Requires synthetic content creations system providers to include provenance data on synthetic content produced or modified by a synthetic content creations system that such provider makes available.
STATE OF NEW YORK
________________________________________________________________________
6540--E
Cal. No. 163
2025-2026 Regular Sessions
IN ASSEMBLY
March 5, 2025
___________
Introduced by M. of A. BORES, CUNNINGHAM, KELLES, FORREST, CHANDLER-WA-
TERMAN, TORRES, OTIS, DURSO -- read once and referred to the Committee
on Science and Technology -- committee discharged, bill amended,
ordered reprinted as amended and recommitted to said committee --
reported and referred to the Committee on Codes -- reported and
referred to the Committee on Rules -- Rules Committee discharged, bill
amended, ordered reprinted as amended and recommitted to the Committee
on Rules -- committee discharged, bill amended, ordered reprinted as
amended and recommitted to said committee -- ordered to a third read-
ing, amended and ordered reprinted, retaining its place on the order
of third reading -- again amended on third reading, ordered reprinted,
retaining its place on the order of third reading
AN ACT to amend the general business law, in relation to requiring
synthetic content creations system providers to include provenance
data on synthetic content produced or modified by a synthetic content
creations system that the synthetic content creations system provider
makes available
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. This act shall be known and may be cited as the "stop deep-
2 fakes act".
3 § 2. The general business law is amended by adding a new article 45-C
4 to read as follows:
5 ARTICLE 45-C
6 STOP DEEPFAKES ACT
7 Section 1550. Definitions.
8 1551. Synthetic content creations system.
9 1552. Content provenance preservation.
10 1553. Provenance data requirements.
11 1554. Enforcement by attorney general.
12 § 1550. Definitions. For the purposes of this article:
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD07930-26-6
A. 6540--E 2
1 1. "Provenance data" means data that records the origin or history of
2 digital content and is communicated as a content credential or via
3 another substantially similar method, pursuant to either the Technical
4 Specification for Content Credentials published by the Coalition for
5 Content Provenance and Authenticity, or pursuant to relevant standards,
6 guidelines or specifications which adopt generally accepted security
7 best practices and are published by an established standards setting
8 body. Such data must at a minimum communicate: (a) information about
9 the origin or creation of the content; (b) subsequent editing or modifi-
10 cation to the content or its metadata; and (c) use of a synthetic
11 content creations system in generating or modifying the content. Such
12 data shall be cryptographically bound to the underlying file and use
13 signing credentials whenever the medium of the synthetic content permits
14 such binding credentials. "Provenance data" shall not include personal
15 information as defined in subdivision five of section two hundred two of
16 the state technology law, or unique device, system, or service informa-
17 tion that is reasonably capable of being associated with a particular
18 user, including but not limited to an internet protocol address, unless
19 a user chooses to include such personal information in such data
20 described in paragraph (a), (b), or (c) of this subdivision.
21 2. "Generative artificial intelligence system" means a class of arti-
22 ficial intelligence system that is self-supervised and emulates the
23 structure and characteristics of input data to generate derived synthet-
24 ic content, including, but not limited to, images, videos, audio, text,
25 and other digital content.
26 3. "Synthetic content" means audio or visual content that has been
27 generated or materially modified by a synthetic content creations
28 system.
29 4. "State agency" has the same meaning as defined in subdivision six
30 of section two hundred two of the state technology law.
31 5. "Synthetic content creations system provider" means an organization
32 or individual that creates, codes, substantially modifies, or otherwise
33 produces a synthetic content creations system that is made publicly
34 available for use by a New York resident, regardless of whether the
35 terms of such use include compensation.
36 6. "Synthetic content creations system hosting platform" means an
37 online repository or other website, other than the synthetic content
38 creations system provider, that makes a synthetic content creations
39 system available for use by a New York resident, regardless of whether
40 the terms of such use include compensation. Synthetic content creations
41 system hosting platform does not include a cloud computing platform or
42 other service insofar as such cloud computing platform or other service
43 makes synthetic content creations systems available for use by a New
44 York state resident solely at the direction of others.
45 7. "Social media platform" shall have the same meaning as in section
46 eleven hundred of this chapter.
47 8. "Artificial intelligence" or "artificial intelligence technology"
48 means a machine-based system that can, for a given set of human-defined
49 objectives, make predictions, recommendations, or decisions influencing
50 real or virtual environments, and that uses machine- and human-based
51 inputs to perceive real and virtual environments, abstract such percep-
52 tions into models through analysis in an automated manner, and use model
53 inference to formulate options for information or action.
54 9. "Synthetic content creations system" means a class of generative
55 artificial intelligence system capable of generating wholly synthetic
56 content.
A. 6540--E 3
1 10. "File-sharing platform" means an online service for which a prima-
2 ry function is to enable users to upload files and make such files
3 available for access, discovery, or download by users who did not create
4 or collaborate in creating the content, including through public links,
5 browsing interfaces, or similar distribution features.
6 11. "Mass messaging platform" means a public-facing direct messaging
7 platform that allows users to distribute content to more than one
8 hundred users simultaneously.
9 12. "Large online platform" means a social media platform, file-shar-
10 ing platform, mass messaging platform, or stand-alone search engine that
11 distributes content to users who did not create or collaborate in creat-
12 ing the content. A "large online platform" does not include:
13 (a) broadband, broadband service or broadband internet, as defined in
14 paragraph (b) of subdivision two of section sixteen-gg of the New York
15 state urban development corporation act, as added by section two of part
16 MMM of chapter fifty-eight of the laws of two thousand twenty-two; or
17 (b) a telecommunications service, as defined in section 153 of title
18 47 of the United States code.
19 (c) Any infrastructure as a service or platform as a service, as those
20 terms are defined in the National Institute of Standards and Technolo-
21 gy's Special Publication 800-145, and any subsequent version of such
22 publication.
23 § 1551. Synthetic content creations system. 1. A synthetic content
24 creations system provider shall apply provenance data, either directly
25 or through the use of third-party technology, to synthetic content
26 produced or modified by a synthetic content creations system that the
27 synthetic content creations system provider makes available; provided,
28 however, that this obligation shall not apply to the extent the synthet-
29 ic content creations system performs an assistive function for standard
30 editing or does not substantially alter the input data provided by the
31 deployer or the semantics thereof.
32 2. The application of provenance data to synthetic content, as
33 required by this section, shall, at a minimum, identify the digital
34 content as synthetic and communicate the following provenance data:
35 (a) that the content was created or edited using artificial intelli-
36 gence;
37 (b) the name of the synthetic content creations system provider;
38 (c) the time and date the provenance data was applied;
39 (d) to the extent technically feasible, the specific portions of the
40 content that the synthetic content creations system generated; and
41 (e) the type of device, system, or service that was used to generate
42 the image, audio, or video.
43 3. Synthetic content creations system hosting platforms shall not make
44 available a synthetic content creations system where the hosting plat-
45 form knows that the synthetic content creations system provider for such
46 system does not apply provenance data to content created or substantial-
47 ly modified by the artificial intelligence system in a manner consistent
48 with specifications set forth in this section, nor shall a synthetic
49 content creations system hosting platform deliberately prevent a
50 synthetic content creations system provider from applying provenance
51 data to content created or substantially modified by a synthetic content
52 creations system in a manner consistent with the specifications set
53 forth above.
54 4. The provisions of this section shall only apply to synthetic
55 content creations systems that were created or modified after the effec-
56 tive date of this article.
A. 6540--E 4
1 § 1552. Content provenance preservation. 1. A large online platform
2 shall not delete, disassociate, or degrade, in whole or in part, prove-
3 nance data from or associated with content uploaded to the large online
4 platform, unless and until such content is permanently deleted or
5 removed from the large online platform or the deletion, disassociation,
6 or degradation of such content is required by law. Nothing in this arti-
7 cle shall be construed as prohibiting users from choosing to include
8 personal information in provenance data from or associated with such
9 uploaded content.
10 2. (a) A large online platform shall be required to surface latent
11 provenance data with either content that is an image, video, or audio,
12 or content that is any combination thereof, that is:
13 (i) Clear, conspicuous, appropriate for the medium of the content and
14 understandable to a reasonable natural person; and
15 (ii) Permanent or extraordinarily difficult to remove or modify.
16 (b) Such surfacing of latent provenance data shall include, to the
17 extent such information is available and reliable in conformance with
18 security best practices via the provenance data, the following informa-
19 tion:
20 (i) Whether or not the content was created or modified using a
21 synthetic content creations system;
22 (ii) The name of the synthetic content creations system provider used,
23 if any;
24 (iii) The time and date the provenance data was applied;
25 (iv) The type of device, system, or service that was used to generate
26 the image, audio, or video;
27 (v) The name of the tool used to apply the provenance data; and
28 (vi) The specific portions of the content that the synthetic content
29 creations system generated, if any.
30 (c) This subdivision shall not apply to file sharing platforms that
31 are designed primarily for file storage or collaboration within a
32 defined organization, workspace, or group of users in which access to
33 files is limited through permission-based or invitation-only controls,
34 or where content is not routinely surfaced or distributed to the general
35 public, nor shall this subdivision apply to mass messaging platforms
36 that are designed primarily for communication within a defined organiza-
37 tion, workspace, or group where participation is limited through permis-
38 sion-based or invitation-only controls and where messages on such plat-
39 form are not routinely distributed or surfaced to the general public.
40 § 1553. Provenance data requirements. 1. A state agency shall ensure,
41 to the extent practicable either through direct application or through
42 the use of third-party technology, that all audio, images and videos
43 published or distributed electronically by the state agency carry prove-
44 nance data.
45 2. The application of provenance data to audio, images and videos, as
46 required by this article, shall, at a minimum, communicate the following
47 provenance data:
48 (a) The type of device, system, or service that was used to generate
49 the audio, image or video, to the extent the device, system, or service
50 has the technical capability to do so;
51 (b) The specific portions of the content that the synthetic content
52 creations system used by the state agency generated, if any;
53 (c) Whether the content was created or edited using artificial intel-
54 ligence;
55 (d) The name of the synthetic content creations system provider used
56 to generate the synthetic content, if any; and
A. 6540--E 5
1 (e) The time and date any of the provenance data delineated in this
2 section was applied.
3 § 1554. Enforcement by attorney general. In addition to the other
4 remedies provided, whenever there shall be a violation of this article,
5 application may be made by the attorney general in the name of the
6 people of the state of New York to a court or justice having jurisdic-
7 tion by a special proceeding to issue an injunction, and upon notice to
8 the defendant of not less than five days, to enjoin and restrain the
9 continuance of such violations; and if it shall appear to the satisfac-
10 tion of the court or justice that the defendant has, in fact, violated
11 this article, an injunction may be issued by such court or justice,
12 enjoining and restraining any further violation, without requiring proof
13 that any person has, in fact, been injured or damaged thereby. In any
14 such proceeding, the court may make allowances to the attorney general
15 as provided in paragraph six of subdivision (a) of section eighty-three
16 hundred three of the civil practice law and rules. Whenever the court
17 shall determine that a violation of this article has occurred, the court
18 may impose a civil penalty of not more than twenty-five thousand dollars
19 for each violation.
20 § 3. This act shall take effect on the one hundred eightieth day after
21 it shall have become a law.
