Tennessee Preventing Deepfake Images Act (Tenn. Code Ann. §§ 39-17-1901 to -1906): AI Compliance Requirements

Never transfer, publish, distribute, or make accessible an AI-generated or digitally altered intimate depiction of an identifiable individual without that individual's consent to the DISCLOSURE specifically. Tennessee treats creation consent and disclosure consent as different things: § 39-17-1903(c)(1) states that an individual's consent to the creation of the depiction "does not establish that the individual consented to its disclosure." Consent is deemed validly given only if it is set out in an agreement written in plain language and signed knowingly and voluntarily by the depicted individual, AND that agreement includes a general description of the intimate digital depiction and, where applicable, the visual work into which it will be incorporated (§ 39-17-1903(c)(2)). A generic model release or blanket terms-of-service acceptance therefore will not carry the burden. Liability attaches on intentional disclosure where the discloser knows of, or recklessly disregards, the absence of consent — recklessness is enough, so the absence of a signed instrument is itself the exposure.

Labelling synthetic intimate content as fake does not protect you in Tennessee. Both the civil and criminal provisions say so expressly and in identical terms: § 39-17-1904(f) provides that it is not a defence to a civil action, and § 39-17-1906(c) that it is not a defence to prosecution, that there is "a disclaimer stating that the intimate digital depiction of the depicted individual was unauthorized or that the depicted individual did not participate in the creation or development of the material." This matters directly to AI product design, because provenance watermarking, C2PA-style content credentials and "AI-generated" badges are widely treated as a sufficient mitigation — under this Act they mitigate nothing on the intimate-depiction path. Product and trust-and-safety teams should treat consent verification, not labelling, as the controlling control, and should not let a labelling feature justify relaxing an intimate-content block.

If you operate an interactive computer service as defined in 47 U.S.C. § 230, or an information service or telecommunications service as defined in 47 U.S.C. § 153, Tennessee gives you an express, narrow immunity — and it is worth structuring moderation to stay inside it. Under § 39-17-1905 (civil) and § 39-17-1906(d) (criminal), such a provider is not liable on account of: any action voluntarily taken in good faith to restrict access to or availability of intimate digital depictions; any action taken to enable or make available to information content providers or other persons the technical means to restrict access to such depictions; or any content provided by another person in violation of the part. Note the boundary — the shelter covers third-party content and good-faith restriction, so it does not extend to depictions the service itself creates or develops. A provider whose own generative feature produces the depiction is an information content provider as to that output and falls outside the safe harbour. Document good-faith moderation and takedown practice, and keep first-party generation logically distinct from third-party hosting.