AI Deepfakes and Personality Rights: The Civil Track

This post is informational and reflects the state of the law as of April 2026. Personality-rights statutes vary by state and are changing. For a specific product, consult a licensed attorney.

Most of the attention on AI deepfakes goes to the criminal side, and that side is real: the federal TAKE IT DOWN Act (signed May 2025) makes nonconsensual intimate imagery a crime and requires platforms to remove flagged content within 48 hours. But for most companies that build or host media tools, the criminal statute is not where the exposure sits. The civil track is, and it is opening up state by state.

Washington’s SB 5886 is a clear example. The state expanded its personality-rights statute to cover “forged digital likenesses,” meaning AI-generated or digitally altered video, images, or synthetic audio depicting a real person in a way likely to deceive a reasonable observer. The features that matter for risk:

A private right of action. Enforcement is not left to a regulator. Any person whose likeness appears in synthetic content distributed in Washington can sue.
Damages that do not require the defendant to have profited. The statute allows actual damages plus noneconomic damages even where the defendant made no money, on top of a statutory civil penalty.
Broad reach. The law protects individuals regardless of where they live; the hook is the use or dissemination of the content in Washington.

Why the civil track is the one to plan for

A criminal statute is enforced by prosecutors exercising discretion over a defined category of conduct. A private right of action with noneconomic damages is enforced by everyone, and it does not require the plaintiff to show a lost dollar. For a company whose product can generate or host a real person’s likeness, that is a materially different risk profile, and it is the one standard media-liability planning tends to miss.

Washington is not alone. Several states have extended likeness and publicity rights into the AI era: California (its right-of-publicity statutes now reach AI “digital replicas,” including for deceased personalities), Illinois (its Right of Publicity Act was amended to cover digital replicas), Tennessee (the ELVIS Act, which reaches voice simulation and even the tools used to make it), and New York. The specifics differ, but the direction is consistent, and a company operating nationally is exposed under the strictest of them.

What to do

Identify the products that generate, host, distribute, or license user-created media depicting real people. That is your exposure surface.
Map the state statutes that apply to your users, with attention to the ones that allow noneconomic damages without proof of profit. That combination is where a plaintiff’s bar builds cases, and it is often a gap in media-liability insurance.
Build one notice-and-takedown workflow that handles both the federal TAKE IT DOWN regime and state personality-rights demands, rather than bolting on a separate process for each.

The federal criminal statute gets the headlines. Plan for the civil track, because state court is where the money will move. (For how this fits with AI use policies and vendor terms, see the firm’s AI Governance and Technology Transactions practices.)

If your product can put a real person’s likeness on screen, talk to MB Legal about where your exposure sits.

This post is informational and does not constitute legal advice. Personality-rights and deepfake statutes vary by state and continue to change. For guidance on a specific product, consult a licensed attorney.