UT HB276: Artificial Intelligence Modifications

In one paragraph

Utah's HB 276 enacts two AI laws. The Digital Voyeurism Prevention Act bars AI image generation services from distributing counterfeit intimate images of a real person without verified consent, requires covered platforms to remove reported images within 48 hours, and lets victims sue, subject to safe harbors. The Digital Content Provenance Standards Act requires large online platforms to show content provenance data and generative AI providers with over 1,000,000 monthly users and capture-device makers (devices made for sale from 2028) to embed latent disclosures; fines up to $2,500 per violation. Signed March 24, 2026; effective January 1, 2027.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

AI image generators must get verified consent before producing intimate images of real people; platforms need 48-hour takedown processes; large platforms and large generative AI providers must handle provenance data from 2027, capture-device makers from 2028.

Key provisions

1. 1Digital Voyeurism Prevention Act (Title 13, Chapter 72b): a generation service (an online service that generates intimate images with AI on its own servers and delivers them) may not distribute a counterfeit intimate image (a 'digital forgery' under the federal Take It Down Act) without the depicted person's consent, gathered through a system that verifies identity with reasonable accuracy and keeps records at least seven years
2. 2Victims or their heirs may sue a generation service for a mandatory injunction and removal, actual damages including emotional distress, punitive damages for willful, reckless or malicious violations, and attorney fees; each distribution is a separate violation; suits allowed until the later of 3 years from discovery or 10 years from the violation
3. 3Safe harbor for generation services that don't hold themselves out for such images, publish and follow a written policy with reasonable safeguards and reporting procedures, keep a compliant consent system and act promptly on notice; services that categorically block intimate image generation are excused from the consent steps; plaintiffs must plead specific facts defeating the safe harbor
4. 4Covered platforms (as defined in the Take It Down Act) must run notice-and-removal procedures, remove reported counterfeit intimate images within 48 hours and make reasonable efforts to remove identical copies; good-faith compliance is a safe harbor, and Section 230 is not altered
5. 5Digital Content Provenance Standards Act (Chapter 72c): large online platforms (over 2,000,000 unique monthly users) must detect compliant system provenance data, show users it is available and let them inspect it, and may not knowingly strip it where technically feasible
6. 6Covered providers of publicly accessible generative AI systems with over 1,000,000 monthly visitors or users must embed latent disclosures in AI-created or substantially modified image, video and audio content that, where technically feasible and reasonable, convey the date and time and either a manufacturer name or digital signatures showing whether generative AI was used
7. 7Capture device manufacturers must, to the extent technically feasible and consistent with widely adopted standards, embed a latent disclosure of the maker or a digital signature plus the date and time, for devices produced for sale in Utah on or after January 1, 2028, and may let users turn it off; the Division of Consumer Protection enforces Chapter 72c with fines up to $2,500 per violation
8. 8Signed March 24, 2026; effective January 1, 2027; also has the state chief information officer set provenance standards for certain state agency web content

Latest legislative action

Mar 24, 2026. Governor Signed

Sponsors