CA AB621: Deepfake pornography.

In one paragraph

California's AB 621 rewrites Civil Code § 1708.86, the civil claim over sexually explicit deepfakes. A depicted person can sue anyone who creates and intentionally discloses, or intentionally discloses, digitized sexually explicit material (including images) when they know or reasonably should know the person did not consent or was a minor, and anyone who knowingly facilitates or recklessly aids or abets it. Deepfake pornography services and providers that keep them running after 30 days' notice face presumptions of liability. Statutory damages reach $50,000, or $250,000 if malicious, and prosecutors may sue. Signed October 13, 2025 (Chapter 673); effective January 1, 2026.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Operators of deepfake pornography services face presumed liability. Companies whose services keep such a service running are presumed liable if they do not stop within 30 days of getting sufficient evidence from a victim or prosecutor (via their reporting channel, if prominently displayed).

Key provisions

1. 1Digitized sexually explicit material: any portion of a visual or audiovisual work, including an image, created or substantially altered through digitization that shows the depicted individual nude or appearing to engage in, or be subjected to, sexual conduct; a deepfake pornography service is a website, app or other service whose primary purpose is creating such material
2. 2A depicted individual may sue a person who creates and intentionally discloses, or intentionally discloses, such material and knows or reasonably should know the individual did not consent or was a minor when it was created, or who knowingly facilitates or recklessly aids or abets that conduct
3. 3Owners and operators of a deepfake pornography service are deemed to create and disclose the material and presumed to know consent was lacking unless they produce the individual's express written consent; consent requires a signed, plain-language agreement, which can be rescinded within three business days in some cases
4. 4A provider of services that enable a deepfake pornography service's ongoing operation is presumed liable if a depicted individual or public prosecutor gives it sufficient evidence (through its customer-service email or designated process, if one is prominently displayed on its website) and it fails to take all necessary steps to stop within 30 days (a court may extend this for a law enforcement investigation)
5. 5Depicted individuals may recover the defendant's gains, economic and noneconomic damages or statutory damages of $1,500 to $50,000 per work ($250,000 if malicious), punitive damages, fees and injunctions; public prosecutors may obtain $25,000 per violation ($50,000 with malice) without proving actual harm
6. 6Exceptions for reporting unlawful activity, law enforcement duties, legal proceedings, matters of legitimate public concern, newsworthy or political works and protected commentary; disclaimers are no defense; conduct protected by federal law, including 47 U.S.C. § 230, is excluded and internet service providers are not liable for mere transmission
7. 7Suits must be filed within three years of discovery; the Legislature declares that applying § 1708.86 to deepfake pornography services is declaratory of existing law
8. 8Signed October 13, 2025 (Chapter 673, Statutes of 2025); effective January 1, 2026

Latest legislative action

Oct 13, 2025. Chaptered by Secretary of State - Chapter 673, Statutes of 2025.

Sponsors (showing 5 of 28)

Roll call votes (showing 3 of 9)