A group of Minneapolis women discovered their male friend secretly created explicit deepfakes of them and over 80 other women using AI. The shocking case, detailed in a new CNBC investigation, exposes a dangerous legal void where victims have almost no recourse against AI-powered sexual exploitation - and how everyday social media photos can be weaponized in ways lawmakers never anticipated.
The nightmare began in summer 2024 when Jessica Guistolise and her friends learned the unthinkable. A male friend had been secretly harvesting their Facebook photos and feeding them into an AI service called DeepSwap to create explicit videos and images. Not just of them - over 80 women across the Twin Cities had been targeted in what amounts to one of the most extensive deepfake abuse cases documented to date.
"I heard that camera click, and I was quite literally in the darkest corners of the internet," Guistolise told CNBC in an exclusive investigation. "Because I've seen myself doing things that are not me doing things." The sound of camera shutters now triggers panic attacks, her eyes swelling with tears as the trauma resurfaces.
But here's the most disturbing part: the perpetrator broke no laws. Because the women weren't minors and he never distributed the content, authorities found no crime had been committed. "He did not break any laws that we're aware of," said Molly Kelley, one of the victims and a law student. "And that is problematic."
This legal vacuum reflects how quickly AI has outpaced regulation. Less than a decade ago, creating convincing deepfakes required serious technical expertise. Now, as CNBC's investigation reveals, anyone with an internet connection can access "nudify" services through Facebook ads, Apple and Google app stores, or simple web searches.
"That's the reality of where the technology is right now, and that means that any person can really be victimized," Haley McNamara, senior vice president at the National Center on Sexual Exploitation, told CNBC. The services often masquerade as playful face-swapping tools while serving primarily pornographic purposes.
DeepSwap itself remains mysteriously elusive. The company has shifted its claimed headquarters from Hong Kong to Dublin, listing "MINDSPARK AI LIMITED" as its corporate entity. CNBC couldn't locate CEO Penyne Wu online or get responses from marketing manager Shawn Banks. The opacity suggests these services operate deliberately in regulatory gray zones.
The psychological damage, however, is crystal clear. Mary Anne Franks from George Washington University Law School compared the victims' experience to revenge porn survivors. "It makes you feel like you don't own your own body, that you'll never be able to take back your own identity," said Franks, who also leads the Cyber Civil Rights Initiative.
Kelley and the Minnesota women have channeled their trauma into advocacy, working with Democratic state Senator Erin Maye Quade on legislation that would fine companies $500,000 for every nonconsensual deepfake generated in Minnesota. The bill treats nudify services like digital peeping toms - recognizing that consent violations don't require physical presence.
"We just haven't grappled with the emergence of AI technology in the same way," Maye Quade told CNBC, highlighting how legal frameworks lag behind technological capabilities. But their efforts face headwinds from federal policy that prioritizes AI development over protection.
Trump's recent executive orders established AI advancement as a "national security imperative" through the White House's AI Action Plan. Some experts worry this federal push could undercut state-level safety measures, creating a tension between innovation and individual rights that victims like Kelley know all too well.
The Minnesota case illustrates a broader crisis brewing as deepfake technology democratizes. What was once the domain of skilled technicians is now accessible to anyone with malicious intent and a social media photo. The victims' advocacy represents a crucial test case for whether legal systems can adapt fast enough to protect people from AI's unintended consequences.
The Minneapolis women's fight represents a critical moment in AI governance. As deepfake technology becomes increasingly accessible, their case reveals how existing laws fall short of protecting victims from digital sexual exploitation. While federal policy prioritizes AI innovation, state lawmakers like Senator Maye Quade are racing to establish basic protections. The question isn't whether this technology will continue advancing - it's whether legal frameworks can evolve quickly enough to prevent more victims from falling through the cracks that Jessica Guistolise and her friends discovered the hard way.
