Deepfake Liability Act

Section 230(c)(1) of the Communications Act of 1934 (47 U.S.C. 230(c)(1)) is amended—

(1) by striking No provider and inserting the following:

Except as provided in subparagraph (B), no provider

(1) ; and

(2) by adding at the end the following:

Subparagraph (A) only applies to a provider of an interactive computer service if such provider is implementing, with respect to the interactive computer service of the provider, a reasonable process for addressing cyberstalking and intimate privacy violations that includes, at a minimum, the following:

(I) A process to prevent, to the extent practicable, cyberstalking and intimate privacy violations.

(II) A clear and accessible process to implement section 3(a) of the TAKE IT DOWN Act (47 U.S.C. 223a(a)) (relating to notice and removal of intimate privacy violations and content relating to cyberstalking).

(III) Minimum data logging requirements that—

(aa) preserve data necessary for legal proceedings related to cyberstalking or an intimate privacy violation; and

(bb) ensure that preserved data is not transferred or otherwise used for a purpose other than a legal proceeding related to cyberstalking or an intimate privacy violation.

(IV) A process to remove or block content that has been determined unlawful by a court.

(V) Any other process or requirement determined necessary by the Commission to address cyberstalking and intimate privacy violations.

In this subparagraph:

The term consent has the meaning given such term in section 223(h)(1).

The term cyberstalking means a deliberate course of conduct—

(aa) directed at a specific individual;

(bb) that causes the individual to suffer substantial emotional distress or the fear of bodily harm; and

(cc) that would cause a reasonable individual to suffer substantial emotional distress or the fear of bodily harm.

The term intimate privacy violation means the following:

(aa) An intimate visual depiction obtained or shared without the consent of an individual portrayed in the depiction.

(bb) A sexually explicit digital forgery made or shared without the consent of an individual portrayed in the sexually explicit digital forgery.

The term intimate visual depiction has the meaning given such term in section 1309(a) of division W of the Consolidated Appropriations Act, 2022 (15 U.S.C. 6851(a)).

The term sexually explicit digital forgery has the meaning given such term in section 223(h)(1).

Section 230(f)(3) of the Communications Act of 1934 (47 U.S.C. 230(f)(3)) is amended by striking creation or development and inserting creation or development (including through solicitation, encouragement, or the use of a generative model).

Section 223(h) of the Communications Act of 1934 (47 U.S.C. 223(h)) is amended—

(A) in paragraph (1), by amending subparagraph (B) to read as follows:

The term sexually explicit digital forgery means an intimate visual depiction of an identifiable individual that has been created, materially manipulated, altered, or annotated so that such depiction is virtually indistinguishable from an authentic visual depiction of such individual.

(B) in paragraph (3)—

(i) in the heading, by striking digital forgeries and inserting sexually explicit digital forgeries; and

(ii) by striking digital forgery each place it appears and inserting sexually explicit digital forgery; and

(C) in paragraph (6)(B), in the heading, by striking digital forgeries and inserting sexually explicit digital forgeries.

Section 223(h) of the Communications Act of 1934 (47 U.S.C. 223(h)), as amended by the preceding provisions of this Act, is further amended—

(A) in paragraph (2)(C)—

(i) in clause (iii), by striking the semicolon and inserting; or;

(ii) by striking clause (iv); and

(iii) by redesignating clause (v) as clause (iv); and

(B) in paragraph (3)(C)—

(i) in clause (iii), by striking the semicolon and inserting; or;

(ii) by striking clause (iv); and

(iii) by redesignating clause (v) as clause (iv).

Section 3 of the TAKE IT DOWN Act (47 U.S.C. 223a) is amended—

(A) in the heading, by striking nonconsensual intimate visual depictions and inserting intimate privacy violations and content relating to cyberstalking;

(B) by amending subsection (a) to read as follows:

A covered platform shall establish a process whereby a covered individual (or an authorized person acting on behalf of such individual) may—

(i) notify the covered platform of—

(I) an intimate privacy violation or content relating to cyberstalking published on the covered platform—

(aa) that includes a depiction of the covered individual;

(bb) that was published without the consent of the covered individual;

(cc) that depicts matter that was not voluntarily exposed by the covered individual in a public or commercial setting;

(dd) that does not depict a matter of public concern; and

(ee) publication of which—

(AA) causes the covered individual to suffer substantial emotional distress or the fear of bodily harm; and

(BB) would cause a reasonable individual to suffer substantial emotional distress or the fear of bodily harm; or

(II) content relating to cyberstalking published on the covered platform—

(aa) that is directed at the covered individual;

(bb) that was published without the consent of the covered individual;

(cc) that does not refer to a matter of public concern; and

(dd) publication of which—

(AA) causes the covered individual to suffer substantial emotional distress or the fear of bodily harm; and

(BB) would cause a reasonable individual to suffer substantial emotional distress or the fear of bodily harm; and

(ii) submit a request for the covered platform to remove such intimate privacy violation or content relating to cyberstalking.

A notification and request for removal of an intimate privacy violation or content relating to cyberstalking submitted under the process established under subparagraph (A) shall include, in writing—

(i) a physical or electronic signature of the covered individual (or an authorized person acting on behalf of such individual);

(ii) an identification of, and information reasonably sufficient for the covered platform to locate, the intimate privacy violation or content relating to cyberstalking;

(iii) a brief statement that the covered individual has a good faith belief that the intimate privacy violation or content relating to cyberstalking was published without the consent of the covered individual, including any relevant information for the covered platform to determine that the intimate privacy violation or content relating to cyberstalking was published without the consent of the covered individual;

(iv) information sufficient to enable the covered platform to contact the covered individual (or an authorized person acting on behalf of such individual); and

(v) a statement that the information in the notification and request for removal is accurate, and, under penalty of perjury, that the party submitting the notification and request for removal is the covered individual depicted in the intimate privacy violation or content relating to cyberstalking or the covered individual at whom the content relating to cyberstalking is directed (or an authorized person acting on behalf of such individual).

A covered platform shall provide on the platform a clear and conspicuous notice, which may be provided through a clear and conspicuous link to another web page or disclosure, of the notice and removal process established under paragraph (1)(A) that—

(A) is easy to read and in plain language; and

(B) provides information regarding the responsibilities of the covered platform under this section, including a description of how an individual can submit a notification and request for removal.

Upon receiving a valid removal request from a covered individual (or an authorized person acting on behalf of such individual) using the process described in paragraph (1)(A)(ii), a covered platform shall, as soon as possible, but not later than 48 hours after receiving such request—

(A) remove the intimate privacy violation or content relating to cyberstalking; and

(B) make reasonable efforts to identify and remove any known identical copies of the intimate privacy violation or content relating to cyberstalking.

A covered platform shall not be liable for any claim based on the covered platform’s good faith disabling of access to, or removal of, material claimed to be a nonconsensual intimate privacy violation or nonconsensual content relating to cyberstalking based on facts or circumstances from which the unlawful publishing of an intimate privacy violation or content relating to cyberstalking is apparent, regardless of whether the intimate privacy violation or content relating to cyberstalking is ultimately determined to be unlawful or not.

(B) ; and

(C) in subsection (b)(2)—

(i) in subparagraph (A), by striking Except as provided in subparagraph (D), the and inserting The; and

(ii) by striking subparagraph (D).

Section 4 of the TAKE IT DOWN Act (47 U.S.C. 223a note) is amended by striking paragraphs (2) and (3) and inserting the following:

The term consent has the meaning given such term in section 223(h)(1) of the Communications Act of 1934 (47 U.S.C. 223(h)(1)).

The term covered individual means—

(A) an individual—

(i) who appears in whole or in part in an intimate privacy violation or content relating to cyberstalking; and

(ii) whose face, likeness, or other distinguishing characteristic (including a unique birthmark or other recognizable feature) is displayed in connection with such intimate privacy violation or content relating to cyberstalking; and

(B) a specific individual at whom content relating to cyberstalking is directed.

The term covered platform means a website, online service, online application, or mobile application that is accessible to the public.

The term covered platform does not include the following:

(i) A provider of broadband internet access service (as described in section 8.1(b) of title 47, Code of Federal Regulations, or any successor regulation).

(ii) Electronic mail.

(iii) A messaging service.

(iv) A data storage service.

The term cyberstalking has the meaning given such term in section 230(c)(1)(B)(ii) of the Communications Act of 1934 (47 U.S.C. 230(c)(1)(B)(ii)).

The term intimate privacy violation has the meaning given such term in section 230(c)(1)(B)(ii) of the Communications Act of 1934 (47 U.S.C. 230(c)(1)(B)(ii)).

Not later than 180 days after the date of the enactment of this Act, the Federal Trade Commission, in consultation with the Federal Communications Commission and (as appropriate) with the Attorney General, shall promulgate regulations under section 553 of title 5, United States Code, to implement the amendments made by this Act.

The amendments made by this Act shall apply to information made available on an interactive computer service (as defined in section 230(f) of the Communications Act of 1934 (47 U.S.C. 230(f))) or a covered platform (as defined in section 4 of the TAKE IT DOWN Act (47 U.S.C. 223a note), as amended by this Act) on or after the date of the enactment of this Act.

The amendments made by this Act may not be construed to infringe upon any right protected under the First Amendment to the Constitution.