Law / United States / 
Vermont
Disclosure of sexually explicit images without consent, digitized and computer-generated images
In force since .
An AI prohibited practices rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Do not knowingly disclose a nude or sexually explicit visual image of an identifiable person, without that person's consent, with intent to harm, harass, or intimidate them, where the disclosure would cause a reasonable person to suffer harm.
- This reaches an image created or realistically altered by digitization, including one built from an image of a person other than the one depicted, or a wholly computer-generated image.
- Consent to the recording or production of an image does not by itself constitute consent to disclose it.
- Disclosure made with intent to profit financially draws a higher penalty tier.
- An operator of a website, online service, or application may not accept a fee or other consideration to remove, delete, or refrain from posting such an image when the depicted person requests it.
- A person harmed by a violation may bring a private civil action for damages and injunctive relief.
These lines are LexLint's reading of the law's text. Also read by: State v. VanBuren, 2018 VT 95, 210 Vt. 293, 214 A.3d 791 (recorded ).
In the frameworks
- NIST AI RMF
- MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A violation is punishable by up to two years' imprisonment or a $2,000.00 fine, or both; a violation committed with intent to profit financially is punishable by up to five years' imprisonment or a $10,000.00 fine, or both.
Penalty structure
Base violation: up to two years' imprisonment or a $2,000.00 fine, or both. Disclosure with intent to profit financially: up to five years' imprisonment or a $10,000.00 fine, or both.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Depicted persons, by private civil action under subsection (e); a violation of subsection (b) is a crime
Settledness
- As of
- Case citation
- State v. VanBuren, 2018 VT 95, 210 Vt. 293, 214 A.3d 791
- Open questions
- Does an image "created or altered by digitization" that uses "images other than the person depicted" count as a "visual image of an identifiable person who is nude" under Section 2606(b)(1) when the nude body shown is not the depicted person's?
- Does "the disclosure would cause a reasonable person to suffer harm" in Section 2606(b)(1) require proof that the depicted person actually suffered "harm" as Section 2606(a)(2) defines it?
What it makes you log
Logging duty
Section 2606 criminalizes and creates a private cause of action for disclosing a nonconsensual sexually explicit image, including one built by digitization, and separately bars a website or app operator from accepting payment to remove such an image on request. It states no duty for anyone to create, keep, or produce a record; enforcement runs through criminal prosecution and a civil action by the person depicted.
- Kind
- None
- As of
What this law does
Section 2606 makes it a crime to knowingly disclose a visual image of an identifiable person who is nude or engaged in sexual conduct, without that person's consent, with intent to harm, harass, or intimidate them, where the disclosure would cause a reasonable person to suffer harm; a second, higher tier applies where the disclosure is made with intent to profit financially.
"Visual image" expressly includes an image created or altered by digitization, and "digitization" is defined as altering an image in a realistic manner using an image or images of a person, including images of a person other than the one depicted, or computer-generated images, so the statute reaches a realistic nonconsensual sexual deepfake of an identifiable person and not only an authentic recording.
Consent to the recording of an image does not by itself constitute consent to disclose it, and a website or app operator may not accept payment to remove or refrain from posting such an image on the depicted person's request.
The section carries statutory exceptions for voluntary public or commercial nudity, disclosures in the public interest (including reporting unlawful conduct), matters of public concern, and a Communications Decency Act section 230 style carve-out for interactive computer services hosting another person's content.
The section was added in 2015 (Act No. 62), amended by 2023 Act No. 161 (adjourned session), section 45, effective , and amended again by 2025 Act No. 89 (adjourned session), section 2, effective ; whether the digitization definition specifically originated in the 2015 enactment or was introduced by the 2023 amendment is not confirmed against the uncodified session laws, so the 2023 amendment's effective date is used here as the date the digitization provisions bind.
When LexLint raises it
When your app profile says your app generates images with AI, generates video with AI or publishes adult content.
Back to the example · Lint your app
Page updated .