Because the women weren’t underage and the man who created the deepfakes never distributed the content, there was no apparent crime.

“He did not break any laws that we’re aware of,” said Molly Kelley, one of the Minnesota victims and a law student. “And that is problematic.”

Now, Kelley and the women are advocating for a local bill in their state, proposed by Democratic state Senator Erin Maye Quade, intended to block nudify services in Minnesota. Should the bill become law, it would levy fines on the entities enabling the creation of the deepfakes.

Maye Quade said the bill is reminiscent of laws that prohibit peeping into windows to snap explicit photos without consent.

“We just haven’t grappled with the emergence of AI technology in the same way,” Maye Quade said in an interview with CNBC, referring to the speed of AI development.

Jessica Guistolise, one of the Minnesota victims, said she continues to suffer from panic and anxiety stemming from the incident last year.

Sometimes, she said, a simple click of a camera shutter can cause her to lose her breath and begin trembling, her eyes swelling with tears. That’s what happened at a conference she attended a month after first learning about the images.

“I heard that camera click, and I was quite literally in the darkest corners of the internet,” Guistolise said. “Because I’ve seen myself doing things that are not me doing things.”

Mary Anne Franks, professor at the George Washington University Law School, compared the experience to the feelings victims describe when talking about so-called revenge porn, or the posting of a person’s sexual photos and videos online, often by a former romantic partner.

“It makes you feel like you don’t own your own body, that you’ll never be able to take back your own identity,” said Franks, who is also president of the Cyber Civil Rights Initiative, a nonprofit organization dedicated to combating online abuse and discrimination.

Less than a decade ago, a person would need to be an AI expert to make explicit deepfakes. Thanks to nudifier services, all that’s required is an internet connection and a Facebook photo.

Researchers said new AI models have helped usher in a wave of nudify services. The models are often bundled within easy-to-use apps, so that people lacking technical skills can create the content.

And while nudify services can contain disclaimers about obtaining consent, it’s unclear whether there is any enforcement mechanism. Additionally, many nudify sites market themselves simply as so-called face-swapping tools.

“There are apps that present as playful and they are actually primarily meant as pornographic in purpose,” said Alexios Mantzarlis, an AI security expert at Cornell Tech. “That’s another wrinkle in this space.”

During CNBC’s investigation into Walmart’s marketplace, it found at least 43 third-party sellers who had used the identity of another business to set up their account. Some of these sellers were impersonating large, publicly traded companies such as Thermo Fisher Scientific and Rockwell Medical, while others were smaller, private businesses, such as a New York grocery chain and a Chicago pizzeria. 

CNBC purchased and tested six items for its investigation, all of them highly rated, deeply discounted beauty products offered by sellers that were impersonating legitimate businesses. All of them were fake, according to brands and lab testing. 

During the Covid pandemic, Walmart’s marketplace boomed and the company gradually made it easier for sellers to join and list items on the platform, former employees said. 

One of those former employees, Tammie Jones, said when she first joined Walmart’s seller vetting team, the requirements to join the marketplace were strict. But she said over time, there was pressure from management to approve more sellers, even when she had concerns about the applicant’s credentials or documentation.

“It got to a point where they were just like, ‘You know what? Just go ahead and approve everybody,'” said Jones. “They wanted that business, so they were willing to take a chance on it.” 

About three weeks after CNBC shared its reporting with Walmart, the company changed some of its marketplace vetting policies for beauty and personal-care products in late July.  

In an email Walmart sent to some sellers, the company announced new restrictions for the category and said it would start requiring certain sellers to participate in an “enhanced vetting program” for those kinds of items. The changes would address some of the issues raised in CNBC’s reporting. 

As part of the new program, some sellers would have to provide documentation for each personal-care or beauty item in their assortment, such as an invoice that demonstrates the product was sourced directly from a brand owner or manufacturer. 

Numerous beauty and personal-care listings were taken down from the platform after the change, some sellers said. 

The nature of online marketplaces makes it difficult to get rid of counterfeit goods entirely, partially because of a lack of regulation. While selling counterfeit goods is a crime, platforms face almost no liability for facilitating their sale, as long as they take down listings for fake goods after brands bring them to their attention. 

The Shop Safe Act, a bipartisan federal bill, is designed to curb the sale of fakes online by incentivizing platforms to better vet sellers and the products they’re offering. When platforms comply with certain anti-counterfeiting measures, they could be shielded from liability if a seller offers a fake product. 

Brands widely supported the legislation, but it has so far failed to pass at least three times, partially because Walmart and other online marketplaces like Amazon, Etsy and eBay have lobbied against aspects of it, two U.S. Senate aides, who spoke on the condition of anonymity because the discussions were private, told CNBC. The legislation is expected to be reintroduced in the current Congress, they said.

In the absence of more concrete policy changes, legal experts said the argument that certain platforms could be held responsible for the sale of harmful products like counterfeit body lotion or faulty fire alarms is gaining momentum, even if they were technically sold by a third party.