Utah S.B. 271 (Unauthorized Artificial Intelligence Impersonation Amendments)

Summary

Defines key AI-relevant concepts and expands personal identity protections by establishing "generative artificial intelligence" as AI systems trained on data to simulate human conversation through text, audio, or visual communication, and “personal identity” to include both real and digitally altered likeness, including those created through AI.

Prohibits the unauthorized use or modification of an individual’s "personal identity" through generative AI or other means for commercial purposes without consent, and bans the distribution of tools designed to do so.

Permits an individual to bring legal action if their personal identity is abused in advertisements, with entitlements to injunctive relief, damages, and legal costs.

Exempts uses of personal identity for news, public affairs, sports broadcasts, entertainment works, or transformative creations from being considered abuse.

Expands Utah law to define "cause the publication" as preparing and submitting advertisements or content, including content that uses or simulates an individual’s identity.

Be it enacted by the Legislature of the state of Utah:

Section 1. Section 45-3-2 is amended to read:

45-3-2. Definitions.

As used in this act:

(1) "Advertisement" means a notice designed to attract public attention or patronage and includes a list of supporters for a particular cause.

(2) "Cause the publication" means:

(a) that a person:

(i) prepares or requests another to prepare:

(A) an advertisement of the type described in Subsection 45-3-3(1); or

(B) content that uses, simulates, or recreates an individual's personal identity; and

(ii) submits or requests another to submit the advertisement or content for publication; and

(b) the advertisement or content has been published.

Defines "consent" as voluntary agreement and prohibits inferring consent from inaction regarding personal identity usage.

(3)(a) "Consent" means an individual's voluntary agreement to the use of that individual's personal identity.

(b) "Consent" may not be inferred by the failure of the individual to request that the individual's personal identity not be used or that the individual's name be removed from a mailing or supporter list.

(4) "Content" means audio, video, image, text, or other media, regardless of format.

Defines "generative artificial intelligence" as a system simulating human conversation to produce non-scripted outputs with minimal oversight.

(5) "Generative artificial intelligence" means an artificial intelligence technology system that:

(a) is trained on data;

(b) is designed to simulate human conversation with a consumer through one or more of the following:

(i) text;

(ii) audio; or

(iii) visual communication; and

(c) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight.

(6) "Individual" means a natural person.

(7) "Person" means any natural person, firm, partnership, association, corporation, joint venture, or any other form of business organization or arrangement, and the agents or representatives of such persons.

Defines "personal identity" to include an individual’s identifying characteristics and any AI-generated simulations, reproductions, or recreations of those traits.

(8)(a) "Personal identity" means an individual's:

(i) name;

(ii) title;

(iii) picture;

(iv) portrait;

(v) video likeness;

(vi) voice; or

(vii) audiovisual appearance.

(b) "Personal identity" includes any simulation, reproduction, or artificial recreation of the content described in Subsection (8)(a), whether created through:

(i) generative artificial intelligence;

(ii) computer animation;

(iii) digital manipulation; or

(iv) any other technological means.

(9) "Publish" means that a person provides the instrumentality through which an advertisement or content is communicated to the public at large or to a significant portion thereof.

(10) "Voice" means a computer-generated sound in a medium that is readily identifiable and attributable to a particular individual, regardless of whether the sound contains the actual voice of the individual.

Expands definitions of personal identity abuse to include unauthorized AI-generated content for commercial purposes in a way that implies consent, and prohibits distributing tools designed to create such unauthorized content.

Section 2. Section 45-3-3 is amended to read:

45-3-3. Acts constituting abuse -- Permitting prosecution.

(1) Except for purposes of the criminal penalty in Section 76-9-407, the personal identity of an individual is abused if:

(a)(i) content containing the personal identity of an individual is used for purposes of:

(A) advertising products, merchandise, goods, or services;

(B) fundraising;

(C) solicitation of donations; or

(D) purchases of products, merchandise, goods, or services;

(ii) the use:

(A) expresses or implies that the individual approves, endorses, has endorsed, or will endorse the specific subject matter;

(B) creates a likelihood of confusion as to the participation, association, or connection of the individual; or

(C) creates a false impression that the individual participated in or approved the use; and

(iii) consent has not been obtained from the individual.

(b) the person knowingly distributes, sells, or licenses any technology, software, or tool whose intended primary purpose is the unauthorized creation or modification of content that includes an individual's personal identity for commercial purposes.

Allows use of personal data for advertising if obtained lawfully or if it does not imply endorsement by the individual.

(2) Nothing in this part prohibits prosecution of abuse of personal identity under Section 76-9-407.

(3) The personal identity of an individual is not abused if the individual's personal data or publicly available information:

(a) was lawfully obtained;

(b) is used to preview, advertise, or promote the sale of a product, service, or subscription, including the sale of a product, service, or subscription of which the individual's personal data or publicly available information is or may be a part; and

(c) is not used in a way that expresses or implies that the individual approves, endorses, has endorsed, or will endorse the product, service, or subscription being previewed, advertised, or promoted.

Allows individuals to seek relief for personal identity abuse, including injunctions, damages, and attorney's fees.

Section 3. Section 45-3-4 is amended to read:

45-3-4. Cause of action for abuse -- Remedies.

An individual whose personal identity has been abused under Section 45-3-3 of this act may bring an action against a person who caused the publication of the advertisement or content, and is entitled to injunctive relief, damages alleged and proved, exemplary damages, and reasonable attorney's fees and costs.

Allows individuals to sue publishers for personal identity abuse if no consent verification occurs, with remedies including injunctions and damages.

Section 4. Section 45-3-5 is amended to read:

45-3-5. Action against publisher -- Grounds -- Remedies.

(1) An individual whose personal identity has been abused under Section 45-3-3 of this act may bring an action against a person who published the advertisement or content:

(a) if the advertisement or content, on its face is such that a reasonable person would conclude that it is unlikely that an individual would consent to such use; and

(b) the publisher did not take reasonable steps to assure that consent was obtained.

(2) In an action under this section, the plaintiff shall be entitled to injunctive relief, damages alleged and proved, exemplary damages, and reasonable attorney's fees and costs.

Exempts certain uses of personal identity from liability, including news, entertainment, and artistic or political contexts.

Section 5. Section 45-3-7 is enacted to read:

45-3-7. Exemptions.

(1) A person does not violate Section 45-3-3 or Section 45-3-4 if the person uses an individual's personal identity in:

(a) connection with a news, public affairs, or sports broadcast, including the promotion of and advertising for a sports broadcast, an account of public interest, or a political campaign;

(b) a play, book, magazine, newspaper, musical composition, visual work, work of art, audiovisual work, radio or television program if it is fictional or nonfictional entertainment, or a dramatic, literary, or musical work;

(c) a work of political, public interest, or newsworthy value, including a comment, criticism, parody, satire, or a transformative creation of a work of authorship; or

(d) an advertisement or commercial announcement for a work described in this Subsection (1).

(2) The use of personal identity in a commercial medium does not constitute a use for purposes of advertising or solicitation solely because the material containing such use is commercially sponsored or contains paid advertising.

(3) This part may not apply to, and nothing in this part may be construed to impose liability or culpability on, an interactive computer service, as defined in 47 U.S.C. 230(f)(2), for content provided by another person.

Section 6. Effective Date.

This bill takes effect on May 7, 2025.