Is It Illegal to Make AI Images of People?

The Legal Landscape: A Fast-Moving Patchwork of Federal and State Laws

Here's the plain truth: no federal law flatly bans making AI images of people. Legality hinges on three things — what the image depicts, why it was made, and where it gets published — and the rules are changing faster than most teams can track them.

The pace of new legislation is remarkable. According to Ballotpedia's legislative tracking, 47 of 50 states now have at least one deepfake law, with 64 new laws enacted in 2025 alone — a 23% jump over the same period in 2024. Fully 82% of all state deepfake laws passed since 2019 were enacted in just the last two years. A MultiState policy analysis notes lawmakers in every state introduced some form of sexual deepfake bill in 2025.

The federal government has now acted too. The TAKE IT DOWN Act, signed May 19, 2025, criminalizes distributing nonconsensual intimate deepfakes — including content "created entirely by AI if it falsely depicts a real person" — and requires platforms to remove reported content within 48 hours. Penalties reach 2 years imprisonment for adult victims and 3 years for minors, per deepfake law tracking. The first conviction under the Act came in April 2026, when an Ohio man was convicted for AI-generating nonconsensual intimate images.

Notably, several states now criminalize creation itself, not just distribution. Legal analyses of state statutes highlight a pattern with real teeth:

• Alabama HB161 criminalizes both creating and distributing a private image without consent.
• New Hampshire HB 1432 makes knowingly creating an identifiable person's deepfake a Class B felony.
• Pennsylvania Act 35 carries fines up to $15,000 and 7 years for felony deepfake use.

There's a constitutional counterweight: federal courts struck down California's broad political deepfake laws as too sweeping, while disclosure-based requirements have largely survived. And a Senate attempt to preempt state AI regulation with a 10-year moratorium failed 99–1, leaving the state patchwork fully enforceable.

For businesses, the practical question is shifting, as attorney-reviewed analysis puts it, "from 'can I do this?' to 'can I defend it?'" Companies can even face liability for deepfakes created on their networks. That makes vetting the AI tools and agent workflows your team deploys a compliance matter, not just a technical one — the kind of verification SkillzBench is building its free skills directory and MCP connector to support.

Skills, proven.

When AI Images of People Cross the Line: Three Legal Red Zones

Most people assume the law only punishes sharing harmful AI images. In reality, three clusters of law now reach the creation itself — and each one carries real penalties.

Red zone one: nonconsensual intimate imagery. The federal TAKE IT DOWN Act, signed in May 2025, criminalizes distributing AI-generated intimate images that falsely depict a real person — and victims don't need to prove any reputational or financial harm. Penalties run up to two years imprisonment for adult victims and three years for minors, and the first conviction already landed in April 2026, when an Ohio man was convicted for AI-generating nonconsensual intimate images, according to legal tracking of deepfake statutes. States go further: Alabama's HB161 criminalizes creating a private image without consent, and New Hampshire's HB 1432 makes knowingly creating a deepfake of an identifiable individual a Class B felony. One statutory principle deserves special attention: prior consent to create an image is not consent to publish it.

Red zone two: political and election deepfakes. By August 2026, 33 states regulated political deepfakes, up from 21 in early 2025. The constitutional limits here are real, though — federal courts struck down California's broad prohibitions as content-discriminatory, suggesting laws must target false speech causing "legally cognizable harms" like voter interference or intimidation. Disclosure requirements have largely survived where outright bans failed.

Red zone three: right of publicity. Your likeness is increasingly treated as property. Tennessee's ELVIS Act grants every individual a property right in their name, photograph, voice, and likeness; New York extends protection to synthetic media, even posthumously; and Illinois protects against unauthorized digital replicas. The pending NO FAKES Act would create a federal property right in voice and visual likeness.

• Federal TAKE IT DOWN Act: up to 2–3 years imprisonment, with a 48-hour platform takedown requirement
• Alabama and New Hampshire criminalize the act of creation itself, not just distribution
• 33 states now regulate political deepfakes, though courts demand narrow tailoring
• Tennessee's ELVIS Act treats your likeness as property — and the NO FAKES Act may federalize that

For businesses adopting AI image tools, the practical takeaway is that liability can attach even when you didn't build the offending tool — companies can be held liable for deepfake harassment created on their networks. That makes vetting what your AI agents and workflows can actually access a compliance issue, not just a technical one; SkillzBench is building a free directory that security-scans and benchmarks agent skills so teams can see what they're deploying before something crosses a legal line.

What's Still Legal: Parody, Consent, and Why Labeling Protects You

The good news is that courts have drawn a clear line: laws that ban speech outright keep failing, while laws that simply require disclosure keep winning. That distinction is now the single most important thing to understand if you create AI images of real people.

California proved the point. Its political deepfake law AB 2839 was struck down by federal courts as too broad and content-discriminatory, with judges suggesting rules must be narrowly tailored to "false speech that causes legally cognizable harms" like voter intimidation. Yet analysis of deepfake legislation shows disclosure-based requirements have largely survived where prohibition-style laws failed. Telling people an image is AI-generated is constitutionally safer than banning the image itself.

Parody and satire also remain broadly protected. Creative works depicting real people are generally allowed as long as it's clear they're not real — which is exactly why labeling matters so much. In Pennsylvania, Act 35 criminalizes deepfakes created with fraudulent or injurious intent (up to $15,000 in fines and seven years for felony use), but a clear disclaimer serves as an affirmative defense under the state's law, according to HALOCK's legislative review.

The stakes climb quickly for anyone publishing internationally. The EU AI Act's Article 50 mandates labeling of AI-generated content, with fines reaching up to 6% of global turnover for violations. For businesses operating across borders, disclosure isn't just good practice — it's a hard legal requirement.

Practical takeaway: treat labeling as your strongest legal shield.

• Label every AI-generated image of a real person clearly and prominently.
• Get consent before generating any image of an identifiable individual — likeness is increasingly treated as property.
• Keep parody obviously parody; ambiguity is where liability lives.
• Document your intent and disclosure practices so you can prove them later.

The practical standard is shifting, as attorney-reviewed guidance puts it, from "can I do this?" to "can I defend it?" A labeled, consented image is defensible; an unlabeled one is a gamble. For teams running AI image workflows, that defense starts with knowing exactly which tools and agent skills touch your content — something SkillzBench is building to make verifiable, with its free skills directory and MCP connector currently in development.

Your Compliance Playbook: Practical Rules for People and Businesses

Knowing the law is one thing; operationalizing it is another. The shift, as one legal analysis puts it, is "from 'can I do this?' to 'can I defend it?'" — and that means building consent, labeling, and policy into your workflows before anyone clicks generate.

Rule 1: Get explicit consent before generating identifiable people. Consent is not implied, and it doesn't matter whether the person is a public figure or whether their photo was publicly available, per attorney-reviewed guidance. Remember that prior consent to create an image does not equal consent to publish it. And under laws like Alabama's HB161, creation itself can be a crime, not just distribution, according to a deepfake legislation analysis.

Rule 2: Label AI content clearly. Disclosure requirements have survived constitutional challenges where outright bans failed, and in Pennsylvania a disclaimer serves as an affirmative defense. If you operate in Europe, this isn't optional — the EU AI Act mandates labeling with fines up to 6% of global turnover.

Rule 3: Never use synthetic images deceptively in commerce or politics. The FTC treats undisclosed synthetic endorsements and fake reviews as deceptive practices, with civil penalties up to $53,088 per violation, and it has already sent warning letters to 15 major platforms. State election laws add their own restrictions near voting periods.

For businesses, the stakes extend beyond what your marketing team creates:

• Companies can be liable for deepfake harassment created on their networks — even if they didn't build the tool, per legal tracking research.
• Liability is expanding to anyone who "knowingly facilitates" violations, including platforms and hosting services.
• Deepfake incidents surged 257% in 2024, so exposure grows every quarter you wait.

That means a written workplace policy covering AI image tools isn't bureaucratic overhead — it's risk management. Spell out what's permitted, require consent documentation, and mandate labeling in your style guide.

The same discipline applies to AI agents. As teams deploy agents that generate and handle images, vetting which skills and tools those agents can access becomes part of your compliance posture — especially given published research finding roughly 26% of agent skills carry at least one vulnerability. SkillzBench is building a free skills directory and MCP connector (waitlist open) specifically to help teams verify what their agents use before it touches real people's likenesses. Compliance in the AI era is a supply-chain problem — and your image pipeline is only as safe as its weakest skill.