Your Face, Their Loophole: The Patchwork of Laws That Lets Nudify Apps Survive
Photo: Constitutional Court of Korea, Attribution, via Wikimedia Commons
Ask a random person on the street who owns their face and you'll get a puzzled look followed by a confident "I do, obviously." The law's answer is more awkward: it depends on which state you're standing in, whether you're famous, and whether the harm can even be measured in dollars.
That ambiguity isn't an accident. It's the business model.
The Phantom Shield of "Right of Publicity"
Every state recognizes some version of the right of publicity — the idea that you control the commercial use of your name, likeness, and image. Sounds airtight. It isn't.
The right originated to stop advertisers from slapping a celebrity's face on a cereal box without a check. It was built for commerce, not for a teenager in Ohio uploading a classmate's Instagram photo into an undressing bot. Most publicity statutes require a commercial use, and the defense bar for nudify-adjacent platforms has spent years arguing that a subscription fee for a "transformation tool" isn't quite the same thing as selling your likeness. Courts are split. Splits take years to resolve.
Then there's the famous-person problem. A handful of states — New York and California most prominently — have postmortem and broadened likeness protections, partly because those states run on celebrity. But for the vast majority of Americans in states with thin or common-law-only protections, the legal remedy for someone abusing their face is a patchwork quilt with most of the squares missing.
Section 230: The Wall Behind the Wall
Even where a state law might apply, platforms that host or distribute user-generated content have long sheltered behind Section 230 of the Communications Decency Act. The logic: the person who posts the harmful thing is liable, not the platform that carried it.
Nudify services have tried to stretch that logic to its breaking point. There's a real difference between a forum where users upload images and a service whose core product is the harmful transformation itself. Recent federal criminal prosecutions of nudify operators — the first of their kind — have started drawing that line in law enforcement terms, not just editorial ones. But civil remedies for individual victims remain slow, expensive, and geographically inconsistent.
The New Rules Rolling In
The gray zone is finally shrinking, state by state:
- AI-specific deepfake statutes now exist in a majority of states, with a growing subset covering nonconsensual intimate imagery explicitly — including AI-generated versions.
- The TAKE IT DOWN Act, signed in 2025, gives victims a federal takedown mechanism and criminalizes the publication of nonconsensual intimate depictions, real or synthetic.
- Several states now require platform-level notice-and-removal processes with real deadlines, not the old "we'll get to it" standard.
The gap that remains is enforcement. A law on the books in Sacramento doesn't help much when the server is in a jurisdiction that treats US court orders as suggestions.
Why We're Telling You This
We've said it before: we won't process images of real people without consent, full stop. But the legal landscape matters even to people who never touch these tools, because the assumption that "there must be a law against that" is, in most of the country, still mostly wrong. The fixes are coming. They're just not here yet — and knowing where the gaps are is the first step to closing them.
