Starting in 2027, Utah law requires consent before image-generation services share counterfeit intimate images and sets origin-disclosure rules for some online content and state webpages.
Image-generation services must get consent before sharing counterfeit intimate images. Platforms must remove reported images after a valid notice, and people harmed by violations may sue.
Large platforms must help users inspect available origin data and avoid removing compliant data when feasible. Device makers and qualifying AI providers must add hidden disclosures to covered content.
If misleading media could harm someone using a state agency service webpage, Utah's chief information officer must set rules for accessible records about digital content and its edits.
The law sets consent, removal, and lawsuit rules for fake intimate images. These rules cover qualifying image-generation services and covered platforms, and protect people identifiable in counterfeit intimate images. Image-generation services must get the depicted person's specific consent before sharing an image and verify who gave it; they may not demand more personal information than reasonably needed. Platforms must remove an image within 48 hours after a notice that meets the referenced federal law's requirements and make reasonable efforts to remove identical copies. A service or platform may qualify for safe-harbor protection if it meets specified safeguards and response requirements. A person suing must plead specific facts showing why that protection does not apply. These provisions take effect January 1, 2027.
The law requires certain platforms, device makers, and AI providers to show or preserve information about digital content's origin. The rules cover large public platforms, device makers producing devices for sale in Utah, and publicly accessible AI systems with over 1 million monthly users; internal-only AI systems are excluded. Large online platforms must detect available origin data, let users inspect it, and may not knowingly remove compliant data when technically feasible. Device makers must add hidden disclosures to captured content when technically feasible and consistent with accepted standards; users may be allowed to disable the disclosure. Covered AI providers must add hidden disclosures to qualifying image, video, and audio content they create or substantially modify, when technically feasible and reasonable. The chapter takes effect January 1, 2027. Device rules apply to devices made for sale in Utah on or after January 1, 2028.
The law directs Utah's chief information officer to set origin-record rules for some state agency webpages. This applies to public state agency webpages used for transactions or services when the chief information officer finds the stated risk. The rules apply when the chief information officer finds a substantial risk that misleading media could harm a resident using the agency webpage. Records must be digitally accessible and identify the software or tool, creation date, content identifier, and any previous content identifiers. The law takes effect January 1, 2027, and excludes digital content created before that date.
No hearings or votes scheduled.