AI Slop Drives States to Act as Federal Rules Lag: Explained

Browse online for only a few moments and you’ll bump into “AI slop” — media created or altered by artificial intelligence, optimized to grab your attention, and mass-producible with minimal human supervision.

Generative AI tools, such as OpenAI‘s ChatGPT or xAI’s Grok, pose risks beyond fake dinner recipes, low-quality children’s programming, and other nonhuman competition disrupting consumer traffic online. They’ve also caused a swell of misleading deepfakes, including doctored sexual depictions of real people — usually women, children, and public officials.

Watch more:

Federal action to manage AI has been limited in scope.

Last May, President Donald Trump signed a nationwide ban (Public Law 119-12; BGOV Bill Analysis) on non-consensual sexually explicit images, including AI-generated forgeries. The Senate passed a follow-up bill (S. 1837) in January that would allow civil suits against those images’ creators, but the House hasn’t yet acted on it.

Neither chamber has considered any legislation to regulate AI-generated images outside the context of sexual abuse.

In that vacuum, states have moved ahead with their own rules for governing AI content.

California is scheduled to enforce new transparency standards for generative models starting Aug. 2, obligating developers to attach disclosure data to generated media and provide tools for authenticating images, among other requirements.

The law could draw a legal challenge from the Trump administration, which opposes state regulation of AI development and content standards unrelated to child safety.

Here’s what AI developers and content producers can expect.

What do California’s new rules mean for developers nationwide?

Large AI developers, whose generative models are accessible in California and have at least 1 million monthly users, are the main group affected by SB 942, as amended by AB 853.

The state laws introduce authentication and provenance standards for AI-generated or AI-altered digital materials, including images, video, and audio content.

Generative AI system hosting platforms will be barred from making noncompliant systems available in the state starting Jan. 1, 2027.

Disclosures: Latent and manifest disclosure requirements for identifying AI-generated content take effect for developers starting Aug. 2.

AI systems will have to include a latent disclosure by embedding the developer’s name, the AI system’s name and version number, the time and date of generation, and a unique identifier for any AI-generated or -altered material. Developers will have to offer authentication tools for detecting the disclosure.

AI systems also will have to give users the option to include a manifest disclosure that clearly identifies to others that content is AI-generated without use of authentication tools.

Latent and manifest disclosures must be permanent or “extraordinarily difficult” to remove. Starting Jan. 1, 2027, platforms will be prohibited from knowingly removing provenance data from content.

Detection Tools: Developers will have to offer free AI detection tools so a user can assess whether content was created or altered by the developer’s system. Users have to be able to download information about the content, the provenance data, and any digital signatures.

The tool has to work with uploaded or linked online content, and have an application programming interface. Output of the detected provenance data can’t include any personal user data.

Recording Devices: Manufacturers of “capture devices” — devices that can make photo, video, or audio recordings — will have to embed latent disclosures in content by default starting Jan. 1, 2028, in an effort to authenticate digital media.

Civil Penalties: There is potential civil liability of $5,000 per violation per day for noncompliance. The attorney general or a city attorney or county counsel would be able to sue a platform or recording device manufacturer.

What about other states’ AI content rules?

Data Provenance: Three other states have enacted data provenance laws, and two more are considering legislative proposals.

Utah requires online platforms to let users view provenance information and prohibits platforms from removing provenance data from content. It also includes similar latent disclosure and capture device requirements to California’s AI law.

Utah’s law differs from California’s by providing a safe harbor for generation services and covered platforms that implement reasonable safeguards. Utah lets the attorney general assess a $2,500 fee on top of the $5,000 civil penalty per violation per day. The law is effective for content created after May 6, and capture device requirements take effect Jan. 1, 2028.

Washington enacted a law with the same data provenance requirements as California and Utah effective Feb. 1, 2027, and Connecticut’s multi-year efforts to regulate AI include preservation of content’s data provenance information.

Data provenance requirements are also pending in Arizona and Ohio.

Deepfake Technology: Thirty-one states prohibit the use of deepfakes of minors and twenty-two states prohibit deepfakes containing sexual images, paralleling federal efforts to limit non-consensual sexually explicit images.

Twenty-six states prohibit using generative AI to imitate a political candidate’s likeness and require disclosures that content was generated by AI. Some states criminalize use of GenAI to create deepfakes — Pennsylvania added the distribution of a digitally produced likeness of a person to the crime of digital forgery.

Content Ownership: Arkansas in 2025 codified ownership rights related to GenAI content. The law says a person who provides the input or directive, or provides data or input to train the AI, owns the related content.

What federal rules regulate AI-generated media?

No federal standard exists for the authentication or provenance of AI-generated or AI-altered media. President Joe Biden issued an executive order in 2023 calling for, among other AI rules, provenance and labeling standards, but Trump rescinded it.

Rules covering AI-generated content are mostly limited to restrictions on sexually abusive forgeries. The Federal Communications Commission applies existing robocall rules to AI-generated voices, and some commercial practices regulations, such as the Federal Trade Commission’s rule against impersonation of businesses and government entities, also cover fraud using AI, according to the agency.

Deepfake Restrictions: It is a federal crime punishable by two years imprisonment — or three years for crimes against a minor — to publish any non-consensual sexually explicit image, including AI-generated forgeries indistinguishable from an authentic depiction of the subject.

An Ohio defendant in April became the first to plead guilty to publication of AI-generated digital forgeries under the federal deepfake law.

Platform Obligations: Platforms hosting user-generated content — though not email or internet service providers — must allow individuals to request removal of a sexually explicit deepfake published without the individual’s consent.

They then must remove the material within 48 hours and make reasonable efforts to remove identical copies.

The FTC began enforcing platform requirements on May 16, and noncompliance can result in civil penalties of $53,088 per violation.

What are federal lawmakers doing?

Sen. Maria Cantwell (D-Wash.), ranking member of the Commerce, Science, and Transportation Committee, sponsored a bill (S. 1396) that would mandate provenance information standards and accompanying detection tools. The FTC, states, or content owners could take action against individuals for tampering with provenance information.

House lawmakers led by Reps. Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.) plan to release a national AI framework today that would address a broad swath of issues including guardrails and state preemption. That could be the starting point for bipartisan negotiations on comprehensive AI legislation.

House leadership could also take up the Senate-passed DEFIANCE Act (S. 1837), which would allow subjects of abusive sexual deepfakes to sue for damages, including any profits plus up to $150,000, or $250,000 if the claim related to sexual assault, stalking, or harassment.