Tennessee

Adds a new section to Title 39, Chapter 17, Part 10 (Sexual Offenses) making it an offense for a person to knowingly possess, distribute, or produce technology, software, or digital tools designed for the purpose of creating material that includes a minor engaged in sexual activity or simulated sexual activity that is patently offensive, reaching an AI image-generation tool purpose-built for that use.

Possession is a Class E felony, distribution a Class C felony, and production a Class B felony; a court weighs factors including the defendant's own statements, advertising, and instructional materials in deciding whether a tool was so designed. The enacting Public Chapter leaves the new provision's codified section number to be assigned by the Tennessee Code Commission.

Amends the Personal Rights Protection Act of 1984, renamed the Ensuring Likeness, Voice, and Image Security Act, to add voice to the property right an individual holds in their name, photograph, and likeness, defining voice as a sound readily identifiable and attributable to a particular individual whether or not the sound is the person's actual voice or a simulation of it.

A person who publishes, performs, distributes, or transmits an individual's voice or likeness knowing it was not authorized is liable to a civil action, and the same liability reaches a person who distributes, transmits, or otherwise makes available an algorithm, software, tool, or other technology, service, or device whose primary purpose or function is producing a particular identifiable individual's photograph, voice, or likeness, knowing that distributing it was not authorized.

Creates a new part of the criminal code defining an intimate digital depiction as one appearing to show nudity or sexual content and created or altered through digital manipulation, and a deepfake as a video, image, or audio file generated or manipulated by artificial intelligence to realistically portray something that did not occur.

A person who intentionally discloses, or threatens to disclose, an intimate digital depiction of an identifiable individual without consent, knowing or recklessly disregarding that consent was absent, is liable to a civil action and, where the disclosure is intended to harass or cause harm, commits a Class E felony, rising to a Class C felony where the disclosure could reasonably be expected to affect a governmental proceeding, including an election, or facilitate violence.

A provider of an interactive computer service is not liable for content supplied by another person or for good-faith restriction of access to such depictions.

TIPA governs private-sector processing of Tennessee residents' personal information, enacted as House Bill 1181, Public Chapter 408 of the 113th General Assembly. The bill passed the House April 21, 2023 and was approved by the Governor in May 2023; a floor amendment moved the general effective date from an engrossed print's July 1, 2024 to the signed Public Chapter's July 1, 2025, which the Secretary of State's official publication confirms as authoritative.

A separate data protection impact assessment look-back date, July 1, 2024, is unaffected by the general effective-date correction.

Tennessee consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling. A controller must respond without undue delay and in all cases within 45 days of receipt, extendable once by 45 additional days when reasonably necessary; a denial must be communicated within 45 days, and an appeal decision must issue within 60 days of receipt.

TIPA is enforced exclusively by the Tennessee Attorney General and Reporter, who must provide a controller or processor 60 days' written notice identifying the specific violated provisions before suing; this cure notice is mandatory, not discretionary, and the text carries no sunset clause anywhere, unlike Maryland's and Minnesota's expiring cure mechanisms. A court may award relief to each affected consumer regardless of actual damages, and treble damages for a willful or knowing violation.

TIPA's own compliance-program provision requires a written privacy program reasonably conforming to the NIST privacy framework, and grants an affirmative defense to liability for a controller or processor that creates, maintains, and complies with such a program, a structural feature no other state ties to liability this directly. TIPA bars any private right of action, including a class action, under TIPA or other law.

TIPA classifies information revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; the processing of genetic or biometric data to uniquely identify a natural person; a known child's personal information; and precise geolocation data as sensitive data.

"Biometric data" is defined as data generated by automatic measurement of biological characteristics used to identify a specific individual, but categorically and unconditionally excludes a physical or digital photograph, video recording, or audio recording, or data generated from one, with no claw-back for an identification purpose.

This is the single most consequential difference from Maryland, Minnesota, and New Jersey in this same wave: a faceprint or voiceprint a product derives from a recording specifically to identify a person is never "biometric data" in Tennessee, and therefore never triggers TIPA's sensitive-data consent duty on that basis alone. No dedicated Tennessee biometric-privacy statute beyond TIPA's sensitive-data treatment was found.

The Tennessee Personal and Commercial Computer Act of 2003 makes it an offense to intentionally and without authorization access a computer, computer system, or network.

Critically, the statute states that operating a computer network in such a way as to allow anonymous access to that network constitutes implicit consent to access under this part, a materially more scraping-favorable statutory answer than the Computer Fraud and Abuse Act (CFAA)'s contested authorization standard: a public, unauthenticated website that does not gate access is, by the statute's own terms, one the operator has impliedly consented to anonymous access to.

The Act's other codified sections (39-14-601, 603 to 606, covering definitions, other offenses, and remedies) are not described here. No Tennessee appellate decision applies this clause to a scraping or automated-collection fact pattern specifically, so treat the favorable reading as the statute's plain text rather than a litigated holding. No Tennessee-specific statute or case addresses ToS enforceability; ordinary contract law governs.

Requires an individual or commercial entity that publishes or distributes a website on which one third or more of total content is content harmful to minors to perform reasonable age verification before granting access, and to re-verify after each age-verified session of at most 60 minutes. Verifiers must retain seven years of anonymized age verification data and may not retain personally identifying information. A violation is a Class C felony.

Requires social media companies to verify the age of prospective Tennessee account holders, obtain express parental consent before a minor under 18 can create or keep an account, let a parent revoke that consent, and provide parents supervisory tools including privacy settings visibility, daily time restrictions, and mandatory breaks.