Section 1. Section 13-72b-101 is enacted to read:72b. Digital Voyeurism Prevention Act 13-72b-101. Definitions.As used in this chapter:(1)"Artificial intelligence technology" means the same as that term is defined in Section 13-72-101.(2)"Consent" means express permission, freely and voluntarily given by an identifiable individual, with full knowledge of the nature and purpose of the generation of an intimate image depicting the individual, where the consent:(a)is specific to the particular intimate image being generated;(b)is obtained before the generation of the intimate image; and(c)may be revoked at any time.(3)"Counterfeit intimate image" means an intimate image that has been created or generated through the use of artificial intelligence technology, machine learning, digital editing tools, or other technological means to depict the likeness of an identifiable individual.(4)(a)"Distribute" means to sell, exhibit, display, publish, provide, give, provide access to, or otherwise transfer a counterfeit intimate image, with or without consideration.(b)"Distribute" includes the generation of a counterfeit intimate image by a generation service and the subsequent provision of that counterfeit intimate image to the user.(5)"Generate" means to create, produce, compose, materially edit, or facilitate the creation of an intimate image through the use of artificial intelligence technology, digital editing tools, or other technological means.(6)"Generation service" means a person that operates, maintains, or provides an interactive computer service that:(a)enables users to generate intimate images;(b)processes user image generation requests through servers, computer systems, or computing resources controlled by the service operator rather than solely on the user's local device; and(c)distributes generated intimate images to users through the service.(7)"Identifiable individual" means an individual who is recognizable as an actual human individual by the human individual's face, likeness, or other distinguishing characteristic, including a unique physical feature or other recognizable attribute.(8)"Interactive computer service" means the same as that term is defined in 47 U.S.C. Sec. 230(f)(2).(9)"Intimate image" means any visual depiction, photograph, film, video, recording, picture, or computer or computer-generated image, picture, or video, whether made or produced by electronic, mechanical, or other means, that depicts:(a)exposed human male or female genitals, anus, or pubic area, with less than an opaque covering;(b)a female breast with less than an opaque covering, or any portion of the female breast below the top of the areola; or(c)an individual engaged in sexually explicit conduct.(10)"Platform" means a person that operates, maintains, or provides an interactive computer service that:(a)hosts, distributes, or makes accessible content; and(b)enables a user to interact with content provided by the platform or another user.(11)"Reasonable expectation of privacy" means an individual's expectation that:(a)the individual's body will not be viewed, recorded, or depicted in an intimate image without the individual's knowledge and consent; and(b)an intimate image of the individual will not be generated, created, distributed, or manipulated without the individual's knowledge and consent.(12)"Sexually explicit conduct" means actual or simulated:(a)sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between individuals of the same or opposite sex;(b)masturbation;(c)bestiality;(d)sadistic or masochistic activities;(e)exhibition of the genitals, pubic region, buttocks, or female breast of any individual;(f)visual depiction of nudity or partial nudity;(g)fondling or touching of the genitals, pubic region, buttocks, or female breast; or(h)visual depiction of defecation or urination for the purpose of causing sexual arousal of any individual.

Section 2. Section 13-72b-102 is enacted to read:13-72b-102. Unlawful distribution of non-consensual counterfeit intimate images.(1)The distribution of a counterfeit intimate image without the consent of the identifiable individual depicted in the image is a violation of the individual's reasonable expectation of privacy.(2)A generation service may not distribute a counterfeit intimate image without first obtaining and verifying consent from the identifiable individual depicted in the counterfeit intimate image.(3)To obtain and verify consent sufficient to meet the requirements of Subsection (2), a generation service shall implement and maintain a consent verification system that:(a)requires the identifiable individual depicted in the counterfeit intimate image to affirmatively provide consent before the counterfeit intimate image is distributed;(b)verifies the identity of the individual providing consent with reasonable accuracy; and(c)maintains a record of the consent verification for a period of not less than seven years.(4)A generation service may not require an individual to disclose personally identifiable information beyond what is reasonably necessary to verify the individual's identity and obtain valid consent.

Section 3. Section 13-72b-103 is enacted to read:13-72b-103. Civil liability for generation services.(1)A person, or the heirs of a deceased person, who has been injured by a violation recognized in Section 13-72b-102 may bring a civil action against the generation service that committed the violation.(2)If in an action described in Subsection (1) the court finds the defendant is violating or has violated any provision of Section 13-72b-102, the court shall:(a)enjoin the defendant from continuing the violation; and(b)order the defendant to remove or destroy any counterfeit intimate image distributed in violation of Section 13-72b-102 and all copies of the counterfeit intimate image within the defendant's possession or control.(3)It is not necessary that actual damages to the plaintiff be alleged or proved in an action under this section.(4)A plaintiff in an action under this section is entitled to recover:(a)actual damages sustained, if any, including damages for emotional distress;(b)statutory damages in an amount not less than $10,000 and not more than $100,000 for each violation;(c)punitive damages, if the violation is found to be willful, reckless, or malicious; and(d)reasonable attorney fees and costs.(5)In determining the amount of statutory damages under Subsection (4)(b), the court shall consider:(a)the nature and scope of the violation;(b)the number of counterfeit intimate images distributed;(c)whether the defendant implemented any consent verification procedures;(d)the defendant's revenue derived from the generation service;(e)whether the defendant took reasonable steps to prevent violations after receiving notice; and(f)any other factors the court deems relevant.(6)Each distribution of a counterfeit intimate image depicting an identifiable individual without consent constitutes a separate violation.(7)The statute of limitations for a civil action under this section is the later of:(a)three years from the date the plaintiff discovered or reasonably should have discovered the violation; or(b)10 years from the date of the violation.

Section 4. Section 13-72b-104 is enacted to read:13-72b-104. Unlawful distribution of non-consensual counterfeit intimate images on platforms.(1)A platform may not knowingly allow the distribution of a counterfeit intimate image without consent from the identifiable individual depicted in the counterfeit intimate image.(2)A platform knowingly allows the distribution of a counterfeit intimate image without consent if:(a)(i)the platform receives notice under Section 13-72b-106 that a counterfeit intimate image has been distributed without consent; and(ii)fails to comply with the takedown requirements in Section 13-72b-106; or(b)the platform otherwise has actual knowledge that a counterfeit intimate image is being distributed without consent on the platform.(3)A platform's failure to comply with Section 13-72b-106 after receiving notice creates a rebuttable presumption that the platform knowingly allowed continued distribution.

Section 5. Section 13-72b-105 is enacted to read:13-72b-105. Civil liability for platforms.(1)A person, or the heirs of a deceased person, who has been injured by a violation of Section 13-72b-104 may bring a civil action against the platform that committed the violation.(2)If in an action described in Subsection (1) the court finds the defendant is violating or has violated any provision of Section 13-72b-104, the court shall:(a)enjoin the defendant from continued violation; and(b)order the defendant to remove or destroy any counterfeit intimate image distributed in violation of Section 13-72b-104 and all copies of the counterfeit intimate image within the defendant's possession or control.(3)It is not necessary that actual damages to the plaintiff be alleged or proved in an action under this section.(4)A plaintiff in an action under this section is entitled to recover:(a)actual damages sustained, if any, including damages for emotional distress;(b)statutory damages in an amount not less than $5,000 and not more than $50,000 for each violation;(c)punitive damages, if the violation is found to be willful, reckless, or malicious; and(d)reasonable attorney fees and costs.(5)In determining the amount of statutory damages under Subsection (4)(b), the court shall consider:(a)the nature and scope of the violation;(b)the extent of distribution or accessibility of the counterfeit intimate image;(c)the defendant's willingness to comply with removal requests;(d)whether the defendant took reasonable steps to prevent violations after receiving notice; and(e)any other factors the court deems relevant.(6)Each failure to remove a counterfeit intimate image after receiving notice under Section 13-72b-106 constitutes a separate violation of this chapter.(7)The statute of limitations for a civil action under this section is the later of:(a)three years from the date the plaintiff discovered or reasonably should have discovered the violation; or(b)10 years from the date of the violation.

Section 6. Section 13-72b-106 is enacted to read:13-72b-106. Duty to remove -- Notice and takedown procedures.(1)Upon receiving notice from an identifiable individual or the individual's authorized representative that a counterfeit intimate image depicting the individual has been distributed without consent on a platform, the platform shall:(a)within 48 hours of receiving notice, temporarily disable access to the counterfeit intimate image pending investigation;(b)within seven days of receiving notice, conduct a reasonable investigation to determine whether the counterfeit intimate image was distributed without consent; and(c)if the platform determines the counterfeit intimate image was distributed without consent, permanently remove the counterfeit intimate image and prevent the reposting of substantially similar images depicting the same identifiable individual.(2)Notice under Subsection (1) shall include:(a)identification of the identifiable individual depicted in the counterfeit intimate image;(b)identification or description of the counterfeit intimate image sufficient for the platform to locate the image, including a URL or other locator if available;(c)a statement that the identifiable individual did not consent to the creation or distribution of the counterfeit intimate image; and(d)contact information for the individual providing notice.(3)A platform that complies in good faith with the notice and takedown procedures in this section is not liable under this chapter for actions taken in accordance with this section before receiving notice.

Section 7. Section 13-72b-107 is enacted to read:13-72b-107. Transparency and reporting requirements.(1)Before processing a user's request to generate a counterfeit intimate image, a generation service shall clearly and conspicuously disclose to the user:(a)that distribution of non-consensual counterfeit intimate images is prohibited;(b)the consent verification requirements under this chapter;(c)the civil penalties for violations of this chapter; and(d)procedures for a user to report a violation to the generation service.(2)A platform shall clearly and conspicuously provide to users procedures for reporting and requesting removal of non-consensual counterfeit intimate images.

Section 8. Section 13-72c-101 is enacted to read:72c. Digital Content Provenance Standards Act1. General Provisions13-72c-101. Definitions.As used in this chapter:(1)"Artificial intelligence" means a machine-based system that makes predictions, recommendations, or decisions influencing real or virtual environments.(2)"Capture device" means a device that can record photographs, audio, or video content, including a video camera, a still photography camera, a mobile phone with a built-in camera or microphone, or a voice recorder.(3)(a) "Capture device manufacturer" means a person who produces a capture device for sale in the state.(b)"Capture device manufacturer" does not include a person exclusively engaged in the assembly of a capture device.(4)"Compliant system provenance data" means system provenance data that is compliant with widely adopted specifications of an established standards-setting body.(5)"Covered provider" means a person that creates, codes, or otherwise produces a generative artificial intelligence system that:(a)has over 1,000,000 monthly visitors or users; and(b)is publicly accessible within the geographic boundaries of the state.(6)"Digital signature" means a cryptography-based method that identifies the user or entity that attests to the information provided in the signed section.(7)"Generative artificial intelligence system" means an artificial intelligence system that can generate derived synthetic content, including text, images, video, or audio, that emulates the structure and characteristics of the system's training data.(8)(a)"Large online platform" means a public-facing social media platform, file-sharing platform, mass messaging platform, or stand-alone search engine that distributes content to users who did not create or collaborate in creating the content and that exceeded 2,000,000 unique monthly users during the preceding 12 months.(b)"Large online platform" does not include:(i)a broadband internet access service, as defined in 47 C.F.R. Sec. 8.1(b); or(ii)a telecommunications service, as defined in 47 U.S.C. Sec. 153.(9)"Latent" means present but not manifest.(10)"Manifest" means easily perceived, understood, or recognized by a natural person.(11)"Mass messaging platform" means a direct messaging platform that allows users to distribute content to more than 100 users simultaneously.(12)"Metadata" means structural or descriptive information about data.(13)"Personal information" means the same as that term is defined in Section 13-61-101.(14)"Provenance data" means data that is embedded into digital content, or that is included in the digital content's metadata, for the purpose of verifying the digital content's authenticity, origin, or history of modification.(15)"System provenance data" means provenance data that is not reasonably capable of being associated with a particular user and that contains:(a)information regarding the type of device, system, or service that was used to generate a piece of digital content; or(b)information related to content authenticity.(16)"User" means a Utah resident who accesses, interacts with, or uses an interactive computer service, platform, generation service, generative artificial intelligence system, or capture device.(17)"User interface" means the method by which an individual interacts with, controls, or receives information from a computer, software application, website, or electronic device.

Section 9. Section 13-72c-201 is enacted to read:2. Content Provenance Standards and Requirements13-72c-201. Requirements for large online platforms.(1)A large online platform shall:(a)detect whether compliant system provenance data is embedded into or attached to content distributed on the large online platform;(b)provide a user interface to disclose the availability of system provenance data; and(c)allow a user to inspect all available compliant system provenance data in an easily accessible manner:(i)directly through the large online platform's user interface described in Subsection (1)(b);(ii)by allowing the user to download a version of the content with the content's attached system provenance data; or(iii)by providing a link to the content's system provenance data displayed on an internet website or in another application provided either by the large online platform or a third party.(2)A large online platform may not, to the extent technically feasible, knowingly strip any system provenance data or digital signature that is compliant with widely adopted specifications adopted by an established standards-setting body from content uploaded or distributed on the large online platform.

Section 10. Section 13-72c-202 is enacted to read:13-72c-202. Requirements for capture devices.(1)A capture device manufacturer shall include a latent disclosure in content captured by the capture device that conveys:(a)(i)the name of the capture device manufacturer; or(ii)digital signatures sufficient to prove whether the content was created using a type of capture device; and(b)the time and date of the content's creation or alteration.(2)A capture device manufacturer may provide a user with the option to disable the latent disclosure on a capture device required in Subsection (1).(3)A capture device manufacturer shall comply with this section only to the extent technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body.(4)This section applies to any capture device a capture device manufacturer produces for sale in the state on or after January 1, 2028.

Section 11. Section 13-72c-203 is enacted to read:13-72c-203. User disclosures.(1)A covered provider shall include a latent disclosure in image, video, or audio content, or content that is any combination of image, video, or audio, created or substantially modified by the covered provider's generative artificial intelligence system that meets the following criteria:(a)to the extent that it is technically feasible and reasonable, the disclosure conveys the following information, either directly or through a link to a permanent internet website:(i)the time and date of the content's creation or alteration; and(ii)either:(A)the name of the capture device manufacturer; or(B)digital signatures sufficient to prove whether the content was created or substantially altered using a generative artificial intelligence system; and(b)the disclosure is consistent with widely accepted industry standards.(2)(a)If a covered provider licenses the covered provider's generative artificial intelligence system to a third party, the covered provider shall require by contract that the licensee maintain the system's capability to include a disclosure required by Subsection (1) in content the system creates or alters.(b)If a covered provider knows that a third-party licensee modified a licensed generative artificial intelligence system such that the system is no longer capable of including a disclosure required by Subsection (1) in content the system creates or alters, the covered provider shall revoke the license within 96 hours after the day on which the covered provider discovers the licensee's action.(c)A third-party licensee shall cease using a licensed generative artificial intelligence system after the license for the system has been revoked by the covered provider in accordance with Subsection (2)(b).

Section 12. Section 13-72c-301 is enacted to read:3. Enforcement13-72c-301. Enforcement -- Civil liability.(1)The Division of Consumer Protection shall administer and enforce the provisions of Part 2, Content Provenance Standards and Requirements in accordance with Chapter 2, Division of Consumer Protection.(2)The attorney general shall:(a)upon request, give legal advice to the division; and(b)act as counsel for the division in the exercise of the division's responsibilities under this chapter.(3)In addition to the division's enforcement powers under Chapter 2, Division of Consumer Protection:(a)the division director may impose an administrative fine of up to $2,500 for each violation of this chapter; and(b)the division may bring an action in a court of competent jurisdiction to enforce a provision of this chapter.(4)In a court action by the division to enforce a provision of this chapter, the court may:(a)declare that an act or practice violates a provision of this chapter;(b)issue an injunction for a violation of this chapter;(c)order disgorgement of money received in violation of this chapter;(d)order payment of disgorged money to an injured purchaser or consumer;(e)impose a fine of up to $2,500 for each violation of this chapter; or(f)award other relief that the court determines reasonable and necessary.(5)If a court awards judgment or injunctive relief to the division, the court shall award the division:(a)reasonable attorney fees;(b)court costs; and(c)investigative fees.(6)A court may impose a civil penalty of no more than $5,000 for each violation of an administrative or court order issued for a violation of this chapter.(7)The attorney general may bring a civil action on behalf of the division to collect a civil penalty imposed under this section.(8)The division shall deposit all fines and civil penalties collected under this section into the Consumer Protection Education and Training Fund created in Section 13-2-8.(9)Nothing in this chapter shall displace any other available remedies or rights authorized under the laws of this state or the United States.

Section 13. Section 63A-16-215 is enacted to read:63A-16-215. Government websites and applications.(1)The chief information officer shall make rules, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, establishing standards for digital content on a webpage of a state agency that the public can access to facilitate a transaction or obtain a service if the chief information officer determines there is a substantial risk that fraudulent or misleading media could cause harm to a resident of the state interacting with the state agency.(2)The standards required by Subsection (1) shall require a digitally accessible provenance record containing provenance information for digital content captured, created, or edited that includes:(a)the identification of:(i)the type of software or tool used; or(ii)the specific tool used;(b)the date of creation;(c)a content identifier; and(d)the previous content identifiers, if applicable.(3)This section does not apply to digital content created before May 6, 2026.

Section 14. Effective Date.This bill takes effect on May 6, 2026.