Deepfake & AI Voice Cloning Laws by State (2026)

Deepfake laws vary widely across the United States. As of 2026, at least 45 states have enacted some form of law covering sexual deepfakes, election deepfakes, or AI voice cloning, with the federal TAKE IT DOWN Act (signed May 19, 2025) providing a national baseline for nonconsensual intimate deepfakes. This guide covers all three legal buckets for every state and DC.

What Is a Deepfake, and What Laws Apply?

A deepfake is media (video, audio, or still images) in which artificial intelligence replaces or synthesizes a real person's face, voice, or likeness to make them appear to say or do something they never did. The term comes from the deep learning techniques used to train these models.

Three distinct bodies of law now govern deepfakes, and states have moved at different speeds on each.

Bucket 1: Sexual deepfakes (NCII) and AI-generated child sexual abuse material. Nonconsensual intimate image (NCII) laws, sometimes called revenge-porn statutes, were originally written for real photographs and videos. Most states have now amended them to cover AI-generated synthetic content. AI-generated CSAM (depictions of minors that were never filmed) is separately covered by federal law (18 U.S.C. 2256) and by most state CSAM statutes.

Bucket 2: Election and political deepfakes. At least 28 states require disclosure or prohibit distribution of deepfake political content near elections. These laws face recurring First Amendment challenges; courts must weigh election integrity against the right to create satirical or parody content.

Bucket 3: AI voice cloning and digital likeness (right of publicity). A growing number of states have extended their right-of-publicity laws to cover AI-generated replicas of a person's voice or visual likeness used for commercial or harmful purposes. Tennessee's ELVIS Act is the most-cited model.

Many situations touch more than one bucket. An AI-generated deepfake of a candidate used in a political ad raises both election-law and likeness-rights issues. A voice clone used to commit fraud may trigger TCPA rules, state identity-theft statutes, and the FTC's impersonation rule simultaneously.

Federal Deepfake Law

TAKE IT DOWN Act: Enacted

The most significant federal development is the TAKE IT DOWN Act, signed into law on May 19, 2025 (Public Law 119-12). It is the first federal law specifically targeting nonconsensual intimate deepfakes.

The Act makes it a federal crime to knowingly publish nonconsensual intimate visual depictions of adults or minors, expressly including AI-generated "digital forgeries." Penalties reach two years in prison for adult victims and three years when minors are depicted. Critically, platforms must remove flagged content within 48 hours of receiving notice from a victim; the compliance deadline for that takedown infrastructure was May 19, 2026. The FTC enforces platform compliance.

The TAKE IT DOWN Act matters most in the nine states (including Missouri and New Mexico) that still lack adult NCII deepfake laws of their own. For those victims, the federal law is now the primary avenue for platform removal and criminal referral.

FCC AI Robocall Ruling: Enacted

In February 2024, the FCC issued Order 24-17 declaring that AI-generated voices in robocalls constitute "artificial" voices under the Telephone Consumer Protection Act (47 U.S.C. 227). This means voice-clone robocalls to any phone without prior express written consent are illegal nationwide. The ruling was triggered directly by the January 2024 fake-Biden robocall sent to New Hampshire voters ahead of the primary, a call the FCC later issued a $6 million fine for (finalized September 2024).

Federal CSAM Law: Enacted

Under 18 U.S.C. 2256(8)(B) (as amended by the PROTECT Act of 2003), federal law covers computer-generated or AI-generated images that are indistinguishable from real minors engaged in sexually explicit conduct. There is no First Amendment defense for indistinguishable material under the post-Ashcroft v. Free Speech Coalition framework. This applies even in states that have not explicitly amended their own CSAM statutes.

FTC Impersonation Rule: Enacted for Businesses

The FTC's Rule on Impersonation of Government and Businesses (16 C.F.R. Part 461, effective April 1, 2024) prohibits deceptive impersonation of government entities and businesses using AI voice cloning. The extension of the rule to individual impersonation remains a proposed rulemaking (NPRM) and is not yet final.

DEFIANCE Act and NO FAKES Act: Pending, Not Law

Two significant federal bills have been introduced but are not enacted as of June 2026:

The DEFIANCE Act (S.1837 / H.R.3562, 119th Congress) would create a federal civil cause of action for victims of sexual deepfakes with liquidated damages of $150,000 (rising to $250,000 if the conduct involved actual or attempted sexual assault, stalking, or harassment). An earlier version passed the Senate in July 2024 but died in the House before the end of the 118th Congress; the reintroduced S.1837 passed the Senate again by unanimous consent on January 13, 2026 and is now pending in the House. See our DEFIANCE Act explainer for current status.

The NO FAKES Act (S.1367 / H.R.2794, 119th Congress) would create a federal right of publicity against unauthorized AI digital replicas of a person's voice or visual likeness. It has not passed either chamber.

Deepfake Laws by State

The table below shows the enacted status of each of the three legal buckets for all 50 states and DC. Each state name links to the full state guide. "Yes" means an enacted law exists. "No" means no state law; federal law may still apply.

AI Voice Cloning Laws

The ELVIS Act: The National Model

Tennessee's Ensuring Likeness Voice and Image Security Act (the ELVIS Act, Tenn. Code Ann. 47-25-1101 et seq., effective July 1, 2024) was the first state law to extend a right of publicity specifically to AI simulations of a person's voice. "Voice" is defined as a "readily identifiable sound" whether it is the person's actual voice or a simulation of it. The law reaches not just users of unauthorized voice replicas but also anyone who knowingly distributes a tool whose "primary purpose or primary effect" is to produce such unauthorized replicas.

Enforcement is civil and criminal: victims may seek injunctions, impoundment, actual damages plus profits, and attorney fees under Tenn. Code Ann. 47-25-1105. A Class A misdemeanor criminal penalty applies under 47-25-1108. Postmortem rights extend 10 years after death.

At least seven states have enacted comparable protections since 2024. Montana (HB 513, effective January 1, 2026) created property rights over name, voice, and visual likeness with damages up to $50,000 per incident. Arkansas (Act 159, effective February 25, 2025) amended its Frank Broyles Publicity Rights Protection Act to explicitly cover AI reproduction of voice for commercial purposes, one of the first to add a specific AI amendment to an existing right-of-publicity statute. Washington (SSB 5886, effective June 11, 2026) updated the state's Personality Rights Act (RCW 63.60) to cover "forged digital likenesses" including AI voice, raising the civil penalty to $3,000 plus noneconomic damages. Our Washington digital likeness explainer covers that law in detail.

Pennsylvania took a different approach with Act 35 of 2025 (18 Pa.C.S. 4101.1, effective September 5, 2025). Rather than a right-of-publicity model, Pennsylvania created a criminal offense called "digital forgery": creating or distributing a forged digital likeness (including audio of a person's voice) as genuine with intent to defraud or injure. It is a first-degree misdemeanor escalating to a third-degree felony in fraud schemes.

Indiana (IC 32-36-1) and Nevada (NRS 597.770) have older right-of-publicity statutes that explicitly list "voice" among the protected personality elements, making them applicable to voice cloning for commercial use even without a specific AI amendment.

Illinois extended its Right of Publicity Act (765 ILCS 1075) via HB 4875 (signed August 2024, effective January 1, 2025) to add "digital replica," "generative artificial intelligence," and "unauthorized digital replica" as defined terms, prohibiting distribution of works containing unauthorized digital replicas while providing safe harbors for cloud providers lacking actual knowledge.

Illinois also has BIPA. The Biometric Information Privacy Act (740 ILCS 14/) requires written consent before a private entity collects or uses biometric identifiers, including voiceprints. BIPA's $1,000-to-$5,000 per-violation damages have driven some of the largest privacy-related class actions in the country and apply to any AI voice-data collection from Illinois residents.

FCC Robocall Rule

The FCC's February 2024 ruling (Order 24-17) that AI-generated voices in robocalls are "artificial" under the TCPA applies nationwide. Marketers, political groups, and fraudsters alike are now barred from using cloned voices in phone calls without prior express consent.

Election Deepfakes and the First Amendment

At least 28 states have enacted laws restricting deepfakes in election communications. The approaches split between two models: disclosure (requiring a prominent statement that content was AI-generated) and prohibition (banning deceptive deepfakes outright, usually within a window before an election). Prohibition-only laws carry higher First Amendment risk.

California's AB 2839 (2024) was the most ambitious election deepfake ban, but a U.S. District Court struck the law down in its entirety and permanently enjoined it in August 2025 in Kohls v. Bonta. The court held that the prohibition on realistic AI-generated political content (even absent a disclaimer) was a content-based speech restriction not supported by a compelling government interest without narrowing. California's earlier, narrower AB 730 (2019) disclosure-only law survived scrutiny.

Minnesota's Minn. Stat. 609.771 (enacted 2023, effective August 1, 2023) prohibits spreading a deepfake within 90 days before an election with intent to damage a candidate. It has faced First Amendment challenges; as of February 2026, a preliminary injunction was denied and the litigation continues. The state's election deepfake law remains in force pending appeal.

Texas enacted the first election deepfake law in the nation in 2019 (Tex. Election Code 255.004), but a subsection was later ruled unconstitutionally overbroad. The core prohibition on creating and publishing a deepfake video within 30 days of an election with intent to injure a candidate was upheld.

Louisiana's governor vetoed its election deepfake bill in July 2024 on First Amendment grounds. Hawaii's 2024 election deepfake law (Act 191, SB 2687) was enacted but permanently enjoined on January 30, 2026 by a federal court as an unconstitutional restriction on political speech (Babylon Bee v. Hawaii). The pattern suggests that broad prohibition models (particularly those lacking a clear "intent to deceive" or narrow temporal-window requirement) face the most constitutional vulnerability.

Pure disclosure requirements, by contrast, have generally survived challenge. Utah (SB 131), Colorado (HB 24-1147), Oregon (SB 1571), and Wisconsin (Act 123) all use disclosure models.

What to Do If You Are the Victim of a Deepfake

Step 1: Request platform removal. Under the TAKE IT DOWN Act, platforms must remove flagged nonconsensual intimate images (including AI-generated deepfakes) within 48 hours of a verified victim notice (effective May 19, 2026). File notices directly through each platform's reporting channel and reference the TAKE IT DOWN Act if the platform is slow to respond.

Step 2: Document everything. Take screenshots with timestamps of where the content appears and any communications from the person responsible. Documentation preserves evidence for criminal and civil proceedings.

Step 3: Report to law enforcement. If you are in a state with an enacted NCII deepfake law, file a report with local police or the state attorney general. Even in states without specific deepfake laws, federal law (TAKE IT DOWN Act for intimate images; 18 U.S.C. 2256 for CSAM) applies, and the FBI has jurisdiction over federal crimes.

Step 4: Pursue civil remedies. States including California, Colorado, Florida, Michigan, Minnesota, New Hampshire, New Jersey, New York, and others provide explicit private rights of action with statutory damages. Consult an attorney about the statute of limitations in your state; some run as short as one year from discovery.

Step 5: Contact the Cyber Civil Rights Initiative. The CCRI (cybercivilrights.org) provides crisis helpline support and can help identify legal resources in your state.

If the deepfake involves election interference, contact your state elections authority and, if the candidate is depicted, their campaign's legal team, as many states give candidates standing to seek emergency injunctive relief.

How Deepfake Laws Interact With Recording Laws

Deepfake creation and recording consent are distinct legal frameworks, but they intersect in important ways. Recording a conversation without consent may itself be illegal under your state's wiretapping statute; see United States recording laws by state for a full breakdown. But if someone uses an AI tool to clone your voice from a legally-made recording, the recording-consent question is separate from the voice-cloning question.

Meeting transcription tools and AI note-takers add another layer. If an AI meeting recorder captures your voice and that audio is later used to train a voice-cloning model, you may have claims under BIPA (if you're in Illinois), your state's right-of-publicity statute, or the FTC Impersonation Rule, regardless of whether the original recording was lawful. Our guide to AI meeting recording laws covers consent requirements for AI-assisted recording tools specifically.

For a broader look at how AI intersects with state law, see our AI laws by state hub, and for data privacy frameworks that often govern AI data collection, see data privacy laws by state.

Disclaimer: This page provides general legal information, not legal advice. Deepfake laws are changing rapidly; confirm current statutes with a licensed attorney or the official state legislature website for your jurisdiction.

Sources

Citations for this page are drawn from primary government and legislative sources including the statutes and laws cited above.