Colorado Deepfake Laws: AI Images, Voice Cloning & Penalties (2026)

Colorado has enacted two targeted deepfake laws: SB 25-288 (effective August 6, 2025) criminalizes the nonconsensual disclosure of AI-generated intimate images and creates a civil cause of action, while HB 24-1147 (effective July 1, 2024) requires disclosure labels on AI-manipulated election content. No state law yet covers commercial voice cloning, though federal law fills several gaps.

Is It Illegal to Make a Deepfake of Someone in Colorado?

It depends on what the deepfake depicts and how it is used. Colorado addresses two specific categories: intimate images and election communications. Disclosing, or threatening to disclose, AI-generated nude or sexual images of an identifiable adult without consent is now explicitly illegal under SB 25-288.

Making one is not. Every operative provision of that act turns on disclosure or a threatened disclosure: CRS § 18-7-107(1)(a) reaches an actor who "discloses or threatens to disclose through the use of electronic media or a website," § 18-7-108(1)(a) uses the same language, and the civil claim in § 13-21-1503(1) requires a depiction "that a person disclosed or threatened to disclose." An adult who generates an intimate deepfake of another adult and never shares it or threatens to share it commits no Colorado offense and incurs no liability under the new civil part. Creation appears elsewhere in the act only as a damages measure and as a limit on defenses, not as a liability trigger. That is a live gap in Colorado law, and it is worth knowing before assuming the statute covers a purely private file.

Distributing AI-manipulated video or audio of a political candidate without the required disclosure label is prohibited under HB 24-1147.

What is not yet covered: the making of an adult intimate deepfake that is never disclosed or threatened, general harassment deepfakes that stop short of intimate content, commercial voice cloning without an intimate or electoral purpose, and non-candidate political satire. Colorado does not have a comprehensive right-of-publicity statute protecting voice or likeness in commercial contexts. Those gaps are partly addressed by federal law, discussed below.

Colorado also does not yet have a standalone AI-generated CSAM statute, but existing state law covers digitally created visual depictions of minors, and federal law applies regardless. The rule for minors is broader than the adult rule described above: CRS § 18-6-403 reaches the creation and even the mere possession of sexually exploitative material, so no disclosure is needed.

Sexual and Intimate Deepfakes

SB 25-288 (Chapter 339, Colorado Session Laws 2025) is Colorado's primary response to AI-generated intimate imagery. It creates liability for nonconsensual disclosure of an intimate digital depiction, defined as a highly realistic but false visual depiction created through generative AI, image editing, or other computer-generated means that shows a real, identifiable person's intimate body parts or sexual acts without consent.

The civil cause of action requires the plaintiff to show the defendant disclosed or threatened to disclose the depiction; the depicted person did not consent; the defendant knew or recklessly disregarded that the person would suffer severe emotional distress; and the person was identifiable. Courts may award the defendant's monetary gains, actual damages or $150,000 liquidated damages (whichever is greater), exemplary damages, and attorney fees. Injunctive relief ordering removal is also available.

Criminal liability attaches on disclosure or a threatened disclosure, and it does not require a harassment motive. CRS § 18-7-107(1)(a) sets out two alternative routes: the actor either acted "with the intent to harass, intimidate, or coerce the depicted individual," or "knew or reasonably should have known that the depicted individual had a reasonable expectation that the private intimate image or intimate digital depiction would remain private," with the disclosure or threat having caused physical, emotional, or reputational harm. CRS § 18-7-108(1)(a) is built the same way for the pecuniary-gain offense: either an intent to obtain a pecuniary benefit, or knowledge that the depicted individual expected privacy and that disclosure would cause financial harm. Someone who forwarded a deepfake with no malice at all can still fall inside the statute on that second route.

The base offense is a Class 1 misdemeanor. If the actor disclosed the depiction and the disclosure posed an imminent and serious threat to the depicted individual's safety or the safety of their immediate family, and the actor knew or reasonably should have known of that threat, the offense is elevated to a Class 6 felony. Both sections also carry a mandatory add-on fine that overrides the ordinary misdemeanor fine cap: notwithstanding CRS § 18-1.3-501(1)(a.5), and in addition to any other sentence, "the court shall fine the defendant up to ten thousand dollars," with the money credited to the crime victim compensation fund created in CRS § 24-4.1-117.

Satire and parody are a flat carve-out from the civil action: CRS § 13-21-1504(4) provides that part 15 "does not apply to media content that constitutes satire or parody." Public concern is a much weaker shield. It is only a defense the defendant must prove under § 13-21-1504(1)(a)(III), and it can be defeated three ways: a defendant "who created, developed, or otherwise made the intimate digital depiction" cannot escape liability on a good-faith claim (§ 13-21-1504(1)(b)); the plaintiff can defeat the defense by showing by a preponderance of the evidence that the disclosure was made "for the purposes of sexual arousal, sexual gratification, humiliation, degradation, or monetary or commercial gain" (§ 13-21-1504(2)(b)); and a disclosure is not a matter of public concern "solely because the depicted individual is a public figure" (§ 13-21-1504(3)). The criminal statutes separately exclude good-faith disclosures to law enforcement or in court proceedings.

For minors, existing CRS § 18-6-403 (sexual exploitation of a child) covers digitally created visual depictions, and SB 25-288 amended it in 2025 to expressly reach realistic AI-generated depictions of an identifiable child. The federal PROTECT Act (18 U.S.C. § 2256) independently covers computer-generated images indistinguishable from a real minor and applies in Colorado regardless of state-law coverage.

Election and Political Deepfakes

HB 24-1147 (Chapter 250, Colorado Session Laws 2024, codified at CRS § 1-46-103) took effect July 1, 2024, making Colorado one of the first states to regulate AI deepfakes in political advertising. The law prohibits any person from knowingly distributing a communication about a candidate for elective office that contains a deepfake within the 60 days before a primary election or the 90 days before a general election, unless the communication includes a specific disclosure statement: "This (image/audio/video/multimedia) has been edited and depicts speech or conduct that falsely appears to be authentic or truthful."

The disclosure must appear in the content's metadata and, where technically feasible, remain permanent and resistant to removal. Violations must be proved by clear and convincing evidence that the defendant acted with knowledge or reckless disregard of the deepfake's deceptiveness.

Enforcement is two-track. The Secretary of State handles administrative complaints with civil penalties of at least $100 per violation for unpaid communications, or 10% of advertising expenditures for paid placements. Affected candidates also have a private right of action for injunctive relief, compensatory and punitive damages, and attorney fees.

A First Amendment note applies here: in August 2025, a federal court enjoined portions of California's election deepfake law (AB 2839) on First Amendment grounds. Colorado's law has not faced a similar challenge as of June 2026, but election-deepfake statutes nationwide carry ongoing constitutional risk. The law targets non-disclosed manipulation of candidate content, not satire or clearly labeled parody, which helps narrow the First Amendment exposure.

AI Voice Cloning and Digital Likeness

Colorado does not have a statutory right of publicity or an AI-specific voice cloning law. No bill addressing commercial voice replication or digital replica rights had been enacted as of June 2026. This is a meaningful gap: a content creator or advertiser could potentially clone a private individual's voice without triggering any Colorado-specific statute, unless the resulting content also constitutes intimate imagery or election fraud under the laws above.

The national reference point is Tennessee's ELVIS Act (Tenn. Code Ann. § 47-25-1101 et seq., eff. July 1, 2024), the first state law to extend right-of-publicity protections expressly to AI voice simulations. Colorado has not passed a comparable statute.

Common law right of publicity may provide some protection in Colorado courts, particularly for public figures whose name, image, or likeness has measurable commercial value. However, common law claims are less predictable and harder to enforce than statutory rights.

For general AI regulation affecting businesses operating in Colorado, see Colorado AI Laws and Regulation (2026), which covers the AI Act (SB 24-205) and broader algorithmic accountability obligations. That page addresses technology governance; this page focuses on deepfake-specific criminal and civil liability.

Federal Law That Applies in Colorado

Federal law fills several gaps in Colorado's current deepfake framework.

The TAKE IT DOWN Act (Public Law 119-12, signed May 19, 2025) is now federal law. It creates a federal crime for knowingly publishing nonconsensual intimate visual depictions of adults or minors, expressly including AI-generated digital forgeries. The maximum penalty is two years in federal prison (three years when minors are involved). Critically, platforms must remove flagged content within 48 hours of a victim's notice request, enforced by the FTC. This gives Colorado victims a fast-track removal pathway alongside the civil remedies under SB 25-288.

The FCC ruled in February 2024 (FCC 24-17) that AI-generated voices in robocalls are artificial under the TCPA (47 U.S.C. § 227), making AI voice-clone robocalls to phones without prior express consent illegal nationwide. This directly addresses one common voice-cloning abuse vector.

The FTC Impersonation Rule (16 CFR Part 461, eff. April 1, 2024) prohibits deceptive AI-assisted impersonation of government entities and businesses. The FTC can also pursue AI voice fraud under Section 5 of the FTC Act and the Telemarketing Sales Rule.

Two federal bills remain proposals only. The DEFIANCE Act (S.1837, 119th Congress) would create a federal civil cause of action for sexual deepfake victims with $150,000 liquidated damages, but it is pending and not law. The NO FAKES Act (S.4591, 119th Congress) would create a federal right of publicity covering voice and likeness against unauthorized AI digital replicas, but it has not passed either chamber as of June 2026. For background on the proposed federal civil remedy, see the DEFIANCE Act explainer (noting its current pending status).

What Colorado Victims Can Do

If you are the subject of an AI-generated intimate image shared without your consent, Colorado now provides overlapping remedies. Under SB 25-288, you can file a civil lawsuit and seek $150,000 liquidated damages, exemplary damages, and attorney fees without proving actual financial harm. You can also request a court order requiring the defendant to remove the content. A threatened disclosure is enough to start the claim; you do not have to wait until the image is actually posted.

On the criminal side, you can report the disclosure to local law enforcement. You do not need to show the sender was trying to harass you: it is enough that the sender knew or reasonably should have known you expected the image to stay private and that the disclosure caused you physical, emotional, or reputational harm. If the conduct rises to the imminent-safety-threat level, prosecutors can pursue a Class 6 felony charge. For platforms that hosted or distributed the content, the federal TAKE IT DOWN Act requires removal within 48 hours of your notice to the platform.

For election deepfakes targeting a candidate, the affected candidate can file an administrative complaint with the Secretary of State or pursue a civil lawsuit for injunctive relief and damages under CRS § 1-46-103. Private individuals who are not candidates but appear in election-related deepfakes may need to rely on SB 25-288 if the content is intimate, or on common law defamation or false-light claims otherwise.

Colorado's data privacy laws and the Colorado Consumer Protection Act may provide additional angles in cases involving unauthorized commercial use of personal data to train or operate deepfake tools. For the intersection of AI and workplace or meeting recordings, see Colorado AI Meeting Recording Laws.

Penalties at a Glance

Disclaimer: This page provides general legal information about Colorado deepfake and AI image laws, not legal advice. Deepfake and AI law is one of the fastest-moving areas of legislation in the United States; statutes enacted in 2024-2025 are still being interpreted by courts. If you have been harmed by a deepfake or face a claim, consult a licensed Colorado attorney.

More Colorado Laws

• Colorado AI Meeting Recording Laws
• Colorado Data Privacy Laws
• Colorado Recording Laws
• Colorado Sexting Laws