Nine states have enacted legislation targeting nonconsensual explicit deepfakes, with Virginia becoming the first in 2019. Research found 113,000 deepfake images uploaded in nine months, a 54% increase from 2022. Recent incidents involving high school students prompted action. States like Texas, New York, and Minnesota added criminal penalties, while California and Illinois allow civil lawsuits. Ohio, California, New Hampshire, and Oklahoma are considering additional legislation for 2024.

Illinois' 2008 Biometric Information Privacy Act (BIPA) has emerged as the nation's strongest biometric regulation, requiring notice, consent, and prohibiting profit from biometric data while providing private lawsuit rights. The Illinois Supreme Court clarified violations occur with each scan, enabling multi-hundred million dollar settlements against tech companies. Clearview AI, which scraped 30 billion photos and serves 3,000 U.S. law enforcement agencies, settled by restricting private sector sales.

California's Privacy Protection Agency released draft regulations on November 27, 2023, governing automated decision-making technology (ADMT) that uses personal information. The regulations establish consumer opt-out rights for ADMT producing legal effects, profiling employees or job applicants, and tracking consumers in public spaces. Consumers must receive plain-language notices about ADMT use. The draft contrasts with pending legislation CA AB 331, which would mandate impact assessments and allow private lawsuits for algorithmic discrimination.

States are enacting legislation to combat AI-generated deepfakes in elections ahead of 2024. California and Texas passed laws in 2019, while Minnesota criminalized deepfake use and Washington mandated disclosure requirements this year. Michigan recently passed bills requiring AI disclosure in political ads and prohibiting manipulated media within 90 days of elections without disclaimers. Seven additional states introduced similar legislation, adapting existing campaign regulations to address AI-generated content threats.

State lawmakers introduced over 160 AI-related bills in 2023, though most failed to advance past committee stage. Legislation focused on six key areas: facial recognition technology, bias protections, deepfakes, social media regulation, government AI use, and study groups. Montana prohibited continuous facial surveillance by law enforcement, while Minnesota and Illinois passed laws addressing nonconsensual deepfake sexual content. Connecticut and Texas established AI inventories for state agencies.

State lawmakers are grappling with how to define artificial intelligence for regulatory purposes, with no universal definition yet established. Rhode Island's HB 6285 defines AI as technology simulating human intelligence, while Michigan's HB 5143 describes it as machine-based prediction systems. New York's AB 8129 avoids the term entirely, instead defining "automated systems." Governor Hochul recently signed legislation addressing deepfakes without defining AI directly.

State policymakers are in the education phase of AI regulation, with eight states creating dedicated study groups and 11 states assigning standing committees or agencies to examine the technology ahead of 2024 legislative sessions. New Mexico lawmakers heard testimony emphasizing transparency and disclosure requirements, while California AB 331 exemplifies early legislation mandating impact assessments and allowing private lawsuits for algorithmic discrimination.