrating that it can be implemented within online platforms.
S.1837 – 119th Congress (2025-2026): DEFIANCE Act of 2025. (2025). https://www.congress.gov/bill/119th-congress/senate-bill/1837/text
The DEFIANCE Act (2025) proposes that states federal civil action for explicit NCI, including money for damages, a decade for statute of limitations, and pseudonyms for plaintiffs to ensure confidentiality. Congress documents the psychological harms and professional consequences that affect AI-IBSA but is used to demonstrate its inability to provide platform compliance requirements or condition the immunity provided by Section 230 based on the platform’s behavior.
Security Hero. (2023). 2023 State of deepfakes realities, threats, and impact. https://www.securityhero.io/state-of-deepfakes/#concluding-remarks
There was a more than 500% increase in explicit NCII from 2019. The 2023 annual report identifies statistics, such as how many videos are online, the percentage of non-consensual pornography, and who is most likely to be perpetrators. This provides the prevalence of deepfakes, which is used as a reference for this brief.
Shaheen, L. (2024). Section 230’s immunity for generative artificial intelligence. Seattle Journal of Technology, Environmental, & Innovation Law 15(1). https://digitalcommons.law.seattleu.edu/sjteil/vol15/iss1/7
Shaheen (2024) explains that the courts have consistently resolved cases with immunity for online platforms rather than against it, demonstrating that the law gives these platforms a shield from taking accountability. Shaheen (2024) contends that immunity is broad and produces adverse outcomes, connecting to the argument that the current system would not be enough to motivate platforms for proactive detection.
Sundberg, Trudi K. (2025). Federalizing NCII regulation: The take it down act’s approach to criminalization, platform liability, and threats to disseminate. Georgia Law Review: 59 (3), 9.
Sundberg (2025) explains the TAKE IT DOWN Act which criminalizes NCII. Before the act, regulation was largely left to the states with no standard, and Section 230 continued to be left with no liability for hosting harmful content. Yet, Sundberg (2025) argues that the law has too many weaknesses, such as poor safeguards and would not stand up to strict legal review.
Umbach, R., Henry, N., Beard, G., and Berryessa, C.M. (2024). Non-consensual synthetic intimate imagery: prevalence, attitudes, and knowledge in 10 countries, in Proceedings of the CHI Conference on Human Factors in Computing Systems. https://doi.org/10.1145/3613904.3642382.
Umbach and colleagues (2024) surveyed (n = 16,000) from ten countries to examine respondents’ attitudes and awareness of NCII. They find that 2.2% of the respondents reported being victims of AI-IBSA. Survey design shows how victimization may be a growing and global concern.
Viola, M., & Voto, C. (2023). Designed to abuse? Deepfakes and the non-consensual diffusion of intimate images. Synthese, 201(1), 30. https://doi.org/10.1007/s11229-022-04012-2
Viola and Voto (2023) find that those who generate NCII are not motivated by the “aesthetic” of the media itself, rather it is about the feeling of being close and intimate. This further clarifies the motivations for AI-IBSA and counterargues the belief that GenAI intimate image production is solely for “beauty.”
Wolters, P., & Zuiderveen Borgesius, F. (2025). The EU Digital Services Act: What does it mean for online advertising and adtech? International Journal of Law and Information Technology. 33. https://doi.org/10.1093/ijlit/eaaf004
The study provides more assessment of the Digital Service Act tiered and size requirements, explaining how the act gives more stringent requirements for Very Large Platform (VLOsP) and Very Large Online Search Engines. The mere implementation of such a large-scale act demonstrates its feasibility.