Technology & Privacy

AI-Made Intimate Images and the Final Version

H.B. 276 lets people sue AI services that make and share AI-made intimate images of them without their consent, and requires labels showing where digital content came from. The version that became law has no minimum damages for the people depicted, and adds safe harbors for companies and fee awards for platforms that win on them.

Sources: le.utah.gov Method: Public records only, no comment requested

Start Here — the 60-second version

New to this story? Click to open a plain-language walkthrough.

1
H.B. 276 (2026), “Artificial Intelligence Modifications,” primary sponsor Rep. Ariel Defay, Senate sponsor Sen. Kirk A. Cullimore. The bill page lists Cullimore as sponsor of the second substitute, the version that became law.
2
It creates the Digital Voyeurism Prevention Act: an AI “generation service” may not distribute an AI-made intimate image of a real, identifiable person without that person’s consent. The person depicted can sue for actual damages, punitive damages and attorney fees.
3
It creates the Digital Content Provenance Standards Act: big platforms must show where content came from, camera makers must embed origin data, and large AI providers must label AI-made images, video and audio.
4
The original bill set minimum damages of $10,000 per violation against AI services. The final version has none, and adds safe harbors, a stricter pleading standard and attorney-fee awards for platforms that win on the safe harbor. Which substitute made each change was not determined.
5
Signed March 24, 2026. It takes effect Jan. 1, 2027.

Quick glossary — click a term

Counterfeit intimate image

An intimate image of a real person made with AI. The law uses the federal Take It Down Act’s definition of a “digital forgery.”

Statutory damages

A set dollar range a court can award without the plaintiff proving a specific loss. The original bill had them; the final law does not.

Safe harbor

A rule that protects a company from liability if it meets listed conditions, here a published policy, safeguards and prompt takedowns.

Pleading with particularity

A rule that a lawsuit must state specific facts at the start, not general claims, or it is dismissed.

Provenance data

Information attached to a photo, video or audio file showing where it came from and whether it was altered.

AI tools that can produce realistic images of real people who never posed for them have raised new privacy questions. H.B. 276 gives victims a way to sue and sets labeling rules. How easy those suits are to bring changed between the original bill and the one that passed.

What the Law Does, as Enrolled

Consent rule: a generation service “may not distribute a counterfeit intimate image without first obtaining consent from the identifiable individual depicted,” through a consent system that assures identity “with reasonable accuracy” and keeps records at least seven years.
Right to sue: no need to allege or prove actual damages to win a court order stopping distribution and removing the images; actual damages, including emotional distress; punitive damages if the violation is “willful, reckless, or malicious”; attorney fees; each distribution is a separate violation; suits allowed within three years of discovery or 10 years of the violation.
Platforms: “covered platforms,” as the federal Take It Down Act defines them, must remove a reported image within 48 hours. A platform knowingly allows distribution if it gets notice and fails to take the image down.
Safe harbor: a generation service is not liable if it does not market itself for making such images, keeps and publishes a written policy and safeguards, runs a consent system and acts promptly on notice. A platform is not liable if it keeps takedown procedures and acts in good faith. Either can raise this before trial; a platform that wins on it is awarded its attorney fees.
Pleading standard: a plaintiff must plead “with particularity” why the company doesn’t qualify for the safe harbor. “General or conclusory allegations” are not enough. A second failed complaint is dismissed with prejudice and the company is awarded its fees for that motion.
Content labels: platforms with over 2 million monthly users must detect and show provenance data and may not knowingly strip it; camera makers must embed origin data in devices sold from Jan. 1, 2028; AI providers with over 1 million monthly users must add a latent label to AI-made images, video and audio. The Division of Consumer Protection enforces this part, with fines up to $2,500 per violation.
State websites: the state’s chief information officer must set provenance standards for state agency content where fraudulent media could harm residents.

How the Final Version Differs From the Original

Per the Legislature’s compare document (the original bill against the second substitute, the version that became law). The House committee adopted a first substitute and the second replaced it later; which substitute made each change was not determined, because the compare to the first substitute was not read:

Statutory damages removed: the original let victims recover “statutory damages in an amount not less than $10,000 and not more than $100,000 for each violation” from a generation service, and $5,000 to $50,000 from a platform.
Platform liability narrowed: the original treated a platform that “otherwise has actual knowledge” of a non-consensual image as knowingly allowing it, and made a missed takedown a “rebuttable presumption” of knowing distribution. The law as passed drops that separate clause and the presumption and defines liability mainly by notice and takedown.
Takedown rules aligned to federal law: the original required disabling access within 48 hours, an investigation within seven days, and blocking “substantially similar” reposts; the law as passed follows the Take It Down Act and asks for “reasonable efforts” to remove identical copies.
Safe harbor and pleading sections: the original’s sections, as listed in the compare document, have none; the final version has both.
Other changes: file-sharing platforms dropped from the “large online platform” definition; a section on licensing AI systems to third parties removed; start date moved from May 6, 2026 to Jan. 1, 2027.

Read from a plain-text copy of the compare document, which marks removed text but not added text. Changes that could only be confirmed from added text are described from the enrolled bill.

Who Spoke

Per the committee minutes: in the House Economic Development and Workforce Services Committee (Feb. 12), Rep. Defay presented with Zach Boyd, Director of the Office of Artificial Intelligence Policy. In the Senate Transportation, Public Utilities, Energy, and Technology Committee (Feb. 26), Margaret Woolley Bussey, executive director of the Department of Commerce; Christopher Bramwell, the state’s chief privacy officer; and Scott Stornetta, CEO of SureMark Digital, spoke in favor. May Kennedy of the Abundance Institute and Nathan Trail, listed as a vice president of state government affairs with no organization named, spoke to the bill.

Worth Seeing Side by Side

Public records, placed next to each other: Sen. Cullimore’s 2026 campaign reports list $5,000 from Google Client Services (July 16) and $5,000 from Encode AI (Jan. 15). Google’s search engine and platforms fit the bill’s “large online platform” definition. A personal-injury law firm and the trial lawyers’ association gave him $25,000 in 2026. The records don’t show any connection between these gifts and the substitute beyond subject and timing.

Graded on the Five Questions

Scale: C means the record meets what the law requires; B or A goes beyond it; D means the key part is vague or a public check is weakened; F means required information is missing or a public check is removed with nothing in its place.

Question	Grade	Why
Power	B	Creates a new right for people harmed by AI-generated intimate images to sue, and new enforcement against large platforms and AI providers.
Transparency	B	Requires published policies and safeguards, and provenance labels that let the public see where content came from. The bill was heard and amended in open committee in both chambers.
Financial accountability	D	The minimum damages in the original are gone. Platforms that win on the safe harbor are awarded their attorney fees, and a second failed complaint costs the plaintiff the company’s fees for that motion. A plaintiff who wins still recovers attorney fees.
Environmental impact	N/A	Not applicable.
Community impact	C	People depicted gain a path to court, but a stricter pleading standard and safe harbors make suits harder to bring than under the original bill.
Overall	C	Real new protections and labeling rules, narrower for the people depicted than the original bill.

What would have scored higher for the collective: keeping minimum statutory damages so a person who can’t show a dollar loss still recovers money, not only a removal order; dropping the fee award to platforms that win on the safe harbor; or pairing the safe harbor with public reporting of takedown requests and response times.

Vote Record

Feb. 12: House Economic Development and Workforce Services Committee adopted the first substitute 6–0 and Amendment #1 6–0, then recommended it 5–1 (Rep. Leah Hansen no; Fiefia, Hawkins, Jack and Shallenberger absent).
Feb. 20: House passed the amended first substitute 66–0 (nine absent, including Speaker Schultz).
Feb. 26: Senate Transportation, Public Utilities, Energy, and Technology Committee adopted Amendment #3 and recommended it, 5–0 each (Harper, Ipson, Millner, Riebe, Winterton yes; Adams, Kwan, Wilson absent).
Later: the second substitute, which the bill page lists Sen. Cullimore as sponsoring, replaced the first; the Senate and final House votes on it were not in hand.
March 24: signed by Gov. Cox.

Still Open

Not yet read: the Senate floor votes and the House concurrence vote on the second substitute, the compare to the first substitute (which would show which version made each change), and the committee audio.