Deepfake Liability Act

Summary

Conditions platform immunity under Section 230 on having a reasonable process to prevent cyberstalking and intimate privacy violations, requires platforms to implement a fast notice-and-removal system for such content, and expands the definition of "information content provider" to explicitly capture material created via solicitation, encouragement, or generative models. Platforms must log certain data, comply with a 48-hour removal requirement for covered notices, and follow implementing regulations the FTC issues (in consultation with the FCC and, as appropriate, the Attorney General) within 180 days of enactment. The law also revises criminal and civil definitions and cross-references to cover “sexually explicit digital forgeries” and clarifies First Amendment protections.

• Conditions Section 230 immunity on platforms having a reasonable process to prevent cyberstalking and intimate privacy violations.
• Requires platforms to operate a public notice-and-removal process with removal within 48 hours for covered notices and reasonable efforts against identical reposts.
• Expands the definition of "information content provider" to include content created via solicitation, encouragement, or generative models (e.g., certain AI outputs).
• Imposes minimum data logging and recordkeeping requirements tied to notices and removal actions.
• Directs the FTC (with FCC and DOJ input as appropriate) to adopt implementing regulations within 180 days of enactment.
• Creates a good-faith safe harbor for platforms that remove content under the mandated notice-and-removal process.
• Narrows the set of covered platforms by excluding broadband, email, messaging, and data storage services from the notice-and-removal regime.
• Updates criminal/civil definitions (including "sexually explicit digital forgery") and removes some prior statutory exceptions.
• Applies to content made available on or after enactment and includes a non-infringement statement regarding the First Amendment.