Utah H.B. 276 (2026: digital voyeurism, content provenance)

Example (c2pa-python), before:

image = pipe(prompt).images[0]
image.save(out_path)

After:

image = pipe(prompt).images[0]
image.save(raw_path)
manifest = {
  'claim_generator_info': [{'name': 'acme-image-service', 'version': '2.3.0'}],
  'assertions': [
    {'label': 'c2pa.actions', 'data': {'actions': [{'action': 'c2pa.created',
      'digitalSourceType': 'http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia',
      'when': datetime.now(UTC).isoformat()}]}},
    {'label': 'com.acme.provenance', 'data': {'system': 'acme-image', 'system_version': '2.3.0', 'content_id': str(uuid.uuid4())}}]}
builder = c2pa.Builder(manifest)
with open(raw_path, 'rb') as src, open(out_path, 'w+b') as dst:
    builder.sign(signer, 'image/png', src, dst)   # signer from our load_c2pa_signer()

Example (c2pa-python), before:

image = pipe(prompt).images[0]
image.save(out_path)

After:

image = pipe(prompt).images[0]
image.save(raw_path)
manifest = {
  'claim_generator_info': [{'name': 'acme-image-service', 'version': '2.3.0'}],
  'assertions': [
    {'label': 'c2pa.actions', 'data': {'actions': [{'action': 'c2pa.created',
      'digitalSourceType': 'http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia',
      'when': datetime.now(UTC).isoformat()}]}},
    {'label': 'com.acme.provenance', 'data': {'system': 'acme-image', 'system_version': '2.3.0', 'content_id': str(uuid.uuid4())}}]}
builder = c2pa.Builder(manifest)
with open(raw_path, 'rb') as src, open(out_path, 'w+b') as dst:
    builder.sign(signer, 'image/png', src, dst)   # signer from our load_c2pa_signer()

Example (FastAPI + OpenAI SDK (images.edit)), before:

@app.post('/edit')
async def edit(photo: UploadFile, prompt: str = Form(...)):
    img = await photo.read()
    result = client.images.edit(model='gpt-image-1', image=('photo.png', img), prompt=prompt)
    return {'b64': result.data[0].b64_json}

After:

@app.post('/edit')
async def edit(photo: UploadFile, prompt: str = Form(...)):
    img = await photo.read()
    data_url = 'data:image/png;base64,' + base64.b64encode(img).decode()
    mod = client.moderations.create(model='omni-moderation-latest', input=[
        {'type': 'text', 'text': prompt},
        {'type': 'image_url', 'image_url': {'url': data_url}}]).results[0]
    if mod.categories.sexual or mod.categories.sexual_minors or csam_hash_match(img):
        raise HTTPException(422, 'request refused by content safety policy')
    result = client.images.edit(model='gpt-image-1', image=('photo.png', img), prompt=prompt)
    out = base64.b64decode(result.data[0].b64_json)
    if output_is_sexual(out) or csam_hash_match(out):
        raise HTTPException(422, 'output blocked by content safety policy')
    return {'b64': result.data[0].b64_json}

Example (FastAPI + c2pa-python), before:

@app.post('/upload')
async def upload(file: UploadFile):
    data = await file.read()
    s3.put_object(Bucket=PUBLIC_BUCKET, Key=file.filename, Body=data)

After:

@app.post('/upload')
async def upload(file: UploadFile):
    data = await file.read()
    try:
        reader = c2pa.Reader(file.content_type, io.BytesIO(data))
        provenance = json.loads(reader.json())
    except Exception:   # no manifest or unreadable
        provenance = None
    key = f'media/{uuid.uuid4()}'
    s3.put_object(Bucket=PUBLIC_BUCKET, Key=key, Body=data)   # original bytes, manifest intact
    db.media.insert(key=key, provenance=provenance, has_credentials=provenance is not None)