HB 276

Enrolled Copy  H.B. 276
1Artificial Intelligence Modifications
  2026 GENERAL SESSION
  STATE OF UTAH
  Chief Sponsor: Ariel Defay
  Senate Sponsor: Kirk A. Cullimore
2
3  LONG TITLE
4  General Description:
5      This bill enacts provisions related to counterfeit intimate images and digital content
6  provenance standards.
7  Highlighted Provisions:
8      This bill:
9      ▸ defines terms;
10      ▸ creates the Digital Voyeurism Prevention Act to address non-consensual generation and
11  distribution of counterfeit intimate images;
12      ▸ prohibits generation services and platforms from distributing counterfeit intimate images
13  without obtaining and verifying consent from the depicted individual;
14      ▸ establishes civil liability for violations of the act, with actual damages, punitive damages,
15  attorney fees, and injunctive relief;
16      ▸ establishes safe harbor protections for generation services and covered platforms that
17  implement reasonable safeguards and respond appropriately to notices;
18      ▸ establishes heightened pleading standards requiring plaintiffs to plead specific facts;
19      ▸ requires platforms to implement notice and takedown procedures and disclosure
20  requirements;
21      ▸ requires large online platforms to detect, disclose, and preserve provenance data in
22  distributed content;
23      ▸ establishes requirements for capture device manufacturers regarding latent disclosures in
24  captured content;
25      ▸ requires covered providers to include disclosures in AI-generated content;
26      ▸ provides exemptions for certain products and services;
27      ▸ provides for enforcement by the Division of Consumer Protection; and
H.B. 276  Enrolled Copy
28▸ provides a severability clause.
29   Money Appropriated in this Bill:
30None
31   Other Special Clauses:
32This bill provides a special effective date.
33   Utah Code Sections Affected:
34   AMENDS:
3513-2-1 (Effective 01/01/27), as last amended by Laws of Utah 2025, Chapter 468
36   ENACTS:
3713-72b-101 (Effective 01/01/27), Utah Code Annotated 1953
3813-72b-201 (Effective 01/01/27), Utah Code Annotated 1953
3913-72b-202 (Effective 01/01/27), Utah Code Annotated 1953
4013-72b-203 (Effective 01/01/27), Utah Code Annotated 1953
4113-72b-204 (Effective 01/01/27), Utah Code Annotated 1953
4213-72b-205 (Effective 01/01/27), Utah Code Annotated 1953
4313-72b-301 (Effective 01/01/27), Utah Code Annotated 1953
4413-72b-302 (Effective 01/01/27), Utah Code Annotated 1953
4513-72b-303 (Effective 01/01/27), Utah Code Annotated 1953
4613-72b-304 (Effective 01/01/27), Utah Code Annotated 1953
4713-72b-305 (Effective 01/01/27), Utah Code Annotated 1953
4813-72b-306 (Effective 01/01/27), Utah Code Annotated 1953
4913-72b-401 (Effective 01/01/27), Utah Code Annotated 1953
5013-72c-101 (Effective 01/01/27), Utah Code Annotated 1953
5113-72c-201 (Effective 01/01/27), Utah Code Annotated 1953
5213-72c-202 (Effective 01/01/27), Utah Code Annotated 1953
5313-72c-203 (Effective 01/01/27), Utah Code Annotated 1953
5413-72c-301 (Effective 01/01/27), Utah Code Annotated 1953
5563A-16-215 (Effective 01/01/27), Utah Code Annotated 1953
56
57   Be it enacted by the Legislature of the state of Utah:
58Section 1. Section 13-2-1 is amended to read:
5913-2-1 [(Effective 07/01/26) ] (Effective 01/01/27). Consumer protection division
60   established -- Functions.
61   (1) There is established within the Department of Commerce the Division of Consumer
  -2-
Enrolled Copy  H.B. 276
62      Protection.
63  (2) The division shall administer and enforce the following:
64      (a) Chapter 10a, Music Licensing Practices Act;
65      (b) Chapter 11, Utah Consumer Sales Practices Act;
66      (c) Chapter 15, Business Opportunity Disclosure Act;
67      (d) Chapter 20, New Motor Vehicle Warranties Act;
68      (e) Chapter 21, Credit Services Organizations Act;
69      (f) Chapter 22, Charitable Solicitations Act;
70      (g) Chapter 23, Health Spa Services Protection Act;
71      (h) Chapter 25a, Telephone and Facsimile Solicitation Act;
72      (i) Chapter 26, Telephone Fraud Prevention Act;
73      (j) Chapter 28, Prize Notices Regulation Act;
74      (k) Chapter 32a, Pawnshop, Secondhand Merchandise, and Catalytic Converter
75Transaction Information Act;
76      (l) Chapter 34, Utah Postsecondary School and State Authorization Act;
77      (m) Chapter 41, Price Controls During Emergencies Act;
78      (n) Chapter 42, Uniform Debt-Management Services Act;
79      (o) Chapter 49, Immigration Consultants Registration Act;
80      (p) Chapter 51, Transportation Network Company Registration Act;
81      (q) Chapter 52, Residential Solar Energy Consumer Protection Act;
82      (r) Chapter 53, Residential, Vocational [or] and Life Skills Program Act;
83      (s) Chapter 54, Ticket Website Sales Act;
84      (t) Chapter 56, Ticket Transferability Act;
85      (u) Chapter 57, Maintenance Funding Practices Act;
86      (v) Chapter 61, Utah Consumer Privacy Act;
87      (w) Chapter 64, Vehicle Value Protection Agreement Act;
88      (x) Chapter 65, Utah Commercial Email Act;
89      (y) Chapter 67, Online Dating Safety Act;
90      (z) Chapter 68, Lawyer Referral Consultants Registration Act;
91      (aa) Chapter 70, Automatic Renewal Contracts Act;
92      (bb) Chapter 71, Utah Minor Protection in Social Media Act;
93      (cc) Chapter 72a, Artificial Intelligence Applications Relating to Mental Health;
94      (dd) Chapter 72c, Digital Content Provenance Standards Act;
95      [(dd)] (ee) Chapter 78, Earned Wage Access Services Act; and
  -3-
 H.B. 276  Enrolled Copy
96[(ee)] (ff) Chapter 81, Utah Digital Choice Act.
97   (3) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
98division may make rules to establish:
99(a) a public list that identifies a person that:
100(i) violates a chapter described in Subsection (2);
101(ii) without proper legal justification, fails to comply with an order, subpoena,
102judgment, or other legal process issued by:
103(A) the division; or
104(B) a court of competent jurisdiction; or
105(iii) breaches a settlement agreement, stipulation, assurance of voluntary compliance,
106or similar instrument signed by the person and the division; and
107(b) a process by which a person may be removed from the list the division establishes as
108described in Subsection (3)(a).
109Section 2. Section 13-72b-101 is enacted to read:
110CHAPTER 72b. Digital Voyeurism Prevention Act
111Part 1. General Provisions
11213-72b-101 (Effective 01/01/27). Definitions.
113      As used in this chapter:
114   (1) "Artificial intelligence technology" means the same as that term is defined in Section
11513-72-101.
116   (2) "Consent" means express permission, freely and voluntarily given by an identifiable
117individual, with full knowledge of the nature and purpose of the generation of an
118intimate image depicting the individual, where the consent:
119(a) is specific to the particular intimate image being generated;
120(b) is obtained before the generation of the intimate image; and
121(c) may be revoked at any time.
122   (3) "Counterfeit intimate image" means a "digital forgery" as that term is defined in the
123Take It Down Act.
124   (4) "Covered platform" means the same as that term is defined in Section 3 of the Take It
125Down Act, Public Law 119-12, 139 Stat. 59, codified at 47 U.S.C. 230 note.
126   (5)(a) "Distribute" means to sell, exhibit, display, publish, provide, give, provide access
127to, or otherwise transfer a counterfeit intimate image, with or without consideration.
128(b) "Distribute" includes the generation of a counterfeit intimate image by a generation
  -4-
 Enrolled Copy  H.B. 276
129service and the subsequent provision of that counterfeit intimate image to the user.
130  (6) "Generate" means to create, produce, compose, materially edit, or facilitate the creation
131      of an intimate image through the use of artificial intelligence technology.
132  (7) "Generation service" means a person that operates, maintains, or provides an interactive
133      computer service that:
134      (a) enables users to generate intimate images;
135      (b) processes user image generation requests through servers, computer systems, or
136computing resources controlled by the service operator rather than solely on the
137user's local device; and
138      (c) distributes generated intimate images to users through the service.
139  (8) "Identifiable individual" means an individual who is recognizable as an actual human
140      individual by the human individual's face, likeness, or other distinguishing
141      characteristic, including a unique physical feature or other recognizable attribute.
142  (9) "Interactive computer service" means the same as that term is defined in 47 U.S.C. Sec.
143      230(f)(2).
144  (10) "Intimate image" means an "intimate visual depiction" as those terms are defined in the
145      Take It Down Act.
146  (11) "Reasonable expectation of privacy" means an individual's expectation that:
147      (a) the individual's body will not be viewed, recorded, or depicted in an intimate image
148without the individual's knowledge and consent; and
149      (b) an intimate image of the individual will not be generated, created, distributed, or
150manipulated without the individual's knowledge and consent.
151  (12) "Sexually explicit conduct" means the same as that term is defined in 18 U.S.C. Sec.
152      2256(2)(A).
153  (13) "Take It Down Act" means the Tools to Address Known Exploitation by Immobilizing
154      Technological Deepfakes on Websites and Networks Act, Public Law 119-12, codified
155      at 47 U.S.C. Sec. 230 note.
156Section 3. Section 13-72b-201 is enacted to read:
157Part 2. Generation Services
15813-72b-201 (Effective 01/01/27). Unlawful distribution of non-consensual
159  counterfeit intimate images.
160  (1) The distribution of a counterfeit intimate image by a generation service without the
161      consent of the identifiable individual depicted in the image is a violation of the
162      individual's reasonable expectation of privacy.
  -5-
 H.B. 276  Enrolled Copy
163   (2) A generation service may not distribute a counterfeit intimate image without first
164obtaining consent from the identifiable individual depicted in the counterfeit intimate
165image.
166   (3) To obtain consent sufficient to meet the requirements of Subsection (2), a generation
167service shall implement and maintain a consent system that:
168(a) requires the identifiable individual depicted in the counterfeit intimate image to
169affirmatively provide consent before the counterfeit intimate image is distributed;
170(b) assures the identity of the individual providing consent with reasonable accuracy; and
171(c) maintains a record of the consent for a period of not less than seven years.
172   (4) A generation service may not require an individual to disclose personally identifiable
173information beyond what is reasonably necessary to assure the individual's identity and
174obtain valid consent.
175Section 4. Section 13-72b-202 is enacted to read:
17613-72b-202 (Effective 01/01/27). Civil liability for generation services.
177   (1) A person, or the heirs of a deceased person, who has been injured by a violation
178recognized in Section 13-72b-201 may bring a civil action against the generation service
179that committed the violation.
180   (2) If in an action described in Subsection (1) the court finds the defendant is violating or
181has violated any provision of Section 13-72b-201, the court shall:
182(a) enjoin the defendant from continuing the violation; and
183(b) order the defendant to remove or destroy any counterfeit intimate image distributed
184in violation of Section 13-72b-201 and all copies of the counterfeit intimate image
185within the defendant's possession or control.
186   (3) It is not necessary that actual damages to the plaintiff be alleged or proved in an action
187under this section.
188   (4) A plaintiff in an action under this section is entitled to recover:
189(a) actual damages sustained, if any, including damages for emotional distress;
190(b) punitive damages, if the violation is found to be willful, reckless, or malicious; and
191(c) reasonable attorney fees and costs.
192   (5) Each distribution of a counterfeit intimate image depicting an identifiable individual
193without consent constitutes a separate violation.
194   (6) The statute of limitations for a civil action under this section is the later of:
195(a) three years from the date the plaintiff discovered or reasonably should have
196discovered the violation; or
  -6-
 Enrolled Copy  H.B. 276
197      (b) 10 years from the date of the violation.
198Section 5. Section 13-72b-203 is enacted to read:
19913-72b-203 (Effective 01/01/27). Safe harbor for generation services.
200  (1) A generation service is not liable under Section 13-72b-202 if the generation service
201      demonstrates that:
202      (a) the generation service does not hold itself out as providing services for creating
203counterfeit intimate images;
204      (b) the generation service has implemented and maintains a written policy that:
205(i) prohibits the generation and distribution of non-consensual counterfeit intimate
206images;
207(ii) includes reasonable safeguards designed to prevent the creation of counterfeit
208intimate images; and
209(iii) includes procedures for responding to reports of violations;
210      (c) the generation service acted in accordance with the policy described in Subsection
211(1)(b) with respect to the alleged violation;
212      (d) the generation service published the policy described in Subsection (1)(b) in a clear
213and conspicuous location accessible to the public on the generation service's website
214or primary user interface;
215      (e) the generation service published a general description of the reasonable safeguards
216described in Subsection (1)(b)(ii), which may describe technical measures in general
217terms without disclosing proprietary implementation details that could be exploited to
218circumvent the safeguards;
219      (f) the generation service implemented and maintained a consent system that complies
220with Subsection 13-72b-201(3); and
221      (g) upon receiving notice that a counterfeit intimate image was created or distributed
222without consent, the generation service took prompt action to prevent further
223distribution.
224  (2) A generation service qualifies for the safe harbor under Subsection (1) even if a
225      non-consensual counterfeit intimate image was distributed through the service if the
226      generation service demonstrates that:
227      (a) the generation service had no actual knowledge that the image was created or
228distributed without consent before receiving notice;
229      (b) the generation service's consent system was operating as designed;
230      (c) the generation service reasonably relied on information provided through the consent
  -7-
 H.B. 276  Enrolled Copy
231system; and
232(d) upon discovering the violation, the generation service took prompt action to prevent
233further distribution.
234   (3) A generation service that has implemented and maintains a written policy and
235reasonable technical safeguards that categorically prevent the generation of intimate
236images by the service is not required to comply with the consent requirements in
237Subsections (1)(b), (1)(c), (1)(e), (1)(f), (2)(b), and (2)(c) to qualify for safe harbor
238protection under this section.
239   (4) In determining whether a generation service qualifies for safe harbor protection under
240this section, the court shall, among other relevant factors, consider whether the
241generation service's safeguards and policies:
242(a) are consistent with widely accepted industry standards;
243(b) are regularly updated to address emerging technologies and methods for creating
244counterfeit intimate images;
245(c) include technical measures to detect and prevent the generation of counterfeit
246intimate images; and
247(d) include reasonable measures to ensure that users are not attempting to circumvent the
248safeguards.
249   (5) A generation service may assert the safe harbor protections under this section by motion
250before trial and is not required to proceed to trial to establish eligibility for the safe
251harbor.
252Section 6. Section 13-72b-204 is enacted to read:
25313-72b-204 (Effective 01/01/27). Heightened pleading standard for actions
254   against generation services.
255   (1) In any action brought under Section 13-72b-202 against a generation service, the
256complaint shall plead with particularity facts establishing that the generation service
257does not qualify for safe harbor protection under Section 13-72b-203.
258   (2) To meet the pleading requirements of Subsection (1), the plaintiff shall include specific
259factual allegations, including dates, communications, and other evidence, demonstrating
260that the generation service does not qualify for safe harbor protection under Section
26113-72b-203, including facts showing one or more of the following:
262(a) that the generation service holds itself out as providing services for creating
263counterfeit intimate images;
264(b) that the generation service failed to implement a written policy that:
  -8-
 Enrolled Copy  H.B. 276
265(i) prohibits the generation and distribution of non-consensual counterfeit intimate
266images;
267(ii) includes reasonable safeguards designed to prevent the creation of counterfeit
268intimate images; and
269(iii) includes procedures for responding to reports of violations;
270      (c) that the generation service distributed a counterfeit intimate image depicting the
271plaintiff without requesting or obtaining the plaintiff's consent;
272      (d) that the generation service had actual knowledge that a counterfeit intimate image
273was created or distributed without consent and failed to take prompt action to prevent
274further distribution; or
275      (e) that the generation service intentionally designed the service to facilitate the creation
276of non-consensual counterfeit intimate images.
277  (3) General or conclusory allegations that a generation service violated this part are
278      insufficient to state a claim.
279  (4) If a complaint fails to meet the pleading requirements of this section, the court shall
280      dismiss the action without prejudice.
281  (5) A generation service may bring a motion to dismiss under this section before filing an
282      answer or other responsive pleading.
283  (6) If the court grants a motion to dismiss under this section and the plaintiff files an
284      amended complaint that again fails to meet the pleading requirements of this section, the
285      court shall:
286      (a) dismiss the action with prejudice; and
287      (b) award the generation service reasonable attorney fees and costs incurred in bringing
288the motion to dismiss the amended complaint.
289Section 7. Section 13-72b-205 is enacted to read:
29013-72b-205 (Effective 01/01/27). Transparency and reporting requirements.
291  (1) A generation service shall take reasonable measures to inform users that:
292      (a) distribution of non-consensual counterfeit intimate images is prohibited;
293      (b) violations of this part may result in civil liability; and
294      (c) the service provides procedures for reporting violations.
295  (2) A generation service shall clearly and conspicuously provide to users procedures for
296      reporting violations to the generation service.
297  (3) A generation service shall publish in a clear and conspicuous location on the generation
298      service's website or primary user interface:
  -9-
 H.B. 276  Enrolled Copy
299(a) the written policy required by Subsection 13-72b-203(1)(b); and
300(b) a general description of the safeguards implemented to prevent the generation of
301non-consensual counterfeit intimate images, which may describe technical measures
302in general terms without disclosing proprietary implementation details that could be
303exploited to circumvent the safeguards.
304Section 8. Section 13-72b-301 is enacted to read:
305Part 3. Covered Platforms
30613-72b-301 (Effective 01/01/27). Unlawful distribution of non-consensual
307   counterfeit intimate images on platforms.
308   (1) A covered platform may not knowingly allow the distribution of a counterfeit intimate
309image without consent from the identifiable individual depicted in the counterfeit
310intimate image.
311   (2) A covered platform knowingly allows the distribution of a counterfeit intimate image
312without consent if the covered platform:
313(a) receives notice under Section 13-72b-302 that a counterfeit intimate image has been
314distributed without consent; and
315(b) fails to comply with the takedown requirements in Section 13-72b-302.
316Section 9. Section 13-72b-302 is enacted to read:
31713-72b-302 (Effective 01/01/27). Duty to remove -- Notice and takedown
318   requirements.
319   (1) A covered platform shall establish and implement notice and removal procedures that
320comply with the requirements established in Section 3(a) of the Take It Down Act.
321   (2) The requirements described in Subsection (1) include:
322(a) establishing a mechanism for an individual depicted in a counterfeit intimate image
323to notify the covered platform that the image has been published on the covered
324platform without the individual's consent;
325(b) providing clear and conspicuous notice of the mechanism described in Subsection
326(2)(a);
327(c) upon receiving notice that meets the requirements established in the Take It Down
328Act, removing the reported counterfeit intimate image within 48 hours after receiving
329the notice; and
330(d) making reasonable efforts to identify and remove any identical copy of the
331counterfeit intimate image.
332   (3) A covered platform that complies in good faith with the notice and takedown
  - 10 -
 Enrolled Copy  H.B. 276
333      procedures required by this section is not liable under this chapter for actions taken in
334      accordance with this section before receiving notice.
335Section 10. Section 13-72b-303 is enacted to read:
33613-72b-303 (Effective 01/01/27). Civil liability for covered platforms.
337  (1) A person, or the heirs of a deceased person, who has been injured by a violation of
338      Section 13-72b-301 may bring a civil action against the covered platform that committed
339      the violation.
340  (2) If in an action described in Subsection (1) the court finds the defendant is violating or
341      has violated any provision of Section 13-72b-301, the court shall:
342      (a) enjoin the defendant from continued violation; and
343      (b) order the defendant to remove or destroy any counterfeit intimate image distributed
344in violation of Section 13-72b-301 and all copies of the counterfeit intimate image
345within the defendant's possession or control.
346  (3) It is not necessary that actual damages to the plaintiff be alleged or proved in an action
347      under this section.
348  (4) A plaintiff in an action under this section is entitled to recover:
349      (a) actual damages sustained, if any, including damages for emotional distress;
350      (b) punitive damages, if the violation is found to be willful, reckless, or malicious; and
351      (c) reasonable attorney fees and costs.
352  (5) Each failure to comply with the notice and takedown requirements established in
353      Section 13-72b-302 after receiving notice of a counterfeit intimate image constitutes a
354      separate violation of this chapter.
355  (6) The statute of limitations for a civil action under this section is the later of:
356      (a) three years from the date the plaintiff discovered or reasonably should have
357discovered the violation; or
358      (b) 10 years from the date of the violation.
359Section 11. Section 13-72b-304 is enacted to read:
36013-72b-304 (Effective 01/01/27). Safe harbor for covered platforms.
361  (1) A covered platform is not liable under Section 13-72b-303 if the covered platform
362      demonstrates that:
363      (a) the covered platform implemented and maintained notice and removal procedures
364that comply with Section 13-72b-302; and
365      (b) the covered platform acted in good faith in responding to notices of non-consensual
366counterfeit intimate images.
  - 11 -
 H.B. 276  Enrolled Copy
367   (2) A covered platform qualifies for safe harbor protection under this section even if a
368non-consensual counterfeit intimate image appeared on the platform if the covered
369platform demonstrates that:
370(a) the covered platform had no actual knowledge of the image before receiving notice
371under Section 13-72b-302; and
372(b) upon receiving notice, the covered platform complied with the takedown
373requirements in Section 13-72b-302.
374   (3) In determining whether a covered platform acted in good faith in responding to a notice
375of a non-consensual counterfeit intimate image, the court shall consider:
376(a) the size and resources of the covered platform;
377(b) the volume of content distributed on the platform;
378(c) the effectiveness of the platform's proactive measures; and
379(d) whether the platform's measures are consistent with widely accepted industry
380standards.
381   (4) A covered platform may establish the safe harbor protections under this section by
382motion to dismiss or motion for summary judgment.
383   (5) If a court determines that a covered platform has established safe harbor protection
384under this section on a motion to dismiss or motion for summary judgment, the court
385shall:
386(a) dismiss the action or grant summary judgment in favor of the covered platform; and
387(b) award the covered platform reasonable attorney fees and costs.
388Section 12. Section 13-72b-305 is enacted to read:
38913-72b-305 (Effective 01/01/27). Heightened pleading standard for actions
390   against covered platforms.
391   (1) In any action brought under Section 13-72b-303 against a covered platform, the
392complaint shall plead with particularity facts establishing that the covered platform does
393not qualify for safe harbor protection under Section 13-72b-304.
394   (2) To meet the pleading requirements of Subsection (1), the plaintiff shall include specific
395factual allegations demonstrating that the covered platform does not qualify for safe
396harbor protection under Section 13-72b-304, including facts showing one or more of the
397following:
398(a) that the covered platform failed to implement notice and removal procedures that
399comply with Section 13-72b-302;
400(b) that the covered platform failed to act in good faith in responding to notices of
  - 12 -
 Enrolled Copy  H.B. 276
401non-consensual counterfeit intimate images;
402      (c) if the plaintiff provided notice under Section 13-72b-302:
403(i) the specific date and method by which notice was provided;
404(ii) the content of the notice provided;
405(iii) the covered platform's response or failure to respond; and
406(iv) facts establishing that the covered platform failed to comply with the takedown
407requirements in Section 13-72b-302; or
408      (d) if the plaintiff did not provide notice under Section 13-72b-302:
409(i) facts establishing that the covered platform had actual knowledge of the
410non-consensual counterfeit intimate image before the plaintiff provided notice; and
411(ii) facts establishing that the covered platform failed to take reasonable steps to
412remove the image within 48 hours after obtaining actual knowledge.
413  (3) General or conclusory allegations that a covered platform violated this part are
414      insufficient to state a claim.
415  (4) If a complaint fails to meet the pleading requirements of this section, the court shall
416      dismiss the action without prejudice.
417  (5) A covered platform may bring a motion to dismiss under this section before filing an
418      answer or other responsive pleading.
419  (6) If the court grants a motion to dismiss under this section and the plaintiff files an
420      amended complaint that again fails to meet the pleading requirements of this section, the
421      court shall:
422      (a) dismiss the action with prejudice; and
423      (b) award the covered platform reasonable attorney fees and costs incurred in bringing
424the motion to dismiss the amended complaint.
425Section 13. Section 13-72b-306 is enacted to read:
42613-72b-306 (Effective 01/01/27). Relationship to federal law.
427  (1) This part does not expand or modify the notice and takedown requirements established
428      in the Take It Down Act.
429  (2) This part does not alter, modify, or limit Section 230 of the Communications Decency
430      Act, 47 U.S.C. Sec. 230, and may not be construed to impose liability on a covered
431      platform for acting as the publisher or speaker of information provided by another
432      information content provider.
433Section 14. Section 13-72b-401 is enacted to read:
434Part 4. Severability
  - 13 -
 H.B. 276  Enrolled Copy
43513-72b-401 (Effective 01/01/27). Severability.
436   (1) If any provision of this chapter or the application of any provision to any person or
437circumstance is held invalid by a final decision of a court of competent jurisdiction, the
438remainder of this chapter shall be given effect without the invalid provision or
439application.
440   (2) The provisions of this chapter are severable.
441Section 15. Section 13-72c-101 is enacted to read:
442CHAPTER 72c. Digital Content Provenance Standards Act
443Part 1. General Provisions
44413-72c-101 (Effective 01/01/27). Definitions.
445      As used in this chapter:
446   (1) "Artificial intelligence" means a machine-based system that makes predictions,
447recommendations, or decisions influencing real or virtual environments.
448   (2) "Capture device" means a device that can record photographs, audio, or video content,
449including a video camera, a still photography camera, a mobile phone with a built-in
450camera or microphone, or a voice recorder.
451   (3)(a) "Capture device manufacturer" means a person who produces a capture device for
452sale in the state.
453(b) "Capture device manufacturer" does not include a person exclusively engaged in the
454assembly of a capture device.
455   (4) "Compliant system provenance data" means system provenance data that is compliant
456with widely adopted specifications of an established standards-setting body.
457   (5)(a) "Covered provider" means a person that creates, codes, or otherwise produces a
458generative artificial intelligence system that:
459(i) has over 1,000,000 monthly visitors or users; and
460(ii) is publicly accessible within the geographic boundaries of the state.
461(b) "Covered provider" does not include a person that creates, codes, or otherwise
462produces a generative artificial intelligence system that is used exclusively for the
463person's internal business operations and is not made publicly accessible.
464   (6) "Digital signature" means a cryptography-based method that identifies the user or entity
465that attests to the information provided in the signed section.
466   (7) "Generative artificial intelligence system" means an artificial intelligence system that
467can generate derived synthetic content, including text, images, video, or audio, that
  - 14 -
 Enrolled Copy  H.B. 276
468      emulates the structure and characteristics of the system's training data.
469  (8)(a) "Large online platform" means a public-facing social media platform, mass
470      messaging platform, or stand-alone search engine that distributes content to users
471      who did not create or collaborate in creating the content and that exceeded 2,000,000
472      unique monthly users during the preceding 12 months.
473      (b) "Large online platform" does not include:
474(i) a broadband internet access service, as defined in 47 C.F.R. Sec. 8.1(b); or
475(ii) a telecommunications service, as defined in 47 U.S.C. Sec. 153.
476  (9) "Latent" means present but not manifest.
477  (10) "Manifest" means easily perceived, understood, or recognized by a natural person.
478  (11) "Mass messaging platform" means a direct messaging platform that allows users to
479      distribute content to more than 100 users simultaneously.
480  (12) "Metadata" means structural or descriptive information about data.
481  (13) "Personal information" means the same as that term is defined in Section 13-61-101.
482  (14) "Provenance data" means data that is embedded into digital content, or that is included
483      in the digital content's metadata, for the purpose of verifying the digital content's
484      authenticity, origin, or history of modification.
485  (15) "System provenance data" means provenance data that is not reasonably capable of
486      being associated with a particular user and that contains:
487      (a) information regarding the type of device, system, or service that was used to generate
488a piece of digital content; or
489      (b) information related to content authenticity.
490  (16) "User" means a Utah resident who accesses, interacts with, or uses an interactive
491      computer service, platform, generation service, generative artificial intelligence system,
492      or capture device.
493  (17) "User interface" means the method by which an individual interacts with, controls, or
494      receives information from a computer, software application, website, or electronic
495      device.
496Section 16. Section 13-72c-201 is enacted to read:
497Part 2. Content Provenance Standards and Requirements
49813-72c-201 (Effective 01/01/27). Requirements for large online platforms.
499  (1) A large online platform shall:
500      (a) detect whether compliant system provenance data is embedded into or attached to
501content distributed on the large online platform;
  - 15 -
 H.B. 276  Enrolled Copy
502(b) provide a user interface to disclose the availability of system provenance data; and
503(c) allow a user to inspect all available compliant system provenance data in an easily
504accessible manner:
505(i) directly through the large online platform's user interface described in Subsection
506(1)(b);
507(ii) by allowing the user to download the content's compliant system provenance
508data; or
509(iii) by providing a link to the content's system provenance data displayed on an
510internet website or in another application provided either by the large online
511platform or a third party.
512   (2) A large online platform may not, to the extent technically feasible, knowingly strip any
513system provenance data or digital signature that is compliant with widely adopted
514specifications adopted by an established standards-setting body from content uploaded
515or distributed on the large online platform.
516Section 17. Section 13-72c-202 is enacted to read:
51713-72c-202 (Effective 01/01/27). Requirements for capture devices.
518   (1) A capture device manufacturer shall include a latent disclosure in content captured by
519the capture device that conveys:
520(a)(i) the name of the capture device manufacturer; or
521(ii) digital signatures sufficient to prove whether the content was created using a type
522of capture device; and
523(b) the time and date of the content's creation or alteration.
524   (2) A capture device manufacturer may provide a user with the option to disable the latent
525disclosure on a capture device required in Subsection (1).
526   (3) A capture device manufacturer shall comply with this section only to the extent
527technically feasible and compliant with widely adopted specifications adopted by an
528established standards-setting body.
529   (4) This section applies to any capture device a capture device manufacturer produces for
530sale in the state on or after January 1, 2028.
531Section 18. Section 13-72c-203 is enacted to read:
53213-72c-203 (Effective 01/01/27). User disclosures.
533      A covered provider shall include a latent disclosure in image, video, or audio content, or
534   content that is any combination of image, video, or audio, created or substantially modified by
535   the covered provider's generative artificial intelligence system that meets the following criteria:
  - 16 -
 Enrolled Copy  H.B. 276
536  (1) to the extent that it is technically feasible and reasonable, the disclosure conveys the
537      following information, either directly or through a link to a permanent internet website:
538      (a) the time and date of the content's creation or alteration; and
539      (b) either:
540(i) the name of the capture device manufacturer; or
541(ii) digital signatures sufficient to prove whether the content was created or
542substantially altered using a generative artificial intelligence system; and
543  (2) the disclosure is consistent with widely accepted industry standards.
544Section 19. Section 13-72c-301 is enacted to read:
545Part 3. Enforcement
54613-72c-301 (Effective 01/01/27). Enforcement -- Civil liability.
547  (1) The Division of Consumer Protection shall administer and enforce the provisions of Part
548      2, Content Provenance Standards and Requirements in accordance with Chapter 2,
549      Division of Consumer Protection.
550  (2) In addition to the division's enforcement powers under Chapter 2, Division of Consumer
551      Protection:
552      (a) the division director may impose an administrative fine of up to $2,500 for each
553violation of this chapter; and
554      (b) the division may bring an action in a court of competent jurisdiction to enforce a
555provision of this chapter.
556  (3) In a court action by the division to enforce a provision of this chapter, the court may:
557      (a) declare that an act or practice violates a provision of this chapter;
558      (b) issue an injunction for a violation of this chapter;
559      (c) order disgorgement of money received in violation of this chapter;
560      (d) order payment of disgorged money to an injured purchaser or consumer;
561      (e) impose a fine of up to $2,500 for each violation of this chapter; or
562      (f) award other relief that the court determines reasonable and necessary.
563  (4) If a court awards judgment or injunctive relief to the division, the court shall award the
564      division:
565      (a) reasonable attorney fees;
566      (b) court costs; and
567      (c) investigative fees.
568  (5) A court may impose a civil penalty of no more than $5,000 for each violation of an
569      administrative or court order issued for a violation of this chapter.
  - 17 -
 H.B. 276  Enrolled Copy
570   (6) The attorney general may bring a civil action on behalf of the division to collect a civil
571penalty imposed under this section.
572   (7) The division shall deposit all fines and civil penalties collected under this section into
573the Consumer Protection Education and Training Fund created in Section 13-2-8.
574   (8) Nothing in this chapter shall displace any other available remedies or rights authorized
575under the laws of this state or the United States.
576Section 20. Section 63A-16-215 is enacted to read:
57763A-16-215 (Effective 01/01/27). Government websites and applications.
578   (1) The chief information officer shall make rules, in accordance with Title 63G, Chapter 3,
579Utah Administrative Rulemaking Act, establishing standards for digital content on a
580webpage of a state agency that the public can access to facilitate a transaction or obtain a
581service if the chief information officer determines there is a substantial risk that
582fraudulent or misleading media could cause harm to a resident of the state interacting
583with the state agency.
584   (2) The standards required by Subsection (1) shall require a digitally accessible provenance
585record containing provenance information for digital content captured, created, or edited
586that includes:
587(a) the identification of:
588(i) the type of software or tool used; or
589(ii) the specific tool used;
590(b) the date of creation;
591(c) a content identifier; and
592(d) the previous content identifiers, if applicable.
593   (3) This section does not apply to digital content created before January 1, 2027.
594Section 21. Effective Date.
595   This bill takes effect on January 1, 2027.
  - 18 -