The TAKE IT DOWN Act's First Big Case Is About a Man Who Built a Deepfake Porn Library

What happened

In May 2025, federal prosecutors in New Jersey charged Cornelius Shannon in one of the earliest criminal prosecutions brought under the TAKE IT DOWN Act, a federal law targeting the publication of nonconsensual intimate imagery. The DOJ alleged that Shannon had produced and published at least 360 albums of AI-generated deepfake pornography depicting approximately 90 women without their consent. Among those depicted were public figures. The content appeared on an adult image and video sharing platform and was viewed millions of times before prosecutors moved.

The TAKE IT DOWN Act had been on the books for only a short time before the Shannon case arrived as one of its first tests. The alleged conduct was not a single image posted in a moment of impulse. Prosecutors described a sustained operation, hundreds of albums spanning dozens of depicted individuals, built using AI tools capable of generating convincing sexual imagery of real people who had given no consent and, in most cases, likely had no idea it existed.

The platform hosting the content sits at the center of the structural problem the case makes visible. By the time charges were filed, the material had already accumulated millions of views. That interval, from upload to mass audience to eventual legal action, is the window in which AI-generated nonconsensual imagery causes most of its harm. Detection lags behind distribution, and distribution moves fast on platforms designed to surface popular content regardless of how it was made.

The roughly 90 women depicted had no mechanism to intercept the imagery before it reached a wide audience. They had no advance notice that the content would be created, no reliable path to removal outside a formal legal process, and no way to know whether they were among those targeted until the case became public. Public figures and private individuals occupied the same position: the content could be manufactured, published, and viewed by millions before any accountability process engaged at all.

That gap is precisely where a complete record of system outputs would make a difference. A provable record of what a system produced, on what date, and who authorized its publication would compress the interval between creation and consequences, giving platforms and prosecutors a starting point rather than a months-long reconstruction. Without that record, enforcement depends on exposure after the fact, and the harm runs its full course before the law can respond.

Reported impact

Affected parties

Not publicly disclosed

Harm type

Not publicly disclosed

Scale

Not publicly disclosed

Financial impact

Not publicly disclosed

Regulatory action

Not publicly disclosed

Classification

Organization

Not publicly disclosed

AI system

Not publicly disclosed

Industry

Not publicly disclosed

Country

Not publicly disclosed

Provider

Not publicly disclosed

Incident type

Not publicly disclosed

Relevant governance controls

Governance control mapping is not available for this record.

• No controls mappedNot publicly disclosed

Control mapping is analytical. It does not state that any control would have prevented the incident.

Sources and evidence

This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.