Binding law — in force
Obtain express written consent before publishing a realistic AI imitation of an identifiable person (Hawaii Act 247, 2026)
From 2026-07-14, it is unlawful for any person to knowingly publish a realistic digital imitation of an identifiable individual without that individual's consent (express, written permission from the individual or an authorized representative) if the imitation is used in connection with an advertisement, causes harm (reputational injury, financial loss, emotional distress or misappropriation of identity for commercial gain), or is used to commit fraud, defamation, harassment or other criminal acts (Act 247, new HRS chapter, section -2). A digital imitation is a highly realistic AI-generated depiction, audio or video derived from an actual, particular individual's identifying characteristics, portraying their voice, face or likeness in a work in which they did not perform or appear. The individual or estate (for ten years after death) may sue for an injunction, damages of up to $25,000 per advertisement or actual damages, punitive damages and fees; the attorney general may seek injunctive relief. Detect ad or publishing features that clone voices or swap faces with no consent record.
Trust and provenance not reviewed by a lawyer · audit-grade · source verified 4 Oct 2026 · release 2026.10.05
- Lane
- Binding law — in force In force: applies since 14 Jul 2026
- Official source
- Act 247 (2026), sec. 2, new HRS chapter, section -1 ('Advertisement', 'Artificial intelligence') · captured 4 Oct 2026 · anchor hash (SHA-256)
075d46c5fc42…· 7 more anchors in the data release - Verification
- Quoted text found word for word in the captured official document (4 Oct 2026). Source last verified 4 Oct 2026: checked against the captured official document; not in the weekly watcher's list; checked against the captured document.
- Data release
- Data release 2026.10.05, data as of 4 Oct 2026, schema 0.3.10.
- Legal review
- Not reviewed by a lawyer. TwinEthos derived this rule from the official text it cites: treat it as research to check against that text; it is not legal advice. No TwinEthos rule has been legally reviewed yet. Open questions for counsel on this rule: 1.
- Audit standard
- Audit-grade: meets all 10 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
- Detectors
1 detector (code pattern), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.
Known limits:
- Hosted likeness tools called only through a vendor dashboard
- Prompt-only likeness ('in the voice of <celebrity>') with a general text-to-speech or image model
- Consent may be enforced upstream (account onboarding, talent contracts); the finding asks for the record. Voices or faces of people who licensed them (stock talent) are fine with a record.
Who it applies to
- Duty falls on: any person
- Any person who knowingly publishes (displays, presents or releases to the public) a realistic AI-generated digital imitation of an identifiable individual without express written consent, where the imitation is used with an advertisement, causes harm, or is used for fraud, defamation, harassment or other crimes, to the fullest extent permitted by federal law. In force 2026-07-14. The advertising branch is the one a generation product can gate in code; harm and criminal use depend on the use and are human determinations, as is knowledge.
- Not covered:
- Parody, satire, commentary, criticism, scholarship, or political or educational expression (section -3(1))
- News reporting where the AI content illustrates a story (section -3(2))
- A representation of the individual as the individual in a documentary or a historical or biographical manner, including some fictionalization (section -3(3))
- An advertisement or commercial announcement for such content, where the imitation is relevant to the subject of the work (section -3(4))
- Any medium used for publishing or disseminating third-party content (newspapers, magazines, television, streaming, cable, transit advertisements), for its role in publishing or disseminating it (section -5(b))
- Whether it applies depends on facts outside the code; a person has to decide.
The guard to add
Check a recorded commercial-use consent or talent release for the depicted person before a generated or cloned voice or likeness is published to an ad, product, or storefront.
A consent gate on the path from the likeness generator (face swap, voice clone, identity-preserving image model) to every commercial sink: ad-platform creative uploads, product listings and storefront media, public campaign buckets, merchandise publishing. The gate looks up a consent or talent-release record for the person whose face or voice is reproduced, scoped to commercial use, refuses to publish without a live record, and stamps the asset with the release id so it can be traced and pulled later. A public-figure or celebrity filter runs before generation so references to well-known people are blocked unless a release is on file.
Where it goes: 1 application source code, 2 data models, 6 API calls and integrations, 9 AI output handling.
What this provision adds:
- Consent must be express and written, from the depicted individual or an authorized representative; store the signed permission with the generated asset.
Example (Python insightface + boto3), before:
def build_ad_creative(person_id, frame, target_face, source_face):
out = swapper.get(frame, target_face, source_face, paste_back=True)
cv2.imwrite('/tmp/ad.png', out)
s3.upload_file('/tmp/ad.png', 'campaign-public', f'ads/{person_id}.png')After:
def build_ad_creative(person_id, frame, target_face, source_face):
release = consents.get(person_id=person_id, scope='commercial')
if release is None or release.revoked_at:
raise ConsentRequired('no commercial likeness release for this person')
out = swapper.get(frame, target_face, source_face, paste_back=True)
cv2.imwrite('/tmp/ad.png', out)
s3.upload_file('/tmp/ad.png', 'campaign-public', f'ads/{person_id}.png',
ExtraArgs={'Metadata': {'talent_release_id': str(release.id)}})Control: AI-generated voice or likeness of a real person used on products or in advertising without that person's consent. The same guard addresses 5 items with binding law in 5 jurisdictions. Engineering guidance, not legal advice.
Rule id hi-hb2137.realistic-digital-imitation-consent · review status: primary source derived