Complete Guide to U.S. Deepfake Laws: 2025 State and Federal Compliance Landscape
Executive Summary
The deepfake regulatory landscape has exploded in 2025, with Michigan becoming the 48th state to enact deepfake legislation in August, leaving only Missouri and New Mexico without comprehensive deepfake laws. This represents a dramatic acceleration from previous years, driven by high-profile incidents and growing awareness of AI-generated content harms.
California’s 2025 Privacy and AI Legislative Landscape: Eight Bills Navigate Complex Path Forward
TL;DR: California’s legislature is considering eight privacy-focused bills that could significantly reshape how companies handle consumer data, with three bills having stalled while five continue advancing. The legislation targets precise geolocation tracking, data broker practices, age verification systems, and opt-out preference signals—representing the state’s continued push to strengthen
Compliance Hub
Key Takeaways:
- Federal TAKE IT DOWN Act signed by President Trump in May 2025 creates first federal framework
- 47 states now have enacted deepfake legislation since 2019
- Three main categories: nonconsensual intimate imagery, political deepfakes, and personality rights
- Businesses face complex compliance obligations across multiple jurisdictions
- Penalties range from misdemeanors to felonies with significant fines
The Take It Down Act: America’s First Federal Law Against Deepfakes and Revenge Porn
Executive Summary The Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (Take It Down Act) represents a historic milestone in federal legislation addressing digital exploitation. Signed into law by President Donald Trump on May 19, 2025, this bipartisan legislation criminalizes the publication of non-consensual
My Privacy Blog
Federal Landscape: The TAKE IT DOWN Act
Overview
President Donald Trump signed the TAKE IT DOWN Act into law on May 19, 2025, marking the first comprehensive federal regulation of AI-generated content. The Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act creates criminal penalties and platform obligations.
Key Federal Provisions
Criminal Prohibitions:
- Prohibits "knowingly publishing" intimate visual depictions of minors or non-consenting adults without consent
- Covers both authentic images and AI-generated deepfakes intended to cause harm
- Penalties include up to 2 years imprisonment for adults, 3 years for minors
Platform Requirements:
- Covered platforms must establish notice-and-removal procedures within one year (by May 19, 2026)
- 48-hour removal requirement after valid notice
- Must make reasonable efforts to remove duplicates and reposts
- FTC enforcement for non-compliance under Federal Trade Commission Act
The Rubio Deepfake Incident: A Wake-Up Call for Government Communications Security
Introduction The recent AI-powered impersonation of Secretary of State Marco Rubio represents a watershed moment in cybersecurity threats against high-level government officials. This sophisticated attack, which targeted foreign ministers, a U.S. governor, and a member of Congress, has exposed critical vulnerabilities in how the highest levels of government conduct
My Privacy Blog
State Law Categories and Approaches
Category 1: Nonconsensual Sexual Deepfakes
Currently, 27 states have enacted laws addressing sexual deepfakes, with 13 focusing on nonconsensual sexual content, 8 criminalizing AI-generated CSAM, and 6 addressing both.
Leading Examples:
California (Comprehensive Approach):
- SB 926: Criminalizes creation and distribution of AI-generated sexually explicit content causing emotional distress
- SB 981: Requires social media platforms to establish reporting mechanisms with temporary blocking during investigation
- Both laws effective January 1, 2025
Michigan (Most Recent - 48th State):
- Misdemeanor: Up to 1 year imprisonment and $3,000 fine for creating deepfakes causing harm
- Felony escalation: If victim suffers financial loss, creator intended profit, maintained website for deepfake creation, or posted online
- Specifically covers sexual content where person is identifiable "by reasonable individual"
New York (Hinchey Law):
- Makes it illegal to disseminate AI-generated explicit images without consent
- Criminal penalties: Up to 1 year jail and $1,000 fine
- Private right of action for victims against perpetrators
The 2025 RealSchlep vs. Roblox Controversy: A Deep Dive
TL;DR - Bottom Line Up Front YouTuber Michael “Schlep” (22) has been permanently banned from Roblox and threatened with legal action after his predator-catching operations led to six confirmed arrests of alleged child predators. Roblox claims his vigilante methods violated their Terms of Service and created “an unsafe environment,
My Privacy Blog
Category 2: Political Deepfakes
As of May 2025, 28 states had enacted laws regulating deepfakes in political communications, with most applying within certain timeframes before elections.
Key Features:
- States use varying terminology: "synthetic media" (7 states), "materially deceptive media" (6 states), or "deepfakes" (3 states)
- Most include exceptions for materials with disclosure statements
- California's AB 2355 requires clear disclaimers: "This ad was generated or substantially altered using artificial intelligence"
Category 3: Personality Rights and Likeness Protection
Tennessee ELVIS Act (Groundbreaking Approach):
- First state law protecting voice as property right alongside name, photograph, and likeness
- Effective July 1, 2024, allows civil lawsuits for unauthorized voice/likeness use
- Creates liability for distributing tools whose "primary purpose" is creating unauthorized reproductions
- Maintains criminal misdemeanor liability and allows treble damages for knowing violations
Rep. Nancy Mace’s RESPECT Act: Strengthening Federal Response to Deepfakes and Revenge Porn
Executive Summary Rep. Nancy Mace (R-SC) has introduced the Responding to Exploitation and Sharing of Private Explicit Content and Threats (RESPECT) Act (H.R. 4600) as a follow-up to the recently enacted Take It Down Act. While the Take It Down Act, signed by President Trump on May 19, 2025,
My Privacy Blog
Notable State Variations and Penalties
California: Entertainment Industry Focus
- AB 2602: Makes unenforceable contract provisions allowing digital replica creation without specific description and legal representation
- AB 1836: Protects deceased personalities' digital replicas without estate consent
Pennsylvania: Broad Criminal Approach
- Act 35 (July 2025): Criminal penalties for creating/disseminating deepfakes with fraudulent intent
- First-degree misdemeanor ($1,500-$10,000 fine, up to 5 years jail) or third-degree felony (up to $15,000, up to 7 years jail) for financial fraud
The Alarming Use of AI in Creating Child Pornography: A Legal and Ethical Challenge
Introduction:
The rapid advancement of Artificial Intelligence (AI) has brought about significant benefits in various fields. However, it also presents a dark side, particularly in the illegal creation of child pornography. This emerging trend is not just a technological issue but a grave social, legal, and ethical concern. The AI
My Privacy Blog
Definitional Challenges
States have adopted varying legal definitions for fundamental terms including "deepfakes," "artificial intelligence," and "synthetic media," creating inconsistencies that can lead to unpredictable outcomes for victims seeking legal redress.
Key Definition Variations:
- Texas: Deepfake as "video created with intent to deceive"
- Minnesota: Includes any recording, image, or photograph "substantially derivative thereof"
- California/Minnesota: Require "realistic" standard that would fool "reasonable person"
The SCREEN Act: How “Protecting Children” Became the Trojan Horse for Mass Digital Surveillance
The Political Theater of Child Safety On August 1, 2025, Representative Mary Miller’s seemingly innocuous tweet about protecting children from adult content online sparked a firestorm that exposed the true nature of the SCREEN Act. Her statement—“Children should NEVER have access to adult content online”—was met with an
My Privacy Blog
Compliance Recommendations for Businesses
For Technology Platforms
- Immediate Preparations for Federal Compliance:
- Begin developing notice-and-takedown systems for May 2026 TAKE IT DOWN Act deadline
- Implement user reporting mechanisms for intimate imagery
- Establish 48-hour response protocols
- Content Moderation Enhancement:
- Deploy AI detection tools for deepfake identification
- Create clear community guidelines addressing synthetic media
- Train content moderators on deepfake identification
- Geographic Compliance Mapping:
- Audit operations across 48+ jurisdictions with deepfake laws
- Implement geo-specific content policies where required
- Monitor remaining states (Missouri, New Mexico) for legislative developments
For Entertainment and Media Companies
- Contractual Safeguards:
- Ensure digital replica provisions include "reasonably specific description of intended uses"
- Confirm talent representation by legal counsel or union in AI-related contracts
- Implement clear consent mechanisms for voice and likeness capture
- Rights Management:
- Audit existing content for potential deepfake issues
- For deceased personalities, secure proper estate permissions under laws like California's AB 1836
- Maintain comprehensive records of consent and authorization
For Political Organizations
- Disclosure Requirements:
- Implement "generated or substantially altered using artificial intelligence" disclaimers where required
- Monitor varying state timeframes (typically 60 days before election)
- Train campaign staff on synthetic media identification and labeling
- Risk Management:
- Establish rapid response protocols for deepfake attacks
- Maintain evidence of authentic content creation
- Coordinate with platform reporting mechanisms
For All Businesses
- Employee Training:
- Educate staff on deepfake identification and risks
- Implement clear policies on AI-generated content creation and sharing
- Establish reporting protocols for suspected violations
- Incident Response Planning:
- Create escalation procedures for deepfake incidents
- Maintain relationships with law enforcement and legal counsel
- Document potential violations for enforcement action
The Hong Kong Deepfake Debacle: A New Era in Cybersecurity Threats and How to Combat It
A Guide to Protecting Your Online Identity in Dating: Catfishing, Deepfakes, and ScamsIntroduction The world of online dating can be an exciting way to meet new people and potentially find a romantic partner. However, it also comes with risks, including catfishing, deepfakes, and scams. This guide will provide tips on
My Privacy Blog
Enforcement Landscape
State-Level Enforcement
Prosecution Challenges:
- Proving intent requirements in many laws
- Identifying perpetrators behind anonymous accounts
- Jurisdictional issues for interstate/international cases
Civil Remedies:
- DEFIANCE Act (pending) would provide up to $250,000 in civil damages
- State laws typically provide private rights of action
- Tennessee allows treble damages for knowing violations
Federal Enforcement
- FTC enforcement authority under TAKE IT DOWN Act
- Criminal prosecution by DOJ for interstate violations
- Platform safe harbor for good faith compliance efforts
Navigating the Deepfake Dilemma: Protecting Your Privacy in the AI Era
In our increasingly digital world, where personal lives and professional responsibilities often intertwine, the integrity of our digital identity is paramount. Yet, an escalating threat, the deepfake, is blurring the lines between what’s real and what’s fabricated, posing unprecedented challenges to our privacy and security. Drawing on advanced Artificial Intelligence
My Privacy Blog
Future Outlook and Emerging Trends
Likely Near-Term Developments
- Remaining State Action:
- Missouri and New Mexico likely to pass legislation in 2026
- Expansion of existing state laws to cover new use cases
- Federal Expansion:
- DEFIANCE Act reintroduced in May 2025 for civil remedies
- Industry push for federal No AI FRAUD Act for unified personality rights
- Technical Standards:
- California SB 942 requirements for AI content provenance disclosure
- Development of industry watermarking standards
- Enhanced detection technology deployment
International Considerations
- EU AI Act mandates transparency for AI-generated content
- UK Online Safety Act requires platform removal of deepfake content
- China requires all AI-generated content to be clearly labeled
Conclusion
The deepfake regulatory landscape has reached a tipping point in 2025, with nearly universal state adoption and the first federal framework now in place. With 48 states having enacted legislation and comprehensive federal requirements taking effect in 2026, businesses must prioritize compliance across this complex patchwork of requirements.
The Peril of Deepfakes in Election Integrity: A Case Study of Impersonating Rishi Sunak
In recent times, the burgeoning use of artificial intelligence in the generation of deepfakes has emerged as a formidable challenge to the integrity of democratic processes. A striking example of this phenomenon has been observed in the lead-up to a general election, where over 100 deepfake video advertisements impersonating Rishi
My Privacy Blog
The convergence of criminal penalties, civil remedies, and platform obligations creates a multi-layered enforcement environment where violations can trigger prosecution at both state and federal levels. Organizations should begin immediate preparation for the TAKE IT DOWN Act's 2026 platform requirements while ensuring compliance with existing state laws.
As AI technology continues advancing and regulatory approaches mature, we expect continued expansion of both scope and enforcement mechanisms. Proactive compliance, robust policies, and continuous monitoring of legislative developments will be essential for navigating this rapidly evolving landscape.
What are Deepfakes and how to protect yourself
1. Deepfakes are realistic fake videos created using deep learning, posing risks like misinformation and fraud. 2. Intel’s FakeCatcher is a real-time deepfake detection platform with 96% accuracy. 3. FakeCatcher uses authentic clues in real videos, like “blood flow,” to identify deepfakes instantly. 4. Real-time detection is crucial to mitigate
My Privacy Blog
This analysis is based on publicly available information as of September 2025 and should not be construed as legal advice. Organizations should consult with qualified attorneys for specific compliance guidance.
