On May 6, 2026, Utah's HB 276 — the Artificial Intelligence Modifications act, which creates the state's new Digital Voyeurism Prevention Act — took effect, requiring websites and social media platforms operating in the state to provide a public reporting mechanism for nonconsensual AI-generated intimate imagery and to remove flagged content within 48 hours. The law was signed by Governor Spencer Cox in late March 2026 as part of a six-bill AI legislative package, but the May 6 effective date makes it the first state-level deepfake takedown mandate to land in actual operation in 2026 — 13 days ahead of the federal TAKE IT DOWN Act's May 19 platform compliance deadline.

Why It Matters

Utah HB 276 is the first effective state-level deepfake-platform takedown law in 2026 and is the early-warning system for what the federal TAKE IT DOWN Act compliance will look like in practice. The law's metadata-provenance provision — requiring platforms to display the alteration history of an image — is the most ambitious technical mandate in any state's deepfake law and could become a template for other states. With Wyoming HB 102, Washington SB 5105, and the federal TAKE IT DOWN Act all coming online in the same six-week window (March 7–May 19), 2026 is the first year in which platform-side intimate-deepfake takedown obligations are simultaneously enforced at the federal and multiple state levels.

The bill, sponsored by Rep. Ariel Defay, was negotiated directly with major tech companies operating in Utah and includes three operational requirements that go further than the federal TAKE IT DOWN Act. First, platforms must remove not just the reported image but make "reasonable efforts to identify and remove any identical copy" — effectively requiring perceptual hash matching. Second, platforms must publish image-provenance metadata showing how content has been altered, an interesting regulatory nod toward C2PA-style content authenticity standards. Third, generation services (the upstream image-creation tools, not just the downstream platforms) are themselves prohibited from producing counterfeit intimate imagery without verified consent of the depicted person.

Notable safe harbors: platforms acting in good faith to comply with the takedown framework receive protection from frivolous lawsuits, and Utah's law specifically preempts only state-law claims, leaving federal Section 230 questions to the Take It Down Act. Enforcement is split between civil action (the Utah AG's office and depicted individuals) and a private cause of action for victims to sue both the generation service and the hosting platform.

For adult content platforms, AI companion platforms, image-generation services, and any social media operator with Utah users, the practical effect is that operational compliance must now include both a Utah-specific reporting URL (or compliance with the federal TAKE IT DOWN Act intake that satisfies it), 48-hour removal SLA, hash-matching for known copies, and metadata provenance disclosure. Platforms that have built compliance for the federal Act largely satisfy Utah's framework — but the metadata disclosure piece is unique and has no federal equivalent.

Sources

Update — 2026-05-08

Initial entry — story first created.