PROVIDENCE, R.I. [Brown University] — In May 2025, the TAKE IT DOWN Act became the first federal law to address deepfakes and other forms of AI-generated nonconsensual intimate images. The law criminalizes the distribution of “revenge porn,” including AI-generated material, and requires social media platforms and other websites to promptly remove the material upon request.
A new analysis by Brown University researchers finds that the deepfakes federal law — and the state laws that came before and after — do not adequately address the sprawling digital ecosystem that enables this form of AI-generated sexual abuse. The study attempts to fully map that ecosystem, the researchers say, in an effort to provide guidance for policymakers and others to better address the problem.
Led by computer scientists from Brown’s Center for Technological Responsibility, Reimagination and Redesign, the study was presented on Saturday, Nov. 7, at the 2026 ACM Conference on Equity and Access in Algorithms, Mechanisms and Optimization. Members of the research team and a pair of Brown undergraduates also created an interactive companion website with the hope of raising awareness about AI-enabled abuse and the harms it causes.
“The core issue is that deepfake abuse is not just about one image, model, website or app, but an entire ecosystem,” said Michelle Ding, a computer science Ph.D. student at Brown and the study’s lead author. “In order to protect vulnerable communities online from the various types of harms and emotional distress that can come from this form of abuse, we must first see this ecosystem clearly.”
AI-generated nonconsensual intimate images aren’t especially new. The study notes that an early proliferation occurred in 2017 on Reddit, when people used face-swap technology to create nude images of celebrities. The emergence of generative AI models and other technologies has supercharged the phenomenon. In 2025, users on the social media site X used Grok AI to create thousands of sexual images of mostly women and girls. Today, AI “nudifier” apps, which can create explicit pictures and videos in seconds, are commonplace — often available in mainstream smartphone app stores.
To map this new and emerging ecosystem of AI-generated nonconsensual intimate images, the researchers drew upon the academic literature, law and policy reports, news stories and other sources. The result is a taxonomy of 11 technology categories that span five distinct roles in the deepfake landscape. The roles include image creation (which involves technologies like the AI models themselves, user interfaces and training datasets); distribution (social media and private messaging apps); discovery and proliferation (search engines, app stores and deepfake communities on social media); infrastructure and support (developer platforms like GitHub and Civitai); and monetization (credit card companies and processors).
To understand how all of these roles and categories fit together, the researchers explored the deepfake ecosystem enabled by X’s Grok. According to the research, Grok’s X-based interface enabled users to access the Grok AI model (creation) to make nonconsensual sexual images just by tagging Grok in X posts with phrases like “put a bikini on her” or “remove her clothes” Grok dutifully responded by posting images directly in X comment threads (distribution). Meanwhile, a community sprang up on the Telegram messaging app (proliferation and discovery) in which users figured out how to make even more explicit images and videos by jailbreaking a Grok interface available for purchase (payment processors) in app stores.
The researchers went on to analyze 64 state and federal laws that address AI-generated nonconsensual images. They found that over 92% of them target individual creators and distributors of abuse material, while barely addressing the larger technological ecosystem. That, the researchers say, sets up an endless game of “whack-a-mole” that chases individual creators and images across the web.
That scattered approach is “simply not enough to prevent abuse at this scale,” Ding said. “Grok was generating over 6,000 images every hour last December. We need to shift our focus to the technical infrastructure enabling and profiting from this abuse.”
