Virginia Deepfake Laws: AI Images, Voice Cloning & Penalties (2026)

Virginia was among the first states in the nation to outlaw intimate deepfakes. Section 18.2-386.2 of the Virginia Code, amended in 2019, expressly prohibits the malicious dissemination of falsely created images depicting an identifiable person in intimate contexts, making it a Class 1 misdemeanor. Virginia also criminalizes AI-generated child sexual abuse material under §§ 18.2-374.1 and 18.2-374.1:1. It has no enacted election deepfake statute. Its statutory right of publicity, Va. Code § 8.01-40, does extend to voice, giving Virginia residents a civil remedy against unauthorized commercial use of a cloned voice.

Is It Illegal to Make a Deepfake of Someone in Virginia?

It depends on the content. Virginia targets two specific categories: nonconsensual intimate images (including deepfakes of adults) and AI-generated child sexual abuse material. Outside those two buckets, a general-purpose deepfake of a private person in a non-sexual context has no dedicated Virginia criminal statute.

For intimate deepfakes, § 18.2-386.2 applies whenever someone maliciously disseminates or sells a falsely created or altered image of an identifiable person in nudity or intimate circumstances with intent to coerce, harass, or intimidate. Dissemination or sale is the operative limit: the section punishes only one who "maliciously disseminates or sells" such an image, so making an intimate deepfake, or keeping one, without disseminating or selling it is not an offense under § 18.2-386.2. The statute does not require that an intimate photograph of the victim ever existed. It defines "another person" to include anyone whose image was used in creating, adapting, or modifying the depiction, where the result is intended to depict an actual person who is recognizable by face, likeness, or other distinguishing characteristic. Some image of the victim must therefore have gone into the output, so a wholly synthesized likeness that merely resembles someone falls outside the statute.

For election communications, Virginia has no enacted deepfake-specific law. Several bills were proposed but not enacted through mid-2026. For voice cloning, Virginia's statutory right of publicity (Va. Code § 8.01-40) expressly protects voice alongside name, portrait, picture, and likeness, giving a Virginia resident whose voice is cloned without consent for advertising or trade purposes a civil remedy under that statute.

For a broader look at how Virginia regulates artificial intelligence across sectors, see Virginia AI Laws, which covers the state's consumer data protection AI provisions and automated employment decision tools. That page addresses AI governance generally; this page focuses on deepfake-specific criminal and civil liability.

Sexual and Intimate Deepfakes

Virginia Code § 18.2-386.2 is the state's primary deepfake NCII statute. It was originally enacted in 2014 as a nonconsensual intimate image law, then amended in 2019 (Chapters 490 and 515, captioned by the legislature as the "falsely created" image bills) to define "another person" to include anyone whose image was used in creating, adapting, or modifying an image intended to depict an actual, recognizable person, making Virginia one of the first states in the country to explicitly reach deepfake intimate images. The 2024 amendment (Chapter 697) further strengthened the statute.

Under the current text, the statute reaches videographic or still images depicting a person in nudity or intimate activity. Critically, it covers images where a person's "face, likeness, or other distinguishing characteristic" was used in "creating, adapting, or modifying" the image with the intent to depict an actual person. That language reaches wholly AI-generated content where no original intimate photo of the victim existed.

The offense requires malicious intent and the purpose of coercing, harassing, or intimidating the depicted person. If the prosecution cannot show that specific mental state, a charge under § 18.2-386.2 will not hold, even if the image is deeply offensive. That intent element matters in practice: distribution driven by amusement or shock value, rather than by a purpose to coerce, harass, or intimidate the person depicted, may fall outside the statute.

Penalty

A violation of § 18.2-386.2 is a Class 1 misdemeanor in Virginia, carrying a sentence of up to 12 months in jail and a fine of up to $2,500. Virginia does not currently have a felony enhancement in this statute for repeat offenses or for distribution to multiple recipients, which critics note limits deterrence compared to states that escalate to felony status on second offense.

Victims do have a statutory civil remedy. Va. Code § 8.01-40.4, enacted in 2017, allows any person injured by conduct prohibited under § 18.2-386.2 to sue for compensatory damages, punitive damages, and reasonable attorney fees, whether or not criminal charges were ever filed.

AI-Generated Child Sexual Abuse Material

Virginia Code § 18.2-374.1, amended by 2024 Chapter 262 (effective July 1, 2024), addresses AI-generated child sexual abuse material by clarifying that the minor depicted "does not have to actually exist." This language, drawn from the federal definitional model, expressly brings computer-generated and AI-generated imagery within the statute's reach.

Production, making, or financing of child pornography where the apparent victim is under 15 years old carries a prison term of five to 30 years, with a five-year mandatory minimum if the offender is seven or more years older than the victim. For apparent victims between 15 and 17, the range is one to 20 years. Mandatory minimums are served consecutively with any other sentence.

Possession and distribution are covered separately under § 18.2-374.1:1. Simple possession is a Class 6 felony (one to five years in prison or up to 12 months in jail). A second or subsequent possession conviction is a Class 5 felony (one to 10 years). Distribution or facilitation of paid access carries a range of five to 20 years with enhanced mandatory minimums on repeat offenses.

Federal CSAM law under 18 U.S.C. § 2256(8)(B) independently covers computer-generated images indistinguishable from a real minor, providing a parallel layer of prosecution regardless of state coverage.

Election and Political Deepfakes

Virginia has no enacted election deepfake statute. Several bills addressing AI-manipulated content in political advertising were introduced in recent sessions but did not become law as of mid-2026. In the 2026 session, SB 141 started as an AI political ad disclosure bill, was rewritten in the House as an expedited defamation measure, and then failed in conference. A broader synthetic digital content bill from 2025 (HB 2124) was signed but never took effect because its effective clause required reenactment by the 2026 General Assembly, which did not occur. Virginia's general fraud and impersonation statutes may apply in narrow circumstances, but there is no disclosure requirement and no dedicated prohibition tied to political communications.

Election deepfake laws nationally carry ongoing First Amendment risk. A federal court struck down California's AB 2839 election deepfake law in its entirety and permanently enjoined its enforcement in August 2025 on free speech grounds, illustrating the constitutional tension these statutes face. Virginia lawmakers considering this area will need to account for that precedent.

At the federal level, no election-specific deepfake law had been enacted as of mid-2026. General campaign finance rules and the federal wire fraud statute may apply in cases involving systematic deception, but no comprehensive federal election deepfake prohibition is in place.

AI Voice Cloning and Digital Likeness

Virginia's statutory right of publicity, Va. Code § 8.01-40, allows a person whose name, portrait, picture, voice, or likeness is used without consent for advertising purposes or purposes of trade to seek an injunction, damages, and punitive damages. For a lawful commercial use, such as an ad, getting that consent in writing beforehand is what our photo release form generator drafts. The statute expressly lists voice alongside name, portrait, picture, and likeness, so a cloned voice used commercially without consent can support a claim under it. Virginia's protection is narrower than Tennessee's ELVIS Act (Tenn. Code Ann. § 47-25-1101 et seq., effective July 1, 2024) in one respect: Tennessee's law covers voice simulations regardless of whether the use is for advertising or trade, while § 8.01-40 requires the use to be for advertising purposes or purposes of trade. Tennessee's law remains the broader national reference point, but § 8.01-40 already gives Virginia voice-cloning victims a statutory remedy.

Section 18.2-386.2 covers image-based abuse, not voice cloning or audio deepfakes. A deepfake audio clip of a Virginia resident's voice used for harassment does not fall within that statute, but commercial exploitation of a cloned voice can be pursued under Va. Code § 8.01-40's right of publicity. Victims of non-commercial harassment are limited to general tort claims, such as defamation if false statements of fact are conveyed, or false light invasion of privacy.

No bill creating a Virginia right of publicity covering AI voice simulations had been enacted as of mid-2026. The proposed federal NO FAKES Act (S.1367, 119th Congress) would create a federal right of publicity for voice and likeness against unauthorized AI digital replicas, but it has not passed either chamber and should not be treated as current law.

Federal Law That Applies in Virginia

Federal law provides important protections that supplement Virginia's state statutes and cover several gaps.

The TAKE IT DOWN Act (Public Law 119-12, signed May 19, 2025) is the first federal law directly targeting nonconsensual intimate visual depictions of adults and minors, expressly including AI-generated deepfakes labeled "digital forgeries." It is a federal crime to knowingly publish such material, with penalties of up to two years in prison (three years if the victim is a minor). Platforms must remove flagged content within 48 hours of a victim's notice, enforced by the FTC. This law supplements § 18.2-386.2 and may provide a higher criminal ceiling than the state misdemeanor.

The FCC ruled in February 2024 (FCC 24-17) that AI-generated voices in robocalls constitute "artificial" voices under the Telephone Consumer Protection Act (47 U.S.C. § 227). AI voice-clone robocalls without prior express consent are therefore illegal nationwide, including in Virginia. The FCC issued a $6 million fine in September 2024 against the consultant responsible for the fake-Biden New Hampshire primary robocall that triggered this ruling.

The FTC Impersonation Rule (16 CFR Part 461, effective April 1, 2024) prohibits deceptive impersonation of government entities and businesses, including via AI voice cloning. The individual-impersonation extension remains an unfinalized proposed rulemaking as of mid-2026. Cloned voices also turn up in calls that pose as a relative in trouble and ask for money fast; our guide to family emergency and grandparent scams covers how to check a call like that before paying.

Federal CSAM law under 18 U.S.C. § 2256(8)(B) (PROTECT Act, 2003) covers computer-generated images indistinguishable from a real minor, providing a parallel prosecution track to Virginia's own § 18.2-374.1.

Two additional federal proposals remain pending and are NOT enacted law. The DEFIANCE Act (S.1837, 119th Congress) would create a federal civil cause of action for sexual deepfake victims, with liquidated damages of $150,000, rising to $250,000 if the conduct involved actual or attempted sexual assault, stalking, or harassment. It passed the Senate by unanimous consent on January 13, 2026, and is now pending in the House; it is not yet law. The NO FAKES Act (S.1367, 119th Congress) would create a federal right of publicity covering voice and likeness against unauthorized AI digital replicas. It was introduced on April 9, 2025 and referred to the Senate Judiciary Committee, where it remained as of August 2026; it has not passed either chamber. For background on the DEFIANCE Act proposal, see the news coverage of the DEFIANCE Act (noting its pending status).

What Victims Can Do

A Virginia victim of an intimate deepfake has several concrete options.

The fastest route for platform removal is the federal TAKE IT DOWN Act: platforms must remove nonconsensual intimate images, including deepfakes, within 48 hours of a victim's notice submission. The National Center for Missing and Exploited Children operates the intake portal at TakeItDown.NCMEC.org. This requires no court order and no proof of identity beyond the notice itself.

For criminal enforcement, victims can report to local law enforcement or the Virginia Attorney General's office under § 18.2-386.2. The offense is a Class 1 misdemeanor, so local prosecutors handle it. The state's intent requirement (malice plus coercion, harassment, or intimidation) means law enforcement will need evidence of those purposes.

For civil remedies, Va. Code § 8.01-40.4 gives victims a statutory cause of action against anyone who engaged in conduct prohibited under § 18.2-386.2, with compensatory damages, punitive damages, and reasonable attorney fees available regardless of whether criminal charges were filed. Common law claims for intentional infliction of emotional distress or invasion of privacy remain available alongside it. Consulting a Virginia attorney experienced in cyber harassment or digital privacy is the recommended first step.

For AI voice cloning harms, a Virginia resident whose voice is used without consent for advertising purposes or purposes of trade can sue under Va. Code § 8.01-40 for an injunction, damages, and punitive damages. General defamation law also applies if false statements of fact are conveyed through a voice deepfake, and false light or common-law misappropriation claims remain available for uses that fall outside § 8.01-40's advertising-or-trade requirement.

For recordings of conversations and broader privacy rights in Virginia, see Virginia Recording Laws and Virginia Data Privacy Laws.

Penalties at a Glance

Disclaimer: This page provides general legal information about Virginia deepfake and AI image laws as of 2026. It is not legal advice and does not create an attorney-client relationship. Laws in this area are changing rapidly. Consult a licensed Virginia attorney for advice about your specific situation.

More Virginia Laws

• Virginia AI Meeting Recording Laws
• Virginia Data Privacy Laws
• Virginia Recording Laws
• Virginia Sexting Laws

Frequently Asked Questions

Is it illegal to make a deepfake of someone in Virginia?

It depends on the content. Virginia Code § 18.2-386.2 makes it a crime to maliciously disseminate or sell a falsely created or altered intimate image of an identifiable person with intent to coerce, harass, or intimidate. That expressly covers AI-generated deepfakes. Dissemination or sale is the operative limit, so making or keeping such an image without disseminating or selling it is not an offense under that section. Deepfakes in non-sexual, non-coercive contexts do not have a dedicated Virginia criminal statute, though common law tort claims may still apply.

Is deepfake porn a crime in Virginia?

Yes. Virginia Code § 18.2-386.2 was among the first state laws in the country to explicitly cover deepfake intimate images when it was amended in 2019. Maliciously disseminating such an image with coercive intent is a Class 1 misdemeanor, punishable by up to 12 months in jail and a $2,500 fine. The federal TAKE IT DOWN Act (signed May 2025) also makes publishing nonconsensual intimate deepfakes a federal crime with up to two years in federal prison.

Can I sue someone for a deepfake in Virginia?

Yes. Va. Code § 8.01-40.4 creates a civil cause of action for any person injured by conduct prohibited under § 18.2-386.2, allowing recovery of compensatory damages, punitive damages, and reasonable attorney fees, even if no criminal charges were filed. Common law claims for intentional infliction of emotional distress or invasion of privacy may also apply. Consulting a Virginia attorney about the specific facts of your situation is the best starting point.

Are AI voice clones illegal in Virginia?

Virginia does not have an AI-specific voice-cloning statute, but its general right-of-publicity law, Va. Code § 8.01-40, expressly protects voice: a person whose voice is used without consent for advertising purposes or purposes of trade can sue for an injunction, damages, and punitive damages. Using an AI voice clone in a robocall without the recipient's consent also violates federal law under the TCPA as clarified by FCC ruling 24-17 (Feb. 2024). For uses outside § 8.01-40's advertising-or-trade requirement, Virginia victims must rely on common law claims such as defamation, which are less predictable. Tennessee's ELVIS Act (2024) remains a broader national model that Virginia has not adopted.

Does Virginia have an election deepfake law?

No. Virginia has no enacted statute specifically targeting deepfakes in election advertising or political communications as of mid-2026. Bills have been proposed but not enacted. General fraud and impersonation statutes may apply in narrow circumstances, but there is no disclosure requirement or dedicated prohibition for AI-manipulated political content in Virginia.

What is the TAKE IT DOWN Act and does it apply in Virginia?

Yes, it applies in Virginia. The TAKE IT DOWN Act (Public Law 119-12, signed May 19, 2025) is a federal law that makes it a crime to publish nonconsensual intimate images of adults or minors, expressly including AI-generated deepfakes. Penalties reach two years in federal prison (three for minors). Platforms must remove flagged content within 48 hours of a victim's notice. It supplements Virginia's § 18.2-386.2 and provides a faster platform-removal path.

Is AI-generated child sexual abuse material illegal in Virginia?

Yes. Virginia Code § 18.2-374.1, amended by 2024 Chapter 262 (eff. July 1, 2024), expressly includes content where the depicted minor 'does not have to actually exist,' covering AI-generated CSAM. Production carries five to 30 years in prison (five to 20 for older minors). Possession is a Class 6 felony under § 18.2-374.1:1. Federal law under 18 U.S.C. § 2256 independently covers computer-generated images indistinguishable from a real minor.

What should I do if someone posted a deepfake of me online in Virginia?

Start with a platform takedown under the federal TAKE IT DOWN Act: platforms must remove flagged nonconsensual intimate images within 48 hours of your notice. The intake portal is TakeItDown.NCMEC.org. You can also report the conduct to local law enforcement or the Virginia Attorney General's office for criminal prosecution under § 18.2-386.2. For civil remedies, consult a Virginia attorney about common law claims for intentional infliction of emotional distress or invasion of privacy.