Utah Unauthorized AI Impersonation (SB 271)
Effective date
Penalty
Civil damages via private right of action. Injunctive relief, actual damages, attorneys' fees.
Obligations mapped
Tracked
Overview
Expands Utah's abuse of personal identity law to cover AI-generated deepfakes and digital replicas used for commercial purposes without consent. Prohibits distributing software primarily designed for unauthorized commercial impersonation. Covers AI-generated simulations of voice, video likeness, and audiovisual appearance. Not limited to deepfakes: it covers commercial misuse of personal identity including non-AI methods. First Amendment exemptions for newsworthiness, artistic expression, and parody. The software distribution prohibition targets nudification apps and similar tools.
This is an AI-specific state law.
See if this regulation applies to your company with the free exposure scan.
Who this applies to
This regulation applies to the following roles:
- Developers of covered AI systems
- Deployers and users of covered AI systems
- Organizations operating in Utah
This regulation applies to both companies that build AI products and companies that use AI tools from other vendors.
See enrolled statute text at the official source.
AI categories covered
- Consumer-facing AI
- General purpose AI
Specific AI use cases:
- Content generation
- synthetic media manipulation
- voice likeness synthesis
- political synthetic media
What this requires you to do
Detailed obligation packs are not yet mapped for this entry in XIRA. Obligation areas from the catalog are listed below.
What this requires you to do
Prohibited practices
Avoid conduct the statute bans, including harmful manipulation and intentional discrimination.
Consent required
Obtain consent. Get explicit permission from individuals before collecting or using their data with AI.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.
Enforcement and penalties
Civil damages via private right of action. Injunctive relief, actual damages, attorneys' fees.
Private right of action: plaintiffs may bring direct claims in addition to government enforcement.
Penalty amounts are based on statutory text and may be subject to adjustment, judicial interpretation, or enforcement discretion.
Legislative history
effective
Takes effect
signed
Signed by Governor Cox
Related regulations
- In EffectAI-Specific
Tennessee ELVIS Act (Ensuring Likeness, Voice, and Image Security)
First enacted US legislation specifically designed to protect musicians from unauthorized AI voice synthesis. Covers any individual's voice, image, or likeness. Uniquely targets tool providers (developers of synthesis tools), not just end users. Expands Tennessee's right of publicity to cover unauthorized synthetic replicas and includes a fair use exemption that specifically incorporates voice replicas.
Effective
- In EffectAI-Specific
California Digital Replicas of Deceased Performers Act (AB 1836)
Restricts commercial uses of realistic AI-generated replicas of deceased performers' voices or likenesses in audiovisual works and sound recordings without consent from the personality's estate or other rightsholder.
Effective
- In EffectAI-Specific
New York Deceased Performer Digital Replicas (SB 8391)
Amends the Right of Publicity law to protect digital replicas of deceased performers. Provides civil remedies for unauthorized AI-generated replicas of deceased individuals for commercial purposes.
Effective
- In EffectAI-Specific
Utah Artificial Intelligence Policy Act (SB 149)
SB 332 extended the act's sunset from May 7, 2025 to July 1, 2027. SB 226 NARROWED disclosure requirements (not added). General consumer transactions now require disclosure only upon clear and unambiguous request. Regulated occupations require proactive disclosure for high-risk artificial intelligence interactions involving sensitive data or significant decisions. Safe harbor: if the AI system itself clearly and conspicuously discloses at the outset and throughout the interaction that it is nonhuman or AI, the entity is not subject to enforcement action. See Utah AI Policy Act Amendments (SB 226) for the 2025 amendments.
Effective
- In EffectPrivacy ADM
Utah Consumer Privacy Act, Profiling Provisions (SB 227)
Utah's comprehensive privacy law. It is the least restrictive state privacy law regarding profiling and ADM among comparable statutes: it includes opt-out for targeted advertising and sale of personal data, but does not include a general profiling opt-out or ADM impact assessment requirement. No universal opt-out mechanism requirement. Trackers sometimes incorrectly list Utah as having ADM provisions similar to other states.
Effective
- In EffectAI-Specific
Utah AI Policy Act Amendments (SB 226 / SB 332)
SB 226 narrowed UAIPA disclosure: general consumer contexts require disclosure only on a clear and unambiguous request; regulated occupations still require proactive disclosure for high-risk artificial intelligence interactions (sensitive data and significant decisions). SB 332 extended the act's sunset from May 7, 2025 to July 1, 2027. Safe harbor unchanged: no enforcement if generative AI clearly and conspicuously discloses it is nonhuman at the outset and throughout the interaction. Applies together with the Utah Artificial Intelligence Policy Act (SB 149).
Effective
- In EffectAI-Specific
Utah AI Mental Health Chatbot Regulation (HB 452)
Regulates AI-powered mental health chatbots. Requires clear disclosure that the service is not a human clinician, limits certain advertising during therapeutic-style conversations, and restricts sharing identifiable health information. Specific disclosure timing: before user can access the chatbot, after 7 days without use, and whenever asked by the user. Health data restrictions: businesses cannot share or sell individually identifiable health information or user input with third parties, except as necessary for chatbot function or to health providers with user consent under HIPAA. Advertising restrictions: ads delivered through chatbot must be disclosed, and no user input can be used to decide whether to advertise or to customize ads. Affirmative defense requires actual policy filing with the Division of Consumer Protection, not only having a policy on file internally.
Effective
Utah AI regulation guide lists every tracked rule for this jurisdiction with timelines and obligation tallies.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.