Deepfake Laws in 2026: What's Actually Illegal Now

Sexually explicit deepfakes — AI-generated images or video depicting a real, identifiable person in a sexual context they never actually participated in — moved from a legal gray area to explicitly criminalized federal conduct within the span of about a year, following a bill that passed Congress with unusually broad bipartisan support and was signed into law in May 2025.

What the TAKE IT DOWN Act Actually Criminalizes

The TAKE IT DOWN Act, formally S. 146 of the 119th Congress, amends Section 223 of the Communications Act of 1934 to add new federal criminal prohibitions covering the publication of non-consensual intimate images. Critically, the law's language covers both authentic images shared without consent and "digital forgeries" — its statutory term for AI-generated or otherwise digitally fabricated intimate depictions — meaning the law makes no distinction, for purposes of criminal liability, between a real photo shared without permission and a fully AI-generated image that never depicted an actual event. Both are treated the same way under the statute.

The criminal penalties are meaningfully serious: knowingly publishing or even threatening to publish non-consensual intimate imagery through an interactive computer service carries up to two years' imprisonment when the victim is an adult, rising to up to three years when the victim is a minor. The criminal prohibition took effect immediately upon the bill's signing.

The Platform Takedown Requirement

Beyond criminalizing the underlying conduct, the law imposes a separate, distinct obligation on what it calls "covered platforms" — a category generally covering websites and apps that host user-generated content at meaningful scale. These platforms are required to establish a notice-and-removal process allowing a depicted individual to request that non-consensual intimate imagery of themselves be taken down, and once a valid request is received, the platform must remove the content within 48 hours or face regulatory penalties enforced by the FTC. Platforms were given roughly one year from the law's signing to stand up this required process, with the compliance deadline landing on May 19, 2026.

This two-part structure — criminal liability for the person who creates or publishes the image, plus a separate civil/regulatory compliance obligation on the platform hosting it — mirrors, in a narrower and more specific form, the general pattern of internet content regulation: individual conduct is addressed through criminal law, while platform responsibility is addressed through a distinct regulatory requirement rather than by making the platform itself criminally liable for user-uploaded content.

Where State Law Fills In the Gaps

Federal law addresses the specific case of non-consensual intimate imagery, but the broader category of "deepfakes" covers considerably more ground — political disinformation, fraud, impersonation in non-sexual contexts — much of which is regulated, if at all, at the state rather than federal level. State-level deepfake legislation has expanded rapidly: by 2026, every state except Ohio and New Mexico has enacted some law specifically addressing sexually explicit deepfakes, a jump from 46 states to 48 within a single year, reflecting just how quickly state legislatures have moved on this specific issue even as broader deepfake regulation covering other contexts remains more uneven and further behind.

The Minnesota Law That Targets the Tool, Not Just the User

The most structurally distinctive state law in this space is Minnesota's, which took the additional step of making AI platform operators themselves potentially liable — not just the individual user who generates and shares a non-consensual deepfake, but the company whose software was used to generate it in the first place, under specified conditions. This is a meaningfully different regulatory approach than targeting only the end user: it places some of the compliance burden and legal risk on the companies building and distributing the underlying generation tools, an approach other states may look to as a template, or may deliberately avoid, depending on how courts and affected companies respond to it as the law is actually applied and tested.

What Still Falls Outside Current Law

Even with this rapid legislative expansion, real gaps remain. Political deepfakes — fabricated video or audio of a candidate or public figure making statements they never made — are regulated far less consistently across states than sexual deepfakes are, and no comparable federal criminal law exists for political or non-sexual deceptive deepfakes the way the TAKE IT DOWN Act now exists for intimate imagery specifically. Enforcement in practice also depends heavily on identifying who actually created and published a given deepfake, which can be genuinely difficult when the content spreads across platforms, jurisdictions, and anonymous accounts faster than any single takedown request or investigation can track it — meaning the existence of a clear legal prohibition, while a real and meaningful development, doesn't by itself solve the practical enforcement challenge that made this such a persistent problem in the first place.