How to Prevent Deepfakes and NCII on Your AI Platform

Blocking real-person likenesses is essential to protecting your processing. If you have users uploading photos of coworkers, or an ex they're angry at, or an actress, you're at risk.

Deepfakes are a real threat to your processing business. You know, the processing business you spent months acquiring, now threatened by a random AI-generated image.

Here is what the law and the card networks now require, and the operational steps that actually prevent non-consensual intimate imagery (NCII) from being created on your platform in the first place.

Key takeaways

•  The TAKE IT DOWN Act has been in force for platforms since May 19, 2026. Covered platforms must remove NCII, including AI-generated digital forgeries, within 48 hours of a valid request, and the FTC can seek civil penalties of $53,088 per violation.

•  Mastercard's adult content rules require consent from anyone whose likeness informs generated output and treat deepfake content built on a real person without consent as a terminating offense, not a warning.

•  Prevention happens at three points: reference image intake, prompt and identity filtering, and output screening against known faces and known abuse hashes.

•  A documented 48-hour removal workflow, with timestamps, is evidence your acquirer will ask for. Build it before the first complaint.

What the law requires

The TAKE IT DOWN Act, signed in May 2025, created a federal crime for publishing non-consensual intimate imagery and gave platforms one year to build a notice-and-removal process. That deadline passed on May 19, 2026. A covered platform is any website, online service, or app that primarily hosts user-generated content or regularly makes intimate imagery available, which captures most adult AI generators that let users save or share output.

The obligations are specific. You must provide a clear, conspicuous reporting process that a depicted person or their representative can use.

You must remove reported NCII within 48 hours of a valid request. You must make reasonable efforts to find and remove identical copies.

The statute expressly covers digital forgeries, meaning images produced through AI or any other computer-generated means, so synthetic content gets no exemption. Violations are enforced by the FTC as unfair or deceptive practices, and the agency has already sent compliance letters to technology companies, published guidance, and opened a public complaint portal.

What the card networks require

The Mastercard adult content rules now explicitly apply to content a provider can upload or generate. If a real, identifiable person's likeness informs the output, the consent and identity verification obligations attach to that person exactly as they would for a filmed performer.

Deepfake content built on a real person without consent is prohibited outright. You can read that again for impact.

Visa's Integrity Risk Program adds its own takedown timeline for adult merchants, and the strictest applicable deadline wins for any given report.

The practical consequence is that your acquirer underwrites you on one question: can a user turn a real person into adult content on your platform without that person's consent? If the answer is yes, or if you cannot prove the answer is no, the bank is carrying uncapped liability and will not keep you.

How to block real-person likenesses

Prevention has to happen before generation. A removal process that works perfectly is still a process that only runs after harm has occurred. You need to get ahead of the activity.

These are the controls that stop the content from existing.

•  Lock down reference image intake. The highest-risk feature on any generator is the ability to upload a photo and generate from it. Either disable face-based reference input entirely, or gate it behind identity verification that confirms the uploader is the person in the photo. Any other configuration makes face-swapping a product feature.

•  Filter identities at the prompt. Maintain and update a blocklist of named public figures, and block prompts that combine a proper name with explicit terms. Pair it with a classifier that detects attempts to describe a specific real person by role, show, team, or handle.

•  Screen outputs for known faces. Run generated faces against a celebrity and public figure recognition service before display. A match is a block, and the prompt and account get flagged.

•  Hash against abuse databases. Compare outputs and uploads against hash lists from organizations such as StopNCII and the National Center for Missing and Exploited Children, so removed or reported content cannot be regenerated or re-uploaded.

•  Apply a hard age floor. Any output a classifier scores as possibly a minor is blocked, no exceptions and no appeal. Our guide to age verification rules for adult merchants covers the user-side checks; this is the content-side check, and both are required.

•  Mark what you make. Embed provenance metadata or an invisible watermark in every output so you, your acquirer, and platforms downstream can identify content that came from your system.

Build the 48-hour workflow before you need it

Removal speed is now a legal requirement with a clock on it. The platforms that meet it are the ones that designed the path in advance.

•  Publish an unauthenticated reporting form at a predictable URL, such as /report or /removal, and link it from every page and from inside the app.

•  Route every submission to a queue with a visible deadline, and alert a named person when a report is 24 hours old without action.

•  Act on good-faith belief. The Act protects platforms that remove content that appears to be covered even if it later proves lawful, so the default on a plausible report is removal, not investigation.

•  Hash removed content immediately and sweep for identical copies across galleries, profiles, and caches.

•  Log receipt time, decision time, removal time, and the copies found, and keep the record. This log is what you hand your acquirer when they ask how you handled a complaint.

•  Terminate the account that generated the content and preserve its prompt history. Repeat offenders are a pattern an acquirer will ask you to show you track.

What your acquirer will want to see

Underwriting for adult AI and NSFW AI payment processing now includes a deepfake section whether or not the questionnaire calls it that. Have ready a written likeness policy, screenshots of the reporting path, your reference image rules, the vendor names behind face matching and hashing, your 48-hour workflow with a sample timeline, and a count of reports received and resolved in the last quarter. If you have had zero reports, say so and show the controls that explain why. This evidence sits alongside the broader moderation package described in our guide to how to prove content moderation for real-time generation.

Frequently asked questions

Does the TAKE IT DOWN Act apply if my users never share content publicly?

Coverage turns on whether the platform hosts user-generated content or makes intimate imagery available, and a fact-specific analysis is required. Treat private galleries and shareable links as covered until counsel tells you otherwise, because your acquirer will.

Is a consent checkbox enough to allow face-based generation?

No. A checkbox proves the uploader clicked a box, not that the person in the photo agreed. Card network rules require verified consent from the person depicted, which means identity verification tied to the reference image.

Can I rely on my base model's built-in safety filters?

Not alone. Base model filters are designed for the model vendor's risk, not yours, and they are not evidence of your controls. Layer your own identity filtering, output screening, and hashing on top, and document them.

Does blocking deepfakes also solve my record-keeping question?

Partly. Keeping real people out of the generator removes most of the performer records problem, but you still need a position on federal record-keeping for synthetic content. See our guide to 2257 records for AI-generated content.

Next step

Deepfakes and NCII are the risks that decide whether an AI image or video generator can process payments at all. MobiusPay works with adult AI merchants that take this seriously, and our risk management team can review your likeness controls and removal workflow against what acquirers are actually asking for in 2026. If you want a processor that will stand behind a compliant platform instead of running from the category, get started today.