Utah is once again moving ahead of federal regulators on artificial intelligence, with a new law targeting deepfakes set to take effect next year.
House Bill 276, signed into law last month, focuses on fake, explicit images created without someone’s consent.
Under the new law, websites and social media platforms operating in Utah must provide a way for people to report when their image is used to create intimate photos and videos without permission. The platform must remove the image within 48 hours and make “reasonable efforts to identify and remove any identical copy of the counterfeit intimate image.”
While federal law now requires some deepfake content to be removed, it only applies in limited cases and doesn’t broadly address how AI-generated content is created or shared. That’s left a gap where fake images can spread quickly, and victims often struggle to get them taken down.
Bill sponsor Rep. Ariel Defay said she worked closely with almost every large tech company operating in Utah to ensure protections for both the industry and its consumers.
“We've tried to protect them from frivolous lawsuits," she said, "and create a safe harbor for those who are good actors in this space.”
During a February committee hearing, Defay explained the bill also requires platforms to disclose metadata — or “provenance data” — to show the history of an image and how it’s been altered.
“It addresses our growing inability to distinguish what's real and what's not with deep faked images and videos,” she said.
Margaret Woolley Bussey, executive director of the Utah Department of Commerce, voiced her support for the new law. Her office has been tasked with identifying gaps in AI regulation and enforcing how businesses use the technology.
“There's many deep fakes that we see that we all kind of know are made with AI — they're unrealistic, we sort of understand that," Bussey said. "But the idea behind this content provenance is that if you don't know … then you need to be able to know whether or not it has been altered with AI.”
On the other hand, groups like the Abundance Institute, a tech policy group that advocates for innovation-focused regulation, worry that placing state-level regulations on issues that extend beyond state borders could simply discourage startups from operating in Utah.
May Kennedy, the institute’s chief of staff, said while her organization agrees that deepfakes are harmful and deserve strong consequences, the language of the bill is too vague.
“That means uncertainty, litigation risk, and higher compliance costs," Kennedy said. "Big incumbents will manage to comply, but smaller builders will avoid Utah, which hurts innovation and competition.”
Scott Stornetta, CEO of SureMark Digital, a small Provo-based identity verification company, pushed back on that sentiment, instead calling the bill “researched and thoughtful.”
“It provides appropriate balance in respecting the rights of victims while providing reasonable fafe harbor protections for legitimate businesses," he said. "More broadly, it provides another example of Utah leading the nation for responsible legislation in the area of AI and related fields … SureMark made a conscious decision to locate its headquarters in Utah in part because of its forward-looking legal framework.”
