Editor
Dinesh Raj chevron_right
In April last year, police in Johor arrested a teenager. The case was not a hack. He had taken photographs of his own classmates from social media, fed them into an app that generated fake nude images, and sold the results. No stolen passwords, no break-in. Just faces that were already public and a tool that did the rest in seconds.
Cases like that are why a courtroom fight now unfolding in the United States matters well beyond it. On 28 July, Elon Musk's artificial intelligence company xAI sued the state of Minnesota to block a law that would become the first in the country to ban so-called nudify apps, the tools that digitally strip clothing from a real person's photo.
Minnesota's statute, known as HF 1606, is due to take effect on 1 August. What makes it unusual is where it points the blame. Instead of chasing the individuals who misuse these tools, it holds the companies that build and operate them strictly liable when their software is used to generate intimate images, with civil penalties of up to USD500,000 per violation and a private right for victims to sue for damages. According to CNBC, xAI argues the law is unconstitutional because liability attaches with no requirement of intent or knowledge, and regardless of whether a company forbids the behaviour in its terms of service or deploys safeguards. The firm says it will switch off the image-editing features of its Grok tool for Minnesota residents rather than carry the risk.
For Malaysian readers, the interesting part is not the lawsuit itself. It is the choice Minnesota made, because Malaysia has just made close to the opposite one. The Cybercrimes Bill 2026, which cleared the Dewan Rakyat on 1 July and passed the Dewan Negara later that month and now awaits royal assent, is built to punish the person who shares. Its Section 24 makes it an offence to transmit, distribute, publish or sell an intimate image, carrying a fine of up to RM300,000, up to five years in prison, or both.
That reaches the classmate, the former partner, the stranger in a group chat. What it does not reach is the app. A nudify service running on a server abroad sits outside the grip of a law written around the person doing the sharing in Malaysia. The main lever regulators have over the tool itself is a takedown request, which comes only after the image already exists.
The damage is not hypothetical. The Malaysian Communications and Multimedia Commission received 6,987 requests to remove deepfake and AI-manipulated content between January 2024 and March 2026, and says it has taken down 95 percent of them. Complaints have climbed roughly eightfold, from 917 in 2024 to 3,612 in 2025 and 7,967 by the middle of June this year, according to figures shared by Deputy Communications Minister Teo Nie Ching. Much of the recent surge is nudify material, and much of it targets women and girls.
There is a direct thread between the two stories. The same tool at the centre of the Minnesota case, Grok, has already been named in Malaysian reporting on the spread of AI-generated sexual imagery. So the question Minnesota is testing, whether a government can make the maker of an AI tool answer for what that tool produces, is not academic here. It is precisely the gap Malaysia's new law leaves open.
None of this makes Minnesota's approach clearly right. Free-expression groups, including ARTICLE 19, have warned that broad rules on manipulated content risk sweeping up legitimate speech, and Malaysia has heard the same criticism of the Cybercrimes Bill. Strict liability on toolmakers is a blunt instrument, which is part of why xAI believes it can win. But if the Minnesota law survives Musk's challenge, it becomes the first working model for putting pressure on the supply side of this problem rather than only on the people at the end of it. Malaysia, having chosen to go after the sharer, has good reason to watch whether the other approach holds up in court.
Images courtesy of Smitty, Sasun Bughdaryan and Kev Costello on Unsplash.
