You expect all kinds of apps on Apple’s App Store and Google’s Play Store, from weather monitors to home automation apps and games. What you might not expect are apps that can create non-consensual nude imagery from ordinary photos. But they exist, and the City of San Francisco has had enough.
On July 17, 2026, San Francisco City Attorney David Chiu sent cease-and-desist letters to Apple and Google, naming 13 face-swapping and “nudify” apps (eight on the App Store and five on Google Play) and giving the companies 28 days to remove them and cut ties with the developers.
The letters don’t come out of nowhere.
It’s about payment systems, not content moderation
Chiu isn’t arguing that hosting an app automatically makes a platform liable for what it does. Platform operators already won that battle with Section 230 of the Communications Decency Act. That 30-year-old law says websites generally aren’t responsible for content posted by users, allowing platforms to host user-generated content without getting sued every time someone defames someone in a comment thread.
Courts have often extended those protections to cover app stores too. Apple and Google are treated as distributors of whatever a third-party developer uploads, rather than publishers.
Chiu is attempting to sidestep that argument by focusing on the companies’ payment systems, noting that Apple and Google collect a cut of every in-app purchase. According to the Tech Transparency Project (TTP), that means they profit from apps that generate revenue by creating non-consensual intimate imagery.
He has no shortage of evidence. In January, the TTP counted 55 nudification apps on the App Store and 47 on Google Play. In an April follow-up, the researchers deliberately used search terms like “nudify” and “deepnude.” They found 46 apps on the Apple App Store and 49 on Google Play. Roughly 40% of the stores’ search results allowed users to “undress” women, and almost one in three was rated as suitable for minors.
Although many of these apps are marketed using images of women, anyone can become a victim of non-consensual intimate imagery.
The nonprofit estimated that the apps in its dataset had been downloaded 483 million times and pulled in more than $122 million in lifetime revenue. Its verdict on Apple and Google was blunt:
“key participants in the spread of AI tools that can turn real people into sexualized images.”
Chiu’s letters reflect these findings, accusing both companies of
“knowingly facilitating or recklessly aiding the sale of those images by hosting the apps and handling in-app purchases”.
He also has California law to draw upon. A 2025 state statute in California expanded potential liability for entities that facilitate the creation or distribution of sexually explicit deepfakes. Civil penalties could reach $25,000 per violation. That’s serious for companies that transact millions of times every year.
Platforms have taken some action, but not enough
Chiu is doing more than kicking Apple and Google’s tires. His office already spent 2024 and 2025 pursuing 16 of the most-visited deepfake nude websites, resulting in real settlements and shutdowns. This is the same office, using the same playbook, against bigger targets.
Apple’s response has been partial. Spokesperson Adam Dema told WIRED that the company has removed three of the flagged apps and begun terminating the associated developer accounts. That leaves 10 of the 13 still available.
Google spokesperson Dan Jackson said the company had already deleted hundreds of apps with nudification features for Play Store policy violations.
If California courts accept the revenue-share theory, every other city attorney in the state gets a template. The app stores’ longstanding position that they are neutral distributors rather than commercial participants erodes wherever a state has consumer-protection statutes that reach payment infrastructure.
What this means for the rest of us
For consumers, the mechanics of these apps matter more than the litigation. Face-swapping and photo-effect apps aren’t automatically safe just because they passed store review. Grant one access to your camera roll and you could be handing over your own photos, or those of friends and family, to a service that could misuse them or allow others to do so.
Before you install an AI photo app, check what permissions it requests, look up the developer, and see whether independent reporting has raised concerns about it. Don’t assume an app is trustworthy simply because it’s available in an official app store. And our regular rules apply about posting images of yourself or those in your care.
If this story piqued your interest, you can hear more about Chiu’s work in our Malwarebytes podcast from last month, which re-airs the team’s 2024 interview with him.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
