Generates video with AI, in Iowa

Iowa Code ch. 554G (554G.1 to 554G.4, added by 2023 Acts, ch. 63 (H.F. 553)) · Read the law's page

• This affirmative defense is available to a covered entity, a business, defined to include a financial institution and an entity organized under chapter 28E, that accesses, receives, stores, maintains, communicates, or processes personal information or restricted information in or through a system, network, or service located in or outside Iowa; a municipality is excluded from the definition of business, and the chapter creates no independent duty to adopt a cybersecurity program.
• To claim the defense against a tort claim alleging that a failure to implement reasonable information security controls resulted in a data breach of personal information or restricted information, create, maintain, and comply with a written cybersecurity program containing administrative, technical, operational, and physical safeguards, designed to continually evaluate and mitigate reasonably anticipated threats, evaluate the maximum probable loss from a data breach at least annually, and communicate to affected parties the extent of any risk and steps to reduce damages once a breach is known to have occurred.
• Fund the program at a scale and scope that is appropriate if the cost to operate it is no less than the covered entity's most recently calculated maximum probable loss value.
• Satisfy the framework requirement by reasonably conforming the program to a named industry-recognized cybersecurity framework (the NIST framework for improving critical infrastructure cybersecurity, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family), or, where already regulated under one, by conforming the program to the entirety of HIPAA's Security Rule, Gramm-Leach-Bliley Title V, the federal Information Security Modernization Act of 2014, HITECH, Iowa's own Insurance Data Security Act (chapter 507F), or applicable federal critical-infrastructure-protection rules, or by combining PCI Data Security Standard compliance with one of the named frameworks; conform the program to a revised framework or amended regulation within one year of its publication or effective date.
• This section creates no private right of action, including a class action, for a person's failure to comply with it: it is a defense available in litigation another statute or the common law already permits, never an independent basis to sue.

Iowa Code 708.7(1)(a)(5) · Read the law's page

• Do not disseminate, publish, distribute or post a visual depiction showing another person nude or engaged in a sex act without that person's consent, including a synthetic or deepfake image created, adapted or modified from their face, likeness or other distinguishing features.
• Exceptions cover voluntary exposure in public or commercial settings, disclosures made in the public interest, and disclosures by an interactive computer service under 47 U.S.C. 230.

Iowa Code 728.12(3) · Read the law's page

• Do not purchase, possess or knowingly promote a visual depiction created, adapted or modified to give the appearance that an identifiable minor is engaged in a prohibited sexual act, including an AI-generated or digitally manipulated depiction.
• The offense does not require proof of the actual identity of the depicted minor, and it binds any person, not only an AI developer or platform.

Iowa Code ch. 554J (2026 Iowa Acts, ch. 1068) · Read the law's page

• Disclose clearly and conspicuously to a minor account holder that they are interacting with artificial intelligence, using a persistent visible disclaimer or a disclaimer at the start of each interaction and at least once every three hours of continuous use.
• Disclose to any user that the service is artificial intelligence whenever a reasonable person interacting with it could otherwise believe they are talking to a human.
• Do not give a minor user points or similar rewards at unpredictable intervals meant to increase engagement.
• Take reasonable measures to prevent the service from producing sexual content involving a minor account holder, urging a minor toward sexual conduct, or sexually objectifying a minor account holder.
• Take reasonable measures to prevent the service from claiming to be sentient or human, or simulating a romantic, sexual, or emotionally dependent relationship with a minor account holder.
• Offer minor account holders, and the parents or guardians of minors under thirteen, tools to manage the minor's privacy and account settings.
• Adopt a protocol for responding to a user's expressions of suicidal ideation or self-harm, including referral to crisis services.
• Do not represent that the service provides licensed psychology or behavioral health services.