Content protection news, September 2026: deepfakes, leaks, IPTV

September 2026 had three big threads. Deepfake ads built from real people's faces kept running while platforms were slow to act. Leaked game material surfaced again, years after it was taken. And enforcement kept moving from single pages to the operators, suppliers and domains behind them. This roundup covers the stories our weekly radar picked up from 31 August to 28 September.

Deepfakes

On 14 September 2026 the Manhattan District Attorney's Office announced it had seized the domains of 12 websites selling AI generated sexual images of about 1,200 people who never consented, including actors, politicians, athletes, musicians and influencers. No arrests or charges have been announced, and the operators are under investigation only. This is a New York law route that does not carry over to the UK or Ireland. Source: Manhattan District Attorney's Office. Read our analysis: Manhattan DA seizes AI non consensual image sites. More in our deepfakes tracker.

On 4 September 2026 a report said that a federal judge had refused an AI company's request for a preliminary injunction against Minnesota's law banning apps that generate non consensual AI nudes. The law stays enforceable while the challenge continues, but this is not a final judgment on the statute, and it binds one US state only. Read our analysis: Minnesota's AI nudification ban survives an AI company's challenge. More in our deepfakes tracker.

Creators kept finding their faces in ads they never approved. A newspaper report on 12 September 2026 said that several influencers had been deepfaked into ads for GLP-1 drugs, cosmetics and blood testing, with takedowns by the social media company running the ads taking weeks. A follow up report on 16 September said that some of these ads were built from creators' own old selfies and vlogs and ran across two major social apps. More in our deepfakes tracker.

A consumer finance broadcaster says a major social network told him a deepfake ad using his cloned face and voice to sell insurance "meets their standards" and would not be taken down, according to a report on 17 September 2026. The network's owner has made no public statement. More in our deepfakes tracker.

A report on 17 September 2026 said that the oversight board of a major social media company ruled that AI generated videos of a Scottish councillor and a health campaigner broke the company's hateful conduct rules, and ordered their removal. The board also made nine recommendations, including wider "high risk" AI labelling and less algorithmic distribution of deceptive AI material. These are recommendations, not adopted policy. More in our deepfakes tracker.

Impersonation and AI likeness

A major photo and video app said AI persona accounts must label themselves as AI or lose reach, according to a report on 1 September 2026. This is announced policy, not observed enforcement. An account copying a real creator's face has every reason not to label itself. More in our impersonation and AI likeness tracker.

On 1 September 2026 a report covered a class action by four musicians against an AI music generator. They allege it uses musicians' names as prompts and captures voiceprints, in breach of right of publicity and biometric privacy law in Illinois and California. The complaint says it is not a copyright claim, and nothing has been decided. More in our impersonation and AI likeness tracker.

A large music label sued a music distribution service in Delaware, alleging it passed off AI generated tracks, unauthorised remixes and sped up versions as legitimate artist releases, and kept distributing tracks after notice, according to a report on 15 September 2026. These are allegations, and the distributor had not responded when the piece was published. More in our impersonation and AI likeness tracker.

A tech news reporter got an AI generated song onto the verified pages of a real Brooklyn band on four major streaming services without their permission, and reported on 17 September 2026 that it was disturbingly easy. It was a journalist's demonstration, not a scam, and the band did nothing wrong. More in our impersonation and AI likeness tracker.

On 24 September 2026 the US Federal Trade Commission voted 2 to 0 to publish an advance notice of proposed rulemaking, asking whether its Impersonation Rule should cover the ad optimisation tools platforms sell, which scammers use to impersonate real businesses and government agencies. Nothing is decided: it is a request for comment, not a rule and not a finding of liability. Source: Federal Trade Commission press release. Read our analysis: what new platform ad rules could mean for brands. More in our impersonation and AI likeness tracker.

Leaked and stolen content

A Los Angeles judge granted a pop star expedited discovery to subpoena two social apps and a payments company to identify anonymous accounts alleged to have stolen and sold her unreleased music, according to a report on 20 August 2026. The defendants are unidentified and nothing is proven. Removing the copies does not need a court order. More in our leaked content tracker.

A games publisher filed a second, sealed DMCA subpoena against a chat platform on 30 August 2026, seeking the pseudonymous account that posted gameplay footage of its next major game months before the November launch, according to a report on 31 August. The publisher told the court the probe is "rapidly evolving", and everything in the case remains alleged. Identifying a leaker and removing the footage are separate jobs on separate clocks. More in our leaked content tracker.

About 190GB of source code and development files for a best selling game, from a 2022 breach of the studio behind it, was posted in full, exposing a cancelled expansion and an early map build of the next game in the series, according to a report on 18 September 2026. The studio and its publisher have made no statement. Four years passed between the breach and the public release. More in our leaked content tracker.

Live sports and IPTV piracy

A 68 year old man from Chorley was jailed for six and a half years after making £980,812 from an illegal IPTV service run on 80 servers, following a PIPCU investigation, according to a report on 28 August 2026. Proceeds of Crime Act proceedings have only started, and no confiscation figure exists yet. More in our live sports piracy tracker.

Thailand's Department of Special Investigation took down a pirate service that supplied live sports streams and enabling technology to more than ten piracy sites, after a criminal complaint from an English football league backed by a Thai pay TV operator, a sports broadcaster, European football's governing body and an anti piracy coalition, according to a report on 3 September 2026. This was Thai criminal process, with no direct equivalent in the UK, Ireland or the EU. More in our live sports piracy tracker.

A pirate IPTV app run for around ten years by two Istanbul based operators shut down after an Istanbul police search and seizure prompted by a criminal complaint from member companies of a film studio trade body, according to a report on 22 September 2026. The operators then settled with an anti piracy coalition and transferred ten domain names to the trade body. No arrests or charges are reported, and the settlement is a civil agreement. More in our live sports piracy tracker.

Copyright enforcement and site blocking

An anti piracy coalition obtained two DMCA subpoenas covering 49 pirate domains fronted by a CDN and DNS provider, by its own filing count, plus two servers on a chat platform, to identify the operators behind them, according to a report on 30 August 2026. A subpoena is a request for identity, not a finding, and no named site has been adjudicated. More in our piracy enforcement tracker.

Peru's IP authority INDECOPI led Operation LUMEN with agencies in Paraguay, Brazil, the Dominican Republic and Ecuador, blocking 317 music piracy and malware sites that drew around 15 million monthly visits, according to a report on 23 September 2026. The sites were blocked by internet providers in those countries, not taken down worldwide, and site blocking is not equally available in the US or Ireland. More in our piracy enforcement tracker.

A US District Court in Washington entered a 4.5 million dollar default judgment against a former moderator of an online piracy forum who ran pirate shops for copied console games, at 150,000 dollars per title across 30 titles, with a permanent injunction, according to a report on 25 September 2026. He never answered the complaint, so this is not a ruling on a contested record, and the reporting does not say whether any of the sum will be paid. More in our piracy enforcement tracker.

What it means for you

• Legal action and removal are separate tracks. Subpoenas, arrests and judgments take months, and the copies stay up unless someone removes them at the host.

• Platform reports can be slow, or refused. Keep screenshots, links and dates, and use every reporting route a platform offers.

• New laws and rules are local or not yet in force. Minnesota's ban covers one state, and the FTC notice is only a request for comment.

• Going to the source works better than chasing copies. Ask whether your takedowns reach the host, or only remove a link from search.

• Leaks can surface years later. Assume a copy may circulate and keep watching for it.

If any of this is affecting your content or your likeness, talk to us.