Generates images with AI, in Texas

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.

Tex. Bus. & Com. Code §§ 120.101, 120.1001, 120.102, 120.1015, 120.1025, 120.152 · Read the law's page

• If you operate a social media platform, provide an easily accessible complaint system letting a user report explicit deep fake material, alongside illegal content and content-removal decisions.
• Give clear, conspicuous, plain-language notice of that complaint system and how to use it.
• On receiving a report of explicit deep fake material, immediately confirm to the user that you are aware of it, remove the reported content and any identical known copies, and provide the user a written status update within seven days.
• If you determine reported content is explicit deep fake material, take measures to keep the same material from being posted again.
• Failing these duties is a deceptive trade practice, actionable under the Deceptive Trade Practices-Consumer Protection Act.

Tex. Civ. Prac. & Rem. Code §§ 98B.0021-98B.009 · Read the law's page

• A person depicted in artificial intimate visual material, produced or disclosed without their consent and with intent to harm them, can sue the creator, solicitor, discloser, or promoter for damages if the material reveals their identity.
• If you own a website, application, or social media platform and recklessly facilitate production or disclosure of such material for payment, or you own a publicly accessible nudification application (an AI application primarily designed and marketed to produce this material), you are liable for damages to the depicted person.
• If you own a website, application, or social media platform on which such material is disclosed, you are liable for damages if the depicted person requests removal and you fail to remove it, and known identical copies, within 72 hours.
• You must provide an easily accessible system for a depicted person to request removal, and a clear, plain-language notice describing that process and your responsibilities under it.
• Failing the removal, system, or notice duties is a deceptive trade practice, giving the Attorney General and a private claimant a cause of action under the Deceptive Trade Practices-Consumer Protection Act.
• A depicted person has 10 years from discovering the material, or from turning 18, whichever is later, to bring a claim.

Tex. Penal Code § 21.165 · Read the law's page

• Do not knowingly produce or distribute by electronic means deep fake media that, without the depicted person's effective consent, appears to show them with computer-generated intimate parts or engaging in sexual conduct they did not engage in; doing so is a Class A misdemeanor, elevated to a third-degree felony if you have a prior conviction under this section or the person depicted is younger than 18.
• Do not threaten to produce or distribute such deep fake media to coerce, extort, harass, or intimidate someone; doing so is a Class B misdemeanor, elevated to a Class A misdemeanor under the same two aggravators.
• A disclaimer that the media is unauthorized or not authentic is not a defense.
• A general-purpose AI application or software provider has an affirmative defense only if its terms prohibit creating this content and it takes active technical steps against it, such as training the system to identify such media, providing reporting tools, and filtering it from outputs and training data.

Tex. Penal Code § 43.235 · Read the law's page

• Do not knowingly possess, access with intent to view, or promote obscene visual material that appears to depict a child younger than 18 engaging in sexual conduct, whether the depiction is of an actual child, a cartoon or animation, or an AI-generated image.
• Do not use an image of an actual child to train an AI model to produce material that constitutes child pornography.
• Either offense is a state jail felony at minimum, rising to a third-degree felony on one prior conviction under this section or the related child-pornography sections, and a second-degree felony on two or more.

Tex. Bus. & Com. Code §§ 552.052, 552.055-552.057 · Read the law's page

• Do not develop or deploy an AI system that intentionally aims to incite or encourage physical self-harm, harm to another person, or criminal activity.
• Do not develop or deploy an AI system with the sole intent of infringing, restricting, or impairing a constitutional right.
• Do not develop or deploy an AI system with intent to unlawfully discriminate against a protected class; a disparate impact alone is not enough to show that intent.
• Do not develop or distribute an AI system with the sole intent of producing or distributing AI-generated child pornography or deepfake sexually explicit media, or that engages in text-based sexual conversation while impersonating a child younger than 18.
• The Attorney General has exclusive enforcement authority and must give 60 days' notice and a chance to cure before suing; there is no private right of action.
• Civil penalties run from $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day of a continuing violation.

Tex. Bus. & Com. Code §§ 552.101-552.106 · Read the law's page

• If the Attorney General notifies you in writing of a violation, cure it within 60 days of the notice and give the Attorney General a written statement that you have cured the violation, supporting documentation showing the manner in which you cured it, and a statement that you have made any necessary changes to internal policies to reasonably prevent further violation (s. 552.104(b)).
• Respond to a civil investigative demand from the Attorney General, which may ask for a high-level description of your system's purpose, intended use, deployment context and benefits, the type of data used to program or train it, the categories of input data, its outputs, performance metrics, known limitations, and post-deployment monitoring and user safeguards (s. 552.103).
• To rely on the defense that you found the violation yourself, discover it through feedback from a developer, deployer or other person who believes a violation has occurred, through testing including adversarial or red-team testing, through following guidelines set by applicable state agencies, or through an internal review process while you substantially comply with the most recent version of the National Institute of Standards and Technology's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile or another nationally or internationally recognized AI risk management framework (s. 552.105(e)(2)).
• You may not be found liable where another person uses your AI system in a manner the chapter prohibits (s. 552.105(e)(1)).