For most of the last two years, the public argument about AI image generation has been conducted in the abstract. Researchers warned about deepfakes. Companies promised guardrails. Lawmakers wrote bills with acronyms. The deepfakes themselves were discussed the way you discuss weather systems, as a diffuse atmospheric threat that everyone agreed was bad and nobody could quite point at. On May 20, 2026, federal prosecutors in Brooklyn pointed at it, and the thing they pointed at had a phone number, an address, and a catalog.
Prosecutors in the Eastern District of New York unsealed criminal charges against two men, Cornelius Shannon, 51, of Hasbrouck Heights, New Jersey, and Arturo Hernandez, 20, of Bedias, Texas. The two are not connected to each other. They are connected only by the statute they are accused of violating, the Take It Down Act, the federal law President Donald Trump signed on May 19, 2025, that made the publication of nonconsensual intimate imagery, including AI-generated deepfakes, a federal crime. These are described as the first major federal prosecutions under that law, and they arrived almost exactly one year to the day after it took effect.
The Catalog Is The Story
The detail that should stop anyone scrolling past this case is the inventory. According to prosecutors, Shannon operated an account on an adult image- and video-sharing platform and published at least 360 albums of AI-generated deepfake pornography depicting roughly 90 different women. The material, prosecutors say, included female politicians, musicians, and singers, and it was viewed millions of times. Hernandez is accused of publishing approximately 113 albums on a separate website, depicting around 50 identifiable women, including people who were not public figures at all and at least some recent high school graduates.
Add it up and you reach more than 470 albums and over 140 named women, produced by two individuals working alone, on consumer-grade tools, in their spare time. That is the part of the deepfake story that the abstract framing always loses. This is not a nation-state influence operation requiring a server farm. It is two people, one of whom is 20 years old, generating an industrial volume of nonconsensual sexual imagery of real, identifiable women, and distributing it to an audience measured in millions of views. The technology has collapsed the gap between a single motivated person and mass production of abuse material, and the case file is the receipt.
What The Officials Actually Said
The U.S. Attorney for the Eastern District of New York, Joseph Nocella Jr., framed the prosecution around the harm rather than the technology. "This case makes clear that posting deepfake pornography is not a victimless crime," Nocella said. The framing matters because the most common defense of AI image generation, including from people who would never defend this specific conduct, is that synthetic imagery is somehow lesser, that because no camera was present and no physical act occurred, no real person was truly harmed. The named victims, who now have to live with searchable, view-counted sexual imagery of themselves that they never participated in, are the rebuttal.
FBI Assistant Director James Barnacle Jr. went directly at the industry's favorite word. "The use of this emerging technology to victimize individuals is not innovative, it is criminal," Barnacle said. It is worth sitting with that sentence, because the word innovative has been doing an enormous amount of laundering work in the AI sector. Every capability that ships, including the ones whose primary real-world use is harm, gets wrapped in the language of innovation, progress, and inevitability. A federal law enforcement official drawing a hard line between emerging technology and the criminal misuse of it is a small but real correction to two years of marketing.
The Law, And What It Actually Requires
The Take It Down Act, formally titled the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, does two distinct things. First, it criminalizes the publication of nonconsensual intimate imagery, whether the image is authentic or AI-generated. Second, it imposes an obligation on online platforms to remove reported nonconsensual intimate imagery within 48 hours of a valid request, with that platform-removal regime enforced by the Federal Trade Commission. The criminal exposure for the charged men is up to two years in prison for distributing intimate images of adults without consent, with a higher ceiling of three years where the imagery depicts minors.
These are not the law's first scalps. In April 2026, James Strahler II, a 37-year-old from Ohio, became the first person convicted under the Take It Down Act after pleading guilty to a set of charges that included cyberstalking and producing material depicting child sexual abuse. Strahler had used AI to morph the faces of boys he knew onto explicit imagery and had sent at least six adult women messages containing real and AI-generated nude images of them. The Brooklyn case is the first to operate at the scale of a distribution operation rather than a single targeted offender, which is why it reads less like a one-off and more like the opening of an enforcement era.
Why The Law's Existence Is Not The Same As The Problem Shrinking
Here is the uncomfortable part that the press-release version of this story leaves out. Passing a criminal statute and securing high-profile arrests is not the same thing as reducing the volume of the harm. Research circulating in 2026 has suggested that on at least some monitored platforms, the supply of and demand for deepfake pornography did not fall after the Take It Down Act passed. On the contrary, the publicity around the law appears, on those platforms, to have functioned partly as an advertisement, introducing new users to communities they had not previously known existed, while actual takedown requests on those platforms remained rare.
That is the structural trap of regulating a generative technology after deployment. The tools that produce this material are already distributed to hundreds of millions of devices. The marginal cost of generating another album is effectively zero. The law can deter the loudest, most prolific, most traceable offenders, the ones who build catalogs with view counters and operate from a single identifiable account. It does much less against the long tail of one-off offenders who generate a single image, share it privately, and never build the kind of distribution footprint that makes a federal case worth opening. Enforcement scales linearly. The harm scales the way generation scales, which is to say almost for free.
The Pattern, Generalized
- The bottleneck on mass-produced abuse imagery used to be effort and skill. AI image generation removed both. Two individuals produced over 470 albums depicting 140-plus real women, and neither needed a studio, a budget, or an accomplice.
- The "no real person was harmed" defense of synthetic imagery does not survive contact with a case file full of named, identifiable victims whose likenesses were distributed to millions of views without consent.
- A criminal statute deters the traceable, prolific, catalog-building offender. It does far less against the diffuse long tail, and at least some evidence suggests the law's publicity expanded the audience rather than shrinking it.
- The platform-side obligation, removal within 48 hours of a valid report, only works if victims know the imagery exists, know how to report it, and the platform actually complies. All three of those are weak points, and the third is now the FTC's problem to enforce.
What This Case Is Really Testing
The Brooklyn prosecution is being framed as a milestone, and in the narrow legal sense it is. But the real test it sets up is not whether two men can be convicted. It is whether targeted, high-effort enforcement against the most visible offenders can meaningfully bend a curve that the underlying technology is pushing in the opposite direction at near-zero cost. The honest answer, based on what is known so far, is that it probably cannot do it alone. Criminal law is built to punish discrete acts by identifiable actors. The deepfake problem is a volume problem, and volume problems are won or lost upstream, at the level of the tools, the platforms, and the detection systems, not in the courtroom after 470 albums have already been viewed millions of times.
That does not make the prosecution pointless. Naming victims, securing charges, and having a federal law enforcement official say on the record that this is criminal rather than innovative all matter, both as deterrence at the top of the distribution pyramid and as a public correction to the industry's preferred vocabulary. But anyone reading this case as proof that the deepfake problem is now handled is reading it wrong. The case is proof of how large the problem already is. Two people built a catalog of 140-plus victims before anyone with a badge showed up. The arrests are the end of one operation. They are not the end of the operation.