Is This Real? Navigating AI Impersonation Under New And Existing Laws

Is this AI-generated, or is it real? As generative AI tools have become increasingly capable of creating realistic images, videos, and audio, they have also made it easier to impersonate real people without their consent. In response, states are increasingly adopting laws that impose civil and criminal liability for certain AI-generated content that replicates an individual’s identity, likeness, voice, or other personal attributes. This comes against the backdrop of existing federal and state intellectual property (IP) protections for unauthorized commercial appropriation of an individual’s name, likeness, voice, or other identifying attributes.

For organizations, AI impersonation presents risks in two directions. First, a company’s own use of AI-generated marketing content, digital avatars, voice agents, entertainment content, and other synthetic media may implicate state-law and IP restrictions when it replicates or appropriates an individual’s identity without authorization. Second, third parties may use AI to impersonate the company, its executives or employees, or other representatives, potentially causing fraud, consumer confusion, and reputational harm. Companies should address both categories through governance measures tailored to their risk profiles, potentially including pre-deployment and periodic testing, input and output guardrails, revised acceptable-use policies, response procedures for unauthorized synthetic media claims, and monitoring for company impersonation.

While this post focuses on general commercial AI impersonation risks, a parallel and rapidly expanding body of state law addresses candidate impersonation, election communications, and political advertising, including New York Election Law § 14-106, New Hampshire RSA 664:14-c, and the political-media provisions of New Jersey A3540. Organizations and companies dealing with political and election-related communications should evaluate those requirements separately. 

Below, we examine the principal legal frameworks governing AI impersonation, both as sources of compliance obligations for companies using generative AI and as potential remedies when companies or their representatives are impersonated by third parties.

Existing Intellectual Property Framework

Existing federal IP and related state-law doctrines may impose liability when a company uses AI to replicate an individual’s identity without authorization, and they may provide potential remedies when a third party uses synthetic media to impersonate a company, its representatives, or individuals associated with the company.

AI impersonation of individuals can often violate the impersonated individual’s right of publicity, which protects against the unauthorized commercial appropriation of an individual’s name, likeness, voice, or other identifying attributes. Because synthetic media – e.g., digital content created or modified by AI – so often trades on the recognizability of a real person, right-of-publicity principles frequently supply the most direct theory of liability for an unauthorized digital replica or voice clone. These rights may belong to the impersonated individual, but a company may have contractual, licensing, indemnification, or other interests that become relevant when the individual is an executive, employee, spokesperson, or brand ambassador.

Federal copyright law offers an avenue for addressing third-party AI impersonation when the impersonating content reproduces or incorporates copyrighted material owned by the company or another rights holder. Copyright owners may pursue infringement claims directly against the source of the content or through the Digital Millennium Copyright Act (DMCA) to address online infringement with the platforms or hosts of the content. The DMCA’s notice-and-takedown process applies when AI-generated content copies or incorporates protected works, such as preexisting photographs, videos, sound recordings, or other copyright-protected material that has been used to create the synthetic media. That process can provide a practical mechanism to remove infringing material hosted by service providers, and it may be especially useful where the creator is anonymous, foreign, or difficult to identify.

Trademark and unfair competition law can add another layer of federal protection or liability: Under Section 43(a) of the Lanham Act, an individual – particularly a public figure – may assert a false endorsement claim where AI-generated content deploys their identity in a way likely to mislead consumers about sponsorship, endorsement, or affiliation.

Taken together, these doctrines give rights holders meaningful tools against both direct actors and the platforms that facilitate impersonation. However, they have some limitations: For example, right-of-publicity protections vary widely from state to state, trademark claims generally require a likelihood of consumer confusion, and copyright protects expressive works rather than personal identities that may be embodied in a particular copyright-protected work. States have begun to fill such gaps by enacting AI-specific impersonation and digital-replica laws.

State Law Landscape

States have begun regulating AI impersonation through two principal approaches: criminal prohibitions on harmful impersonation and expanded right-of-publicity protections for digital replicas and voice clones. These AI-specific laws exist alongside broader federal and state consumer protection laws, which may also apply where AI-generated content deceives consumers regarding endorsement, affiliation, sponsorship, or approval.

AI-Generated Deepfakes Intended to Harm an Individual

New Hampshire’s Fraudulent Use of Deepfakes law (RSA 638:26-a) and Washington’s SHB 1205 impose criminal penalties for certain harmful AI-generated impersonations. New Hampshire makes it a Class B felony to knowingly create, distribute, or present a “deepfake,” defined as digitally altered video, audio, or other media that falsely depicts an identifiable person as saying or doing something they never said or did, for the purpose of embarrassing, harassing, entrapping, defaming, extorting, or otherwise causing financial or reputational harm. Washington state similarly prohibits the knowing distribution of a “forged digital likeness” of an identifiable individual when presented as genuine and distributed with the intent to defraud, harass, threaten, intimidate, or further other unlawful conduct.

These statutes highlight that the creation of realistic synthetic media depicting real people without their consent is one of the principal misuse risks associated with generative AI systems.

AI-Generated Voice Clones and Digital Replicas (Right of Publicity)

Several states have expanded existing right-of-publicity protections or enacted new laws to address AI-generated voice clones and digital replicas. Unlike the criminal impersonation laws discussed above, these laws generally focus on the unauthorized commercial use of an individual’s identity, including their voice, image, likeness, or other recognizable attributes.

In New York, Sections 50 and 51 of the New York Civil Rights Law prohibit the use of a person’s name, portrait, picture, or voice for advertising or trade purposes without written consent and provide a private right of action for violations. Although those provisions long predate generative AI, the Southern District of New York held last year, in Lehrman & Sage v. Lovo, Inc., that these provisions can apply to claims arising from the creation and commercialization of AI-generated voice clones.¹ In doing so, the court signaled that traditional right-of-publicity principles may provide a viable cause of action for AI-enabled impersonation even absent AI-specific legislation.

Other states have instead enacted AI-specific right-of-publicity legislation. Arkansas (Act 159), Montana (HB 513), Washington (SSB 5886), and Utah adopted laws extending publicity-right protections to unauthorized digital replicas, though the scope and mechanics of each vary. Utah’s Unauthorized Artificial Intelligence Impersonation Amendments (SB 271), for example, extend existing protections to simulated or artificially recreated personal identities and restrict certain technologies designed to create unauthorized commercial uses of an individual’s identity.

Tennessee’s Ensuring Likeness, Voice, and Image Security (ELVIS) Act goes a step further. In addition to extending right-of-publicity protection to an individual’s voice, including AI-generated voice simulations, the Act imposes liability not only for unauthorized uses of a person’s voice or likeness, but also for making available technology whose primary purpose is producing an identifiable individual’s voice or likeness without authorization. Moreover, a platform can be held liable under this statute for distribution or transmission of AI-generated impersonations following receipt of notice that the content is not authorized by the impersonated individual. See, e.g., Tenn. Code Ann. § 47-25-1105 (“A person is liable to a civil action if the person publishes, performs, distributes, transmits, or otherwise makes available to the public an individual’s voice or likeness, with knowledge that use of the voice or likeness was not authorized by the individual”).

The Federal Horizon

In May 2025, President Trump signed the Take It Down Act, which criminalizes the knowing publication of nonconsensual intimate imagery – including AI-generated “digital forgeries” – and requires covered platforms to establish a notice-and-takedown process for removing such content within 48 hours of a valid request. The reach of the Act is narrower than the laws discussed above, as it targets sexually explicit or intimate depictions published without consent, but it does not create a private cause of action or otherwise address other kinds of commercial, fraudulent, and reputational impersonations made possible by generative AI. The Act complements a range of other state laws (not discussed in detail here) that deal with AI-generated digital forgeries of nonconsensual intimate imagery.

The proposed NO FAKES Act (S. 4591) is broader, in that it would give individuals an affirmative right to control the creation and use of AI-generated digital replicas of their voice or likeness without limitation as to the nature of the content. That right could be licensed, allowing individuals to authorize others to create or use a replica on specified terms. Anyone who produces or distributes a replica without such authorization could face civil liability. Platforms that knowingly host unauthorized replicas could also be liable, subject to a Digital Millennium Copyright Act (DMCA)-style notice-and-takedown process. The bill exempts uses implicating First Amendment interests, such as news reporting and satire, and would preempt future state digital-replica laws while preserving existing ones, like Tennessee’s ELVIS Act.

The bill has bipartisan support. The Senate Judiciary Committee unanimously advanced it on June 18, 2026, and it now awaits a full Senate vote, while a companion bill remains pending in the House (H.R. 2794).

Practical Steps for Companies to Take

Companies should be aware of compliance risks when using their own generative AI solutions – for example, in marketing campaigns – while also understanding their rights if they see AI impersonation of their own companies or employees in the marketplace. Here are a few steps to take:

• Conduct pre-deployment and periodic testing of generative AI targeted to the risk profile of its use. If generative AI is being used for public-facing communications, consider testing whether a system can be prompted to generate a realistic, unauthorized voice clone or digital replica of an identifiable individual, and reassess as models and use cases evolve. Guardrails should be implemented to control any identified risks. (Note that using AI-generated replicas in marketing should be reviewed for other advertising compliance issues, including Federal Trade Commission issues, state labeling and disclosure requirements,² and other deceptive advertising law compliance.)
• Document authorization when an individual’s identity is intentionally used. When knowingly using a specific person’s voice or likeness, such as a licensed voice actor or brand ambassador, keep records of consent and the scope of permitted uses.
• Extend acceptable use restrictions to expressly cover impersonation. If your company is using generative AI, ensure that terms of acceptable use and terms of service prohibit using the system to impersonate, harass, defraud, defame, or otherwise harm an identifiable individual.
• Establish a complaint review and response process. Maintain a process for receiving impersonation complaints and promptly addressing them, and keep an eye on legislation like the proposed NO FAKES Act, which would create more expansive legal obligations.
• Monitor for potential AI impersonation of your company or organization in the marketplace, and understand potential remedies. Companies face risks from AI impersonation – including impersonation of top executives and individuals associated with the company – and should monitor potentially fraudulent and deceptive activities and understand potential remedies when issues arise.

Footnotes

1. Opinion & Order, Lehrman et al. v. Lovo, Inc., 24-CV-3770 (S.D.N.Y. July 10, 2025).

2. For example, N.Y. Gen. Bus. Law § 396-b (McKinney) (requiring disclosure of any use of a “synthetic performer” in advertisements).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.