In August 2024, the San Francisco City Attorney sued the operators of 16 websites dedicated to generating nonconsensual deepfake nudes. The legal action made David Chiu, the city’s chief lawyer, a key player in the global battle against so-called “AI nudifiers.”
That battle is as urgent as ever. Several countries have passed bills that criminalize the dissemination of synthetic nonconsensual intimate images (SYNCII); but nudifiers continue to profit from image-based sexual abuse.
In a recent survey commissioned by UNICEF, 1.2 million children across 11 countries said they had been targeted by a nonconsensual deepfake nude. “In some countries, this represents 1 in 25 children – the equivalent of one child in a typical classroom,” the UN organization noted.
The situation is so dire that on Tuesday, a group of internet safety organizations called for a complete ban on AI nudifiers, saying that “this functionality serves no good purpose.” Cassie Coccaro of Thorn, one of the organizations that signed the letter, wrote on LinkedIn that “it’s not common for Thorn to call for an all-out ban on any given technology” because such a drastic decision can have complex trade-offs. Not in this case.
San Francisco’s lawsuit has resulted in real change, including two settlements and 11 websites shut down in California. But Chiu is realistic about the extent of his powers, telling Indicator that “we need more people to take responsibility for addressing this and stamping it out.”
In a phone conversation, Chiu offered an update on the lawsuit, spoke about what his office has discovered about the finances and organization of AI nudifiers, and the need for technology companies that are “adjacent to and facilitating this trade” to step up their efforts.
What follows is a lightly edited transcript of our conversation.
City Attorney Chiu, thanks for being willing to talk to me.
I wanted to get started by giving Indicator readers a sense of the state of your lawsuit. Could you walk me through the number of plaintiffs sued, served, those who have settled, and those who are currently in active litigation?
Eight defendants have been served and two – Briver LLC and Richard Tang – have settled. We're expecting default judgments against at least three others: Itai Tech, Defirex, and CodeBionic Labs. We're still trying to serve one defendant, Gaofan Xu.
But big picture, 11 of the websites that we initially went after have been shut down thus far, at least in California.
Why did you feel that the City of San Francisco was the right authority to pursue this legal case – compared to individual victims or the state?
The origin of this lawsuit was that a couple of my top litigators – who happen to be mothers of teenage daughters – read an article about teenage girls being victimized by AI-generated non-consensual pornography. They texted me the article that weekend and said “Would you approve of us investigating this?” and I said, “Of course.”
What we learned with that one article was horrifying. Everything else we've learned since that has been even more horrifying. It was an investigation that took us to the darkest corners of the internet. We were horrified for the women and girls who've endured this exploitation.
We were also incredibly surprised that no one else had ever gone after these websites. I would have thought that someone else would have done it before, but we felt strongly that someone needed to act, and that was why we filed.
You talked about victims. We understand there have been some victims who have attempted to get recourse. But victims have found virtually no legal recourse, in part because it's almost impossible to determine what website generated the images. And once images are distributed, no one can control what happens to them or remove those copies off the web. You can't unring the bell.
The impact on victims and survivors is incredibly negative. The impact on one's reputation, mental health, loss of autonomy… We know that these images are often used to bully, humiliate, and threaten women and girls. The FBI has warned of an uptick in extortion schemes using this pornography and this phenomenon has impacted a shocking number of women and girls around the globe.
So we felt compelled to act.
Yeah, surveys talk about 6% of US teens targeted, and similar proportions in other countries.
One challenge in this space is that many operators of these awful websites conceal their ownership. Your initial lawsuit mentions several defendants by name but also several unnamed “Doe” defendants. Do you hope to get meaningful relief from all of them? And how are you prioritizing which to spend most time on?
We made the initial decision to go after the owners and operators of the world's 16 most popular websites that offer to “undress” images of girls and women. At the time we were aware of at least 90 websites, but thought it would make sense to go after the largest websites engaging in this AI-facilitated exploitation. Our estimate is that collectively the websites had been visited over two-hundred million times in the first six months of 2024.
There's a huge universe of bad actors here and obviously we could not go after everyone all at once, but we wanted to go after the largest websites to hopefully shut them down and sound the alarm.
Because AI nudifiers – unlike the now closed MrDeepFakes – don’t typically have public feeds, it can be legally and ethically tricky to assess whether they can actually generate illegal content or just promise to. Does your office have a protocol to audit these websites and safely preserve the evidence?
We have an investigative team who use different technical tools to investigate and capture this evidence. It's been a difficult investigation because of the subject matter.
To your question earlier about how so many of these defendants are hiding in the darkness, we have been suing a range of potential so-called “Doe” defendants because we know that many of these owners and operators are deliberately trying to hide who they are and how they're making profit off of this horrific exploitation.
So in a number of instances we didn't know exactly who the defendants were, but were able to go through other third parties through courts – such as internet service providers and web hosting services – to unmask these individuals and corporations.
We have done a lot of work to find the electronic trail that has led us to these defendants. We have had to request that the court allow us to use a variety of methods, through email, through secretaries of state, through the Hague convention.
This legal experience has signaled loudly and clearly that these owners and operators know what they're doing is wrong and they do not want to be found.
Yeah. And I'll ask you in a moment about what else you've discovered about these organizations.
Before I get there, though: You sued these websites in the summer of 2024, almost a year before Congress passed the Take It Down Act criminalizing the dissemination of nonconsensual nudes. Did that law affect your lawsuit in any way? Did it make things easier or did it not really make any substantial difference?
From our perspective, before the federal law passed, the defendants in our case clearly had violated a plethora of other state and federal laws that prohibit revenge pornography, child pornography, deepfake pornography, as well as my state's unfair competition law.
So while it's helpful to have more laws on the books, we feel confident that we have the legal authority we needed before the federal law passed to require accountability on the part of these bad actors.
But of course it's helpful to have this federal law apply to other states where this activity is happening. My authority only extends to the California border. Knowing that there are other other state and federal laws out there can only help address this worldwide scourge.
In work with Santiago Lakatos, I estimated that top AI nudifiers made as much as 36 million dollars in the year to May 2025.
I see that in December the operator of deepnude[.]cc, one of the individuals you sued, settled for $200,000. Do you have a sense of how much money these tools of abuse are making?
So as you can imagine, these actors often try to hide their profits and monies. There are media reports that have pegged the amount generated by these websites as well over 100 million dollars a year.
We're doing our best to try to track down the money trail. I can't comment on what we've learned about various individual apps’ business models over the course of investigation. Suffice it to say, we want to ensure for all of the companies we're going after that they are paying appropriate penalties for what they've been able to profit from.
Beyond their financial situation what can you tell me about the people and organizations that have settled or are being investigated? Are these nudifiers run from people’s basements and bedrooms as side gigs, or have you encountered some more professional outfits that are connected to a broader network of cybercrime?
That's a good question. I don't know if I could say there really is a pattern. I think it spans the spectrum. There's clearly a lot of money here, and individuals and companies that are operating webs of online sites. And then there are others that are doing it as one-offs.
In your lawsuit you also request relief from service providers of these nudifiers, including domain registrars, web hosts, payment processors, and so on. I note also that California’s AB 621 opens new legal grounds against those who enable AI nudifiers.
Over the past year, I have found that Meta ran more than 30,000 ads for AI nudifiers; PayPal and Stripe have provided payment processing; Apple and Google host them on their app store.
Even among the list of domains in your lawsuit I note that Google still provides single sign-on services – allowing easy login – to nudify[.]online, undress[.]app and others. How is your office thinking about the responsibility of US tech companies to restrict access to single-use tools of abuse?
So I'll say a few things.
My office and I were the lead sponsor of AB 621. I'm a former state legislator; when we started doing this work, I was in touch with the chair of the privacy committee Assemblywoman Rebecca Bauer-Kahan.
We talked early last year: She was wondering if there were ways to strengthen the laws in this space and so we worked very closely with her to help craft and pass AB 621.
Part of the purpose of the new law is to ensure that there is accountability, not just of the nudifying websites themselves and their operators, but of the tech infrastructure around those offending websites.
Because as you've noted, it’s not just the individual websites themselves that are operating and profiting from this. The hosting servers, the payment processors, the search engines, the ad servers, are benefiting as well.
We need everyone who is involved in this to be held accountable.
Now, some of these players may not be aware that their technologies are being used as part of this horrific industry. Part of what we are doing through this lawsuit is reaching out to those technology companies that are adjacent to and facilitating this trade.
In many instances, they claim to not be aware of the fact that they're supporting the infrastructure and have been very helpful to us as we have gone after the ultimate bad actors. But these are ongoing conversations and we are certainly continuing to monitor and investigate the web of players around this AI-facilitated exploitation.
What would you say to folks who claim this type of content should be protected by the First Amendment?
You know, it's funny. I realize in all the interviews I've done, no one has asked me this.
It’s an annoying question, but it does come up. The world’s richest man made somewhat similar claims at some point during his mass undressing spree, so I do think it’s helpful to ask.
Here's what I'll say: This is not innovation or free expression. It's sexual abuse, pure and simple.
Yeah.
Some of the companies in your lawsuit – Itai Tech is one example – are being investigated by regulators in Australia and the UK; others are being sued by victims (I spoke to Shane Vogt, who represents one of them). Have you been collaborating with others seeking justice on this topic?
For sure. We're happy to collaborate because I can't go after every bad actor who is engaged in creating and distributing AI-generated non-consensual pornography.
We need many law enforcement offices to be involved. When I initially filed the lawsuit, I had many conversations with counterparts around the country and globe about it and I encouraged other offices to bring similar lawsuits and litigation.
I've had many conversations with advocates and legislators around the country on this topic. Just a few weeks ago I spoke to an association of criminal prosecutors to educate them on how we went about going after these bad actors.
I've taken part in conversations with responsible AI stakeholders on what we're seeing and how we can address it. There is no one who is a credible leader in the AI world who thinks that these practices should be defended. At least no one I've spoken to. You alluded to one, I've not spoken to him about this, but no one I have spoken to.
Finally, I wanted to ask whether you feel hopeful about reining in this industry.
Researchers have called out nonconsensual deepfake nudes for the past seven years, only to see them become more sophisticated and more accessible over time. There have been victories. Obviously, Mr. Deepfakes’ takedown, your settlements. But do you feel hopeful or is this going to be a never-ending battle?
It remains to be seen.
It remains to be seen whether technologies, the laws, and their enforcement will catch up to the incredible volume of horrific and illegal activity that's happening on the worldwide web.
From my perspective at this moment, we need many more actors stepping up to address this enormous multifaceted global challenge.
This industry is exploiting women and girls from around the globe. From Hollywood celebrities and Taylor Swift to everyday high school and middle school students in every country in the world. And it's going to require all hands on deck to address it.
That being said, I'm heartened that there are advocates and officials who are taking this seriously. I want to single out an organization I do a lot of work with, which is the Joyful Heart Foundation. This is Mariska Hargitay's organization who I worked with years ago on addressing the backlog of untested rape kits. This is their top issue right now.
As we have seen growing global awareness on the impact of AI-generated non-consensual pornography we've seen a lot of folks stepping up and I appreciate that.
But we have a tremendous amount of work to do to catch up to what a huge number of bad actors around the globe are doing.
I notice that…
I'm not going to say “Yes, I’m hopeful.” We’ll see.
…I was going to say!
This is a call to action.
We need more people to take responsibility for addressing this and stamping it out.
We need it from law enforcement, we need it from the technology community, we need it from political leaders, and others.
I appreciate that. City Attorney, those were all my questions. Thank you very much and good luck.
Of course. I appreciate your coverage of this.
I am grateful to James Grimmelmann and Santiago Lakatos for suggesting some of the questions for Chiu.
