Are Deepfakes Illegal in the US? An Enterprise Guide to Federal and State Deepfake Laws

Is it illegal to make a deepfake in the US?

Making a deepfake is legal in most circumstances. Film studios, advertisers and app users create synthetic faces and voices every day. The law steps in when the content is sexual and nonconsensual, when it deceives voters, when it is used to defraud, or when it exploits a person's likeness or voice commercially without permission.

At federal level, the TAKE IT DOWN Act (Public Law 119-12, signed 19 May 2025) makes it a crime to knowingly publish nonconsensual intimate images, including digital forgeries, and requires covered platforms to remove valid reports within 48 hours. Making a sexual deepfake without sharing it is not a federal crime, although many states criminalise it. The proposed DEFIANCE Act would add a federal civil claim against people who produce such forgeries; it passed the Senate on 13 January 2026 but has not been enacted.

Fraud statutes do not care whether the lie is told with a real voice or a cloned one. Wire fraud, identity theft and computer misuse charges apply to a deepfake-assisted scam just as they would to a traditional one.

Which US states have deepfake laws?

Almost all of them. Ballotpedia's tracker reported on 30 July 2026 that 49 states had passed at least one deepfake law since 2019. Forty-eight states had laws on sexual deepfakes (up from 45 a year earlier) and 33 regulated political deepfakes (up from 28 in July 2025). By the end of July 2026, states had enacted 58 deepfake bills that year, against 64 at the same point in 2025.

State laws fall into three broad groups. Sexual-deepfake laws add synthetic imagery to existing revenge-porn or child-abuse offences, sometimes with a civil claim. Election laws typically require a disclosure on synthetic media about candidates within a window before a vote, or allow candidates to seek an injunction. Likeness and voice laws extend the right of publicity; Tennessee's ELVIS Act, in force since 1 July 2024, explicitly covers simulated voices.

The details differ enough that a national employer or platform cannot rely on a single policy. Disclosure windows, exceptions for satire and news, and who can sue vary state by state.

Is AI voice cloning legal?

Cloning a voice with the speaker's consent is legal. Cloning it without consent becomes unlawful through how it is used. The FCC's Declaratory Ruling of 8 February 2024 confirmed that AI-generated voices are artificial voices under the Telephone Consumer Protection Act, so robocalls using them need the called party's prior express consent. In September 2024 the FCC fined the organiser of the New Hampshire primary robocalls, which used a cloned presidential voice, $6 million under the Truth in Caller ID Act.

Commercial use of someone's voice without authorisation can breach state right-of-publicity laws, and Tennessee's ELVIS Act was written specifically for simulated voices. Using a cloned voice to impersonate a bank, government agency or other business can violate the FTC Impersonation Rule, and using it to obtain money is fraud. Contact centres should treat a caller's voice as an unreliable identity factor and add call-level detection, such as NeuroCall (Beta), alongside callback and step-up checks.

How should enterprises track US deepfake laws?

Track the laws through the processes they affect. A deepfake law is relevant to a company only where synthetic media can enter or leave its workflows. Map each rule to one of those workflows, give it an owner and record what evidence would show the company met the duty.

A practical register has these columns, maintained by legal with input from security, fraud and trust and safety teams.

• Workflow affected: customer onboarding, account recovery, contact centre, payment approval, user uploads, marketing, political advertising.
• Instrument and jurisdiction, with the bill stage recorded separately from the date the duty becomes enforceable.
• Duty holder: the company as platform, as advertiser, as employer or as regulated financial institution.
• Required evidence: removal timestamps, disclosure records, consent logs, detection results, reviewer decisions, SAR references.
• Review trigger: new state session laws (most take effect on 1 January or 1 July), federal enforcement actions and agency guidance.

What do US banks and fintechs need to know about deepfake fraud reporting?

Financial institutions have the most structured obligations. FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, describes fraud schemes that use deepfake media to defeat identity verification, lists red flags such as identity photos that show signs of alteration, photos that do not match other identifying information, and suspicious behaviour during live verification checks, and asks institutions to use the key term FIN-2024-DEEPFAKEFRAUD when they file a suspicious activity report related to the alert.

The alert does not create a duty to report every suspected deepfake. It does mean that when detection flags a synthetic selfie or a manipulated video call during onboarding, the result, the reviewer's decision and the case reference belong together in the file that supports any SAR.

Where Neural Defend fits in a US deepfake compliance program

Each Neural Defend product produces evidence for a different workflow. NeuroVerify checks a face image, video or audio clip for deepfakes and manipulation in one API call across six signals and returns a unified risk score with signal-level evidence, so onboarding and account recovery decisions can be documented. NeuroCall (Beta) addresses cloned voices in calls. NeuroDetect is the forensic workspace for investigations, takedown disputes and litigation holds, with case files that keep model and version context and exportable reports that record uncertainty and analyst notes.

On the public VendorBench-100 benchmark of 36 systems on 100 adversarial still images, Neural Defend ranked first with an MCC of 0.876, against 0.646 for the next-best vendor; the benchmark does not measure audio or video. Deployment options include managed cloud, private cloud or VPC, secure container, on-premises and air-gapped, and Neural Defend holds SOC 2 Type II and ISO/IEC 27001, 27701 and 42001 certifications.

Detection does not make a company compliant with any statute. It supplies the record that shows what was checked, when and with what result, so counsel can decide whether a legal duty was triggered.