LexLint.ioBeta

Know the law your code answers to.

Law / United States / Utah

Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session)

Utah Code 45-2-3.5, 45-2-14, 45-3-2 to 45-3-7, as amended

In force since .

An AI prohibited practices rule binding public and private bodies.

Obligation class
Consent, Prohibition
Audit expectation
none
Setting the rule reaches
General

What it requires

  • Do not treat the use of generative AI, computer animation, or digital manipulation as a defense to a libel or slander claim
  • Give a person written notice before filing a defamation action over digitally created content; if you are the publisher and remove the content within 10 days of that notice, the plaintiff's recovery is limited to actual damagesno control in the NIST AI RMF
  • Get an individual's consent before distributing an AI-generated, computer-animated, or digitally manipulated replica of that individual's likeness or voiceNIST AI RMFMAP 3.3
  • Do not traffic in identity-replication tools without the depicted individual's consentNIST AI RMFMAP 3.3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
NIST AI 600-1
MIT mitigations Draft
  • 1.5Safety Decision Frameworks
  • 3.3Access Management
NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
  • 5.1.4-5End-users told which uses of the system are prohibited.

Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Section 45-3-3(2) refers to "the criminal penalty in Section 76-12-304" and Section 45-3-3(3) provides that nothing in the chapter prohibits prosecution of abuse of personal identity under that section.

Who enforces it

Enforcement body

The individual whose personal identity is abused or a right holder of that individual, by civil action under Section 45-3-4 or 45-3-5

Settledness

As of
Open questions
  • Does a tool "whose intended primary purpose is the unauthorized creation or modification of content that includes an individual's personal identity" in Section 45-3-3(2)(c) reach a general-purpose generative model that a user directs to replicate a person's likeness or voice?
  • Does "actual knowledge that the use was not authorized" in Section 45-3-3(2)(b) require a publisher to know of the lack of authorization for each use, or does notice of an earlier unauthorized use of the same personal identity suffice?

What it makes you log

Logging duty

The cited sections bar generative AI as a defense to defamation, add a pre-suit notice procedure, and extend the personal-identity consent right to an AI-generated replica. None of them requires anyone to create, keep, or produce a log or record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

SB 256 (2026 General Session), effective , enacts Utah Code 45-2-3.5 to provide that it is not a defense to a libel or slander claim that the communication was created through generative artificial intelligence, computer animation, digital manipulation, or another technological means, or that it uses simulated content rather than an actual recording.

A new Section 45-2-14 requires written notice to the publisher before filing such an action and limits recovery to actual damages if the publisher removes the content within 10 days of notice.

The bill also amends Title 45 Chapter 3, the Abuse of Personal Identity Act, so that every individual's exclusive right to consent to use of their personal identity includes a replication right reaching an AI-generated, computer-animated, or digitally manipulated simulation of their likeness or voice; a person whose identity is abused, including through unauthorized distribution of or trafficking in identity-replication tools, may sue for injunctive relief, damages, exemplary damages, and attorney fees. The chapter does not impose liability on an interactive computer service for content provided by another person.

When LexLint raises it

When your app profile says your app generates audio with AI, generates content with AI, generates images with AI, generates video with AI or processes biometric data.

Back to the example  ·  Lint your app

Page updated .