The Federal Trade Commission sent warning letters this week to fifteen named technology platforms — Amazon, Alphabet, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok and X — and on Wednesday May 20 followed those with a separate round of twelve warning letters to operators of so-called "nudify" services that strip clothing from photographed people using artificial intelligence. [1] The maximum civil penalty under the TAKE IT DOWN Act is $53,088 per violation, calculated per uncleaned instance of nonconsensual intimate imagery. Section 3 enforcement opened on May 19. [2]

On the same Friday, the European Commission agreed within its Digital Omnibus package to push back by sixteen months the operational deadlines for Annex III high-risk obligations under the AI Act — from August 2026 to December 2027. [3] Article 50(2) watermarking obligations move four months. National regulatory sandboxes move twelve months. Brussels also added a deepfake-nudifier prohibition that mirrors what the FTC's Wednesday template letter accuses the twelve named services of running. [4]

Two regulators, opposite trajectories, one frame. The American agency is enforcing a new criminal-civil statute against the operators of the most direct harm in week one. The European agency is buying its own industry a year and four months of additional time on the rules that would have constrained the products that produce the harm. Both made their decisions on May 22, 2026.

The substantive case for the FTC's enforcement is that the operators of nudify services are not difficult to find. The CyberScoop reporting on May 18 documented Grok's use to flood X with nonconsensual sexualized deepfakes of real people earlier this year, multiple criminal and civil investigations across U.S. states, and a class-action lawsuit against xAI and Elon Musk on the same fact pattern. [5] The TAKE IT DOWN Act is the federal statute that converts those state and civil proceedings into a 48-hour removal obligation backed by per-violation penalties. The paper's Thursday standard flagged Google's Omni rollout without a TIDA consent page; Friday's broader enforcement record now extends to the platforms hosting the content the AI generators produce.

The substantive case for the Brussels deferral is harder to make in public. Latham & Watkins, in a May 13 client alert, and Wiley, in its May 14 alert, tracked the EU Omnibus as a compliance-cost-reduction package. [6] [7] Global Policy Watch's May 19 read treated the package as a Brussels acknowledgment that the largest providers — none of them European — were not going to be ready on the original schedule. The deferral is the choice to keep the schedule credible by moving it. The American choice is the opposite: enforce on the schedule the statute set, against the worst actors first, and accept that compliance will be uneven.

The political asymmetry is the gap the paper is reading. American enforcement begins with the moral case nudify services make easy. European deferral begins with the trade-policy case the German auto sector and the French foundation-model labs have been making to the Commission since January. Both regimes will produce results. The American results will be measurable in $53,088 increments against specific operators in specific U.S. courts. The European results will be measurable in eighteen months, when the Annex III deadline arrives and the question is whether the deferred rules can actually be enforced against the world's largest model providers. Neither path is the path the law on paper described a year ago.

What the paper has been reading on this thread is religion-and-AI, the encyclical the Pope has scheduled for Monday with Anthropic's Chris Olah on the panel. Magnifica Humanitas is the third regulator entering this space, and the only one that does not have civil penalty authority. The Vatican's argument, leaked to Vatican News and AP this week, will be that the harm precedes the regulation, and the regulation should not have to wait for the model. Brussels has decided to wait. The FTC has decided not to. On Monday, the Pope tells the world what the Vatican has decided. The week the FTC's first nudify-warning batch acquires a return address will be the week three regulatory frames sit on the same desk.

For the platform companies, the message is operational. Fifteen of them have a $53,088-per-violation timer running in the United States. Twelve nudify operators have a return-address timer running in the U.S. as well. And the European deadline that would have constrained the upstream model producers is now sixteen months further away than it was on May 21. The deepfake the FTC removed on Wednesday is more expensive to leave up than the rule that would have prevented it being built. That is the equation Friday set.

-- ANNA WEBER, Berlin