Law / United States / 
Utah
Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b
An AI prohibited practices rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Do not distribute a counterfeit intimate image of an identifiable individual without first obtaining that individual's affirmative consent, if you operate a generation serviceNIST AI RMFMAP 3.3
- Verify the identity of the person giving consent and keep a record of the consent for at least seven yearsNIST AI RMFMAP 1.6
- Give users a clear way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, if you operate a covered platformNIST AI RMFMEASURE 3.3NIST AI RMFMANAGE 4.1
- This chapter takes effect , so it is a duty to prepare for rather than one owed today
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P8Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent withdrawal, data alteration or deletion) to address impacts of problematic data actions.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Enforcement body
Injured individuals or their heirs, by civil action against a generation service under Section 13-72b-202
Settledness
- As of
- Open questions
- What conduct is a generation service "holding itself out as providing services for creating counterfeit intimate images" under Section 13-72b-203(1)(a), and does a general-purpose image generator that a user prompts to make one qualify?
- What level of "reasonable safeguards designed to prevent the creation of counterfeit intimate images" under Section 13-72b-203(1)(b)(ii) is enough for the safe harbor?
What it makes you log
Who may demand the log
Court
What the log must hold
Consent or opt-out state, Affected person reference
Log retention
The floor runs from when the consent is obtained; the act names no maximum and no purpose-based cap.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 7
Logging duty
To obtain the consent that clears a generation service to distribute a counterfeit intimate image, the service must implement and maintain a consent system that assures the depicted individual's identity and maintains a record of the consent for at least seven years. No provision names a route into this record other than the court's own review of the safe harbor defense in a civil action, and that review happens only once a suit is filed, so it is not a standing audit expectation.
- Kind
- Explicit
- As of
- Provision
- 13-72b-201(3)
- Trigger
- consent_or_optout
What this law does
HB 276 (2026 General Session) creates new Chapter 72b, the Digital Voyeurism Prevention Act, effective . A generation service, a person operating an interactive computer service that lets users generate intimate images using artificial intelligence technology, may not distribute a counterfeit intimate image of an identifiable individual without first obtaining that individual's affirmative, identity-verified consent, and must keep a record of the consent for at least seven years.
An injured individual may bring a civil action for an injunction, actual and punitive damages, and attorney fees, without needing to plead or prove actual damages. A generation service that maintains and follows a qualifying consent system and written policy, and responds promptly once it learns of a violation, has a safe harbor from that civil liability.
A covered platform must give users a way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, and a platform that follows those notice-and-takedown procedures in good faith is not liable for anything posted before it received notice.
When LexLint raises it
When your app profile says your app generates images with AI, generates video with AI, publishes adult content or operates a social platform.
Back to the example · Lint your app
Page updated .