AI Frontier Institute

Artificial Intelligence Modifications

View primary source →

Utah H.B. 276 (Artificial Intelligence Modifications) became law after the Governor signed it on 2026-03-24. It takes effect January 1, 2027 (Section 21). The law creates two new chapters. Chapter 72b, the Digital Voyeurism Prevention Act, covers AI-generated counterfeit intimate images. It uses definitions tied to the federal Take It Down Act (13-72b-101). - Generation services (13-72b-201): A generation service may not distribute a counterfeit intimate image without first getting consent from the identifiable person depicted. It must run a consent system that requires affirmative consent, verifies identity with reasonable accuracy, and keeps consent records for at least seven years. Distribution without consent violates the person's reasonable expectation of privacy. - Civil liability for generation services (13-72b-202): An injured person, or the heirs of a deceased person, may sue. Courts must order an injunction and removal or destruction of the images. Plaintiffs need not prove actual damages. They may recover actual damages (including emotional distress), punitive damages for willful, reckless, or malicious violations, and attorney fees and costs. Each distribution is a separate violation. The limitations period is the later of 3 years from discovery or 10 years from the violation. - Safe harbor for generation services (13-72b-203): A service that meets listed conditions is not liable. These include a published written policy, reasonable safeguards, a compliant consent system, and prompt action after notice. A service that categorically prevents generating intimate images gets relief from some of the consent requirements. The service may assert the safe harbor by motion before trial. - Pleading standard (13-72b-204): Plaintiffs must plead with particularity facts showing the service does not qualify for the safe harbor. A deficient complaint is dismissed without prejudice. A second deficient complaint is dismissed with prejudice, and the service gets its attorney fees and costs. - Transparency (13-72b-205): Services must inform users that non-consensual images are prohibited, that violations may bring civil liability, and how to report violations. They must also publish their policy and a general description of their safeguards. - Covered platforms (13-72b-301 to 13-72b-306): A covered platform may not knowingly allow distribution of a counterfeit intimate image without consent. A platform knowingly allows it if it receives notice and fails to take the image down. Platforms must have notice-and-removal procedures that comply with Section 3(a) of the Take It Down Act. They must remove reported images within 48 hours and make reasonable efforts to remove identical copies (13-72b-302). Platforms face civil liability on terms similar to those for generation services (13-72b-303). A platform has a safe harbor for good-faith compliance or lack of actual knowledge, and a platform that wins on that basis gets attorney fees (13-72b-304). Plaintiffs face the same heightened pleading rules (13-72b-305). The act does not expand the Take It Down Act or alter Section 230 of the Communications Decency Act (13-72b-306). - Severability (13-72b-401): Invalid provisions are severed from the rest of the chapter. Chapter 72c, the Digital Content Provenance Standards Act, covers provenance data and disclosures in digital content. - Large online platforms (13-72c-201): Platforms with over 2,000,000 monthly users must detect compliant system provenance data in content. They must provide a user interface that discloses when it is available and lets users inspect it. They may not knowingly strip compliant provenance data or digital signatures, to the extent technically feasible. - Capture devices (13-72c-202): Capture device manufacturers must embed a latent disclosure. It must carry the manufacturer name or digital signatures, plus the time and date of creation or alteration. Manufacturers may let users disable it. The duty applies only to the extent technically feasible and consistent with widely adopted standards, and only to devices produced for sale in Utah on or after January 1, 2028. - Covered providers (13-72c-203): Providers of generative AI systems with over 1,000,000 monthly users that are publicly accessible in Utah must include a latent disclosure in AI-created or substantially modified image, video, or audio content. They must do so to the extent technically feasible and reasonable. - Enforcement (13-72c-301): The Division of Consumer Protection enforces Part 2 of the chapter. Administrative fines and court fines are up to $2,500 per violation. Civil penalties for violating an order are up to $5,000. The division may seek injunctions, disgorgement, and fees. Fines go to the Consumer Protection Education and Training Fund. Other remedies are not displaced. Related changes: - Section 13-2-1 is amended to add Chapter 72c to the laws the division administers. - Section 63A-16-215 directs the chief information officer to make rules. The rules would require provenance records for digital content on state agency webpages used for transactions or services, where there is a substantial risk that fraudulent or misleading media could cause harm. The rules do not cover content created before January 1, 2027.

← Back to the tracker