Law / United States / 
Maryland
SB 360 / Ch. 219 (2025), AI-Generated Deepfakes in Nonconsensual Intimate Imagery
Md. Code Ann., Crim. Law §3-809
In force since .
An AI prohibited practices rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Do not knowingly distribute a visual representation, including a computer-generated image indistinguishable from the depicted person, that shows another identifiable person with intimate parts exposed or engaged in sexual activity, with intent to harm, harass, intimidate, threaten, or coerce that person.
- Do not distribute such an image knowing, or with reckless disregard for whether, the depicted person did not consent, where that person had a reasonable expectation the image would remain private.
- A violation is a misdemeanor, and the depicted person may also bring a civil action for defamation per se or invasion of privacy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Misdemeanor, punishable on conviction by imprisonment not exceeding 2 years or a fine not exceeding $5,000, or both.
Penalty structure
The misdemeanor's maximum fine; imprisonment not exceeding 2 years may be imposed instead of or together with the fine.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 5,000
Who enforces it
Enforcement body
A person whose visual representation was distributed, through a civil action under Crim. Law § 3-809(f), and the State, through prosecution of the misdemeanor in § 3-809(d).
Settledness
- As of
- Open questions
- Does the test of an image indistinguishable from the person, from the perspective of an ordinary person, in Crim. Law § 3-809(a)(6)(i)2 limit the computer-generated images that § 3-809(a)(6)(ii) includes in a visual representation?
What it makes you log
Logging duty
Section 3-809 defines the prohibited image and states the elements of the distribution offense, and it imposes no duty on anyone to log, record, or otherwise document a distribution. Its only reference to a record is a court's own case file, which the section keeps from public inspection rather than requiring anyone to create.
- Kind
- None
- As of
What this law does
Maryland's nonconsensual intimate imagery statute defines a prohibited visual representation to include a computer-generated image that is indistinguishable from the depicted person, reaching an AI-generated deepfake on the same terms as an unaltered photograph.
A person may not knowingly distribute such an image showing another identifiable person with intimate parts exposed or engaged in sexual activity, with intent to harm, harass, intimidate, threaten, or coerce, or with knowledge or reckless disregard that the person did not consent, where that person had a reasonable expectation the image would remain private. Violation is a misdemeanor, and the depicted person also has a civil cause of action for defamation per se or invasion of privacy.
When LexLint raises it
When your app profile says your app generates images with AI, generates video with AI or publishes adult content.
Back to the example · Lint your app
Page updated .