LexLint.ioBeta

Know the law your code answers to.

Law / United States / Virginia

HB 2678 (2019), Deepfakes in Nonconsensual Image Dissemination

Va. Code Ann. § 18.2-386.2

In force since .

An AI prohibited practices rule binding public and private bodies.

Obligation class
Prohibition
Audit expectation
none
Setting the rule reaches
General

What it requires

  • Do not maliciously disseminate or sell a videographic or still image, including one created, adapted, or modified to depict an identifiable actual person (a deepfake), showing that person nude, partially exposed, or in an image that is otherwise obscene, with intent to coerce, harass, or intimidate them.
  • This applies where you know or have reason to know you are not licensed or authorized to disseminate or sell the image.
  • An internet service provider, email service provider, or other access-software provider is not liable under this section for content supplied by another person.
  • A violation is a Class 1 misdemeanor.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
NIST AI 600-1
MIT mitigations Draft
  • 1.5Safety Decision Frameworks
  • 3.3Access Management
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
  • 5.1.4-5End-users told which uses of the system are prohibited.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Class 1 misdemeanor, punishable by confinement in jail for not more than 12 months and a fine of not more than $2,500, either or both.

What it makes you log

Logging duty

Section 18.2-386.2 criminalizes the malicious dissemination or sale of a nonconsensual nude or obscene image, including a deepfake built from an identifiable person's likeness. It states no duty for anyone to create, keep, or produce a record; the venue clause in subsection (C) governs which Virginia court hears a prosecution and does not itself grant any party access to a record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Any person who, with intent to coerce, harass, or intimidate, maliciously disseminates or sells a videographic or still image depicting another person nude, partially exposed, or (where not exposed) obscene, knowing or having reason to know they are not licensed or authorized to do so, is guilty of a Class 1 misdemeanor.

HB 2678 (2019), effective , expanded 'another person' to include someone whose image was used in creating, adapting, or modifying a videographic or still image to depict an actual, recognizable person, reaching a falsely created or digitally manipulated (deepfake) image on the same terms as an unaltered photograph.

An internet, email, or other access-software provider is not liable under this section for content supplied by another person, and venue lies where the unlawful act occurs or where the image is produced, found, stored, or possessed.

When LexLint raises it

When your app profile says your app generates images with AI, generates video with AI or publishes adult content.

Back to the example  ·  Lint your app

Page updated .