TwinEthos homeAPI access

Law

Utah Abuse of Personal Identity Act (Utah Code 45-3, as amended by SB 271 (2025) and SB 256 (2026))

Utah (private civil action by the individual or right holder) · Utah (US-UT) · 3 provisions encoded · verified against the official source as of 2026-10-04.

Informational data, not legal advice. Summaries and rules have not been reviewed by a lawyer: always verify official law text for decisions. A suggested guard is intended to address each rule; adding it is not a statement of compliance to that law.

Official text: le.utah.gov.

Trust and provenance 3 official sources · last verified 4 Oct 2026 · not reviewed by a lawyer · 3 of 3 provisions audit-grade · release 2026.10.05

Where this instrument's data comes from, how current it is, and what has and has not been checked. Each provision below has its own panel.

Official sources
Lanes
Binding law — in force 3
Verification
Sources last verified 4 Oct 2026; each provision states how.
Data release
Data release 2026.10.05, data as of 4 Oct 2026, schema 0.3.10.
Legal review
None of the 3 provisions has been reviewed by a lawyer; no TwinEthos rule has been legally reviewed yet. Treat each as research to check against the official text; it is not legal advice. Open questions for counsel on them: 3.
Audit standard
3 of 3 provisions audit-grade. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
Detectors
3 detectors, all experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify. Each provision lists its detectors' known limits.
Changes
  • 2026.10.05 (5 Oct 2026): 3 provisions added

Each data release records which provisions changed; the full list is on Changes.

Binding law — in force

Do not distribute a tool whose intended primary purpose is unauthorized AI identity content (Utah Code 45-3-3(2)(c))

Utah Code 45-3-3(2)(c) · official text · In force: applies since 7 May 2025 · Utah (US-UT)

A person abuses an individual's personal identity if it knowingly distributes, sells or licenses any technology, software or tool whose intended primary purpose is the unauthorized creation or modification of content that includes an individual's personal identity (Utah Code 45-3-3(2)(c), as amended by SB 256, effective 2026-05-06; from 2025-05-07 to 2026-05-06 under SB 271 the abuse was limited to content 'for commercial purposes'). Personal identity is an individual's picture, portrait, visual or video likeness, voice or audiovisual appearance, including any simulation, reproduction or artificial recreation by generative AI or other technology; 'voice' includes a computer-generated sound readily attributable to the individual. Only the individual or a right holder may consent to a replication. Detect a voice-clone or face-swap tool with no authorization gate on whose voice or face it reproduces.

Trust and provenance not reviewed by a lawyer · audit-grade · source verified 4 Oct 2026 · release 2026.10.05
Lane
Binding law — in force In force: applies since 7 May 2025
Official source
Utah Code 45-3-3(2)(c) · captured 4 Oct 2026 · anchor hash (SHA-256) 61003d41338a… · 8 more anchors in the data release
Verification
Quoted text found word for word in the captured official document (4 Oct 2026). Source last verified 4 Oct 2026: checked against the captured official document; not in the weekly watcher's list; checked against the captured document.
Data release
Data release 2026.10.05, data as of 4 Oct 2026, schema 0.3.10.
Legal review
Not reviewed by a lawyer. TwinEthos derived this rule from the official text it cites: treat it as research to check against that text; it is not legal advice. No TwinEthos rule has been legally reviewed yet. Open questions for counsel on this rule: 1.
Audit standard
Audit-grade: meets all 10 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
Detectors

1 detector (code pattern), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.

Known limits:

  • Authorization enforced at account onboarding outside the module
  • Hosted cloning APIs whose own verification (e.g. voice captcha) is configured in a vendor console
  • Liability turns on the tool's intended primary purpose (unauthorized creation of an identified person's likeness) and the distributor's knowledge; general-purpose editors need human judgment.

Who it applies to

  • Duty falls on: provider, distributor
  • Persons who knowingly distribute, sell or license technology, software or tools whose intended primary purpose is the unauthorized creation or modification of content including an individual's personal identity (picture, likeness, voice or audiovisual appearance, including AI simulations), where Utah law governs. Applied from 2025-05-07 to tools for commercial purposes (SB 271); the current wording, without that limit, applies from 2026-05-06 (SB 256). The tool's intended primary purpose and the distributor's knowledge are human determinations.
  • Not covered:
    • Use in connection with a news, public affairs or sports broadcast, including its promotion and advertising, or an account of public interest (45-3-7(1)(a))
    • A representation of the individual as the individual in a documentary or a historical or biographical work, unless it creates the false impression of the individual's authentic participation (45-3-7(1)(b))
    • A work of political, public interest or newsworthy value, including comment, criticism, parody, satire, scholarship or a transformative creation (45-3-7(1)(c))
    • Fleeting or incidental uses (45-3-7(1)(d))
    • An advertisement or commercial announcement for a work described in 45-3-7(1) (45-3-7(1)(e))
    • An interactive computer service (47 U.S.C. 230(f)(2)) for content provided by another person (45-3-7(3))
  • Whether it applies depends on facts outside the code; a person has to decide.

The guard to add

Gate the clone or swap feature so it reproduces only voices and faces whose owner is verified or licensed, and reject references that target other identifiable people.

An authorization check at the entry point of the likeness tool (the clone, enroll, or swap endpoint), before the reference sample reaches voices.ivc.create, speaker_wav=, inswapper, or a lip-sync or reenactment model. It accepts a reference only when the requester is the verified owner (speaker verification or a spoken voice captcha matched to the sample) or a likeness license or rights-holder record covers that person, and it rejects references that match a celebrity or public-figure blocklist. The authorization id is stored with the created voice or face model so every later generation traces back to it.

Where it goes: 1 application source code, 2 data models, 6 API calls and integrations.

What this provision adds:

  • Apply the authorization gate to simulations and artificial recreations of a person's voice or likeness (sound-alikes and look-alikes), not only to clones built from that person's recordings or photos.
  • Accept authorization only from the individual or a right holder (an executor, successor, heir, assignee, licensee or devisee); for a deceased individual the right lasts 70 years after death.

Example (FastAPI + Coqui XTTS), before:

@app.post('/clone')
async def clone(sample: UploadFile, text: str = Form(...)):
    path = save_upload(sample)
    tts.tts_to_file(text=text, speaker_wav=path, language='en', file_path='out.wav')
    return FileResponse('out.wav')

After:

@app.post('/clone')
async def clone(sample: UploadFile, text: str = Form(...), user=Depends(current_user)):
    path = save_upload(sample)
    if celebrity_blocklist.matches_voice(path):
        raise HTTPException(403, 'reference voice matches a protected public figure')
    owner = voice_ownership.verify(user.id, path)   # spoken captcha + speaker match
    if not owner.verified:
        raise HTTPException(403, 'only your own verified voice can be cloned')
    tts.tts_to_file(text=text, speaker_wav=path, language='en', file_path='out.wav')
    audit.record('voice_clone', user_id=user.id, voice_authorization_id=owner.id)
    return FileResponse('out.wav')

Control: AI tool whose primary purpose is producing an identifiable person's likeness/voice without authorization. The same guard addresses 5 items with binding law in 4 jurisdictions. Engineering guidance, not legal advice.

Rule id ut-sb271.identity-replication-tool-distribution · review status: primary source derived

Binding law — in force

Do not make available an unauthorized AI identity simulation without a clear simulation disclosure (Utah Code 45-3-3(2)(b), (5))

Utah Code 45-3-3(2)(b) · official text · In force: applies since 6 May 2026 · Utah (US-UT)

From 2026-05-06 (SB 256), a person abuses an individual's personal identity if it publishes, performs, distributes, transmits or otherwise makes available to another person the individual's personal identity with actual knowledge that the use was not authorized by the individual (if living), a minor's legal guardian, or the individual's executors, successors, heirs, assignees, licensees or devisees (for up to 70 years after death) (Utah Code 45-3-3(2)(b)). There is no abuse under (2)(b) if the content is accompanied by a clear and conspicuous disclosure that it is a simulation or artificial recreation of the individual (45-3-3(5)). Detect generation features that publish or share cloned voices or swapped faces with neither an authorization check nor a simulation label.

Trust and provenance not reviewed by a lawyer · audit-grade · source verified 4 Oct 2026 · release 2026.10.05
Lane
Binding law — in force In force: applies since 6 May 2026
Official source
Utah Code 45-3-3(2)(b) · captured 4 Oct 2026 · anchor hash (SHA-256) ef4b4e0327c0… · 6 more anchors in the data release
Verification
Quoted text found word for word in the captured official document (4 Oct 2026). Source last verified 4 Oct 2026: checked against the captured official document; not in the weekly watcher's list; checked against the captured document.
Data release
Data release 2026.10.05, data as of 4 Oct 2026, schema 0.3.10.
Legal review
Not reviewed by a lawyer. TwinEthos derived this rule from the official text it cites: treat it as research to check against that text; it is not legal advice. No TwinEthos rule has been legally reviewed yet. Open questions for counsel on this rule: 1.
Audit standard
Audit-grade: meets all 10 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
Detectors

1 detector (code pattern), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.

Known limits:

  • Labels applied in a video editor or by the hosting platform outside the repository
  • Authorization checked at account onboarding in another service
  • The label may be burned in by a rendering service or applied by the publishing platform in another file; check the export path. Knowledge that a use is unauthorized is a fact outside the code.

Who it applies to

  • Duty falls on: any person
  • Any person who publishes, performs, distributes, transmits or otherwise makes available an individual's personal identity (including AI simulations) with actual knowledge that the use was not authorized, where Utah law governs; applies from 2026-05-06 (SB 256). A product that publishes or shares generated likenesses meets it by an authorization record or a clear and conspicuous simulation disclosure on the content. Actual knowledge is a human determination.
  • Not covered:
    • Use in connection with a news, public affairs or sports broadcast, including its promotion and advertising, or an account of public interest (45-3-7(1)(a))
    • A representation of the individual as the individual in a documentary or a historical or biographical work, unless it creates the false impression of the individual's authentic participation (45-3-7(1)(b))
    • A work of political, public interest or newsworthy value, including comment, criticism, parody, satire, scholarship or a transformative creation (45-3-7(1)(c))
    • Fleeting or incidental uses (45-3-7(1)(d))
    • An advertisement or commercial announcement for a work described in 45-3-7(1) (45-3-7(1)(e))
    • An interactive computer service (47 U.S.C. 230(f)(2)) for content provided by another person (45-3-7(3))
    • Content accompanied by a clear and conspicuous disclosure that it is a simulation or artificial recreation of the individual (45-3-3(5))
  • Whether it applies depends on facts outside the code; a person has to decide.

The guard to add

Gate the clone or swap feature so it reproduces only voices and faces whose owner is verified or licensed, and reject references that target other identifiable people.

An authorization check at the entry point of the likeness tool (the clone, enroll, or swap endpoint), before the reference sample reaches voices.ivc.create, speaker_wav=, inswapper, or a lip-sync or reenactment model. It accepts a reference only when the requester is the verified owner (speaker verification or a spoken voice captcha matched to the sample) or a likeness license or rights-holder record covers that person, and it rejects references that match a celebrity or public-figure blocklist. The authorization id is stored with the created voice or face model so every later generation traces back to it.

Where it goes: 1 application source code, 2 data models, 6 API calls and integrations.

What this provision adds:

  • Where no authorization from the individual or a right holder is on record, attach a clear and conspicuous disclosure that the content is a simulation or artificial recreation of the individual before it is published or shared.
  • For a minor, authorization comes from the legal guardian; for a deceased individual, from the executors, successors, heirs, assignees, licensees or devisees for up to 70 years after death.

Example (FastAPI + Coqui XTTS), before:

@app.post('/clone')
async def clone(sample: UploadFile, text: str = Form(...)):
    path = save_upload(sample)
    tts.tts_to_file(text=text, speaker_wav=path, language='en', file_path='out.wav')
    return FileResponse('out.wav')

After:

@app.post('/clone')
async def clone(sample: UploadFile, text: str = Form(...), user=Depends(current_user)):
    path = save_upload(sample)
    if celebrity_blocklist.matches_voice(path):
        raise HTTPException(403, 'reference voice matches a protected public figure')
    owner = voice_ownership.verify(user.id, path)   # spoken captcha + speaker match
    if not owner.verified:
        raise HTTPException(403, 'only your own verified voice can be cloned')
    tts.tts_to_file(text=text, speaker_wav=path, language='en', file_path='out.wav')
    audit.record('voice_clone', user_id=user.id, voice_authorization_id=owner.id)
    return FileResponse('out.wav')

Control: AI tool whose primary purpose is producing an identifiable person's likeness/voice without authorization. The same guard addresses 5 items with binding law in 4 jurisdictions. Engineering guidance, not legal advice.

Rule id ut-sb271.unauthorized-identity-made-available · review status: primary source derived

Informational data, not legal advice. Summaries are TwinEthos's own words and rules have not been reviewed by a lawyer: check the official text before relying on any of it. A guard addresses an item; adding it is not a statement that your code meets any law.