What the NO FAKES Act addresses in current draft form
In its most recently circulated drafts, the Nurture Originals, Foster Art, and Keep Entertainment Safe Act (NO FAKES Act) would establish a federal civil right against unauthorized production, publication, distribution, or other making available of a digital replica of an individual’s voice or visual likeness. A digital replica is framed as a newly created, computer-generated, highly realistic electronic representation that is readily identifiable as the person, appearing in a sound recording or audiovisual work in which that individual did not actually perform or appear.
Drafts also contemplate post-mortem protection for a defined period after death and consent or license pathways for authorized use. Online platforms that store or host user-directed material would face notice-and-removal style duties for alleged unauthorized replicas, with potential safe-harbor style limitations if they act expeditiously after valid notice. Remedies discussed in draft materials include civil damages (including statutory damage options in some versions), injunctive relief, and attorney’s fees under defined conditions.
First Amendment-oriented exceptions and exclusions appear in the bill text, covering categories such as certain news reporting, commentary, criticism, satire or parody, documentaries, biographical works, and bona fide advertisements for those works, subject to statutory conditions. Draft language on safe harbors, damages, preemption, and exception scope has varied and may change. Compliance programs should track a specific bill version and date rather than secondary summaries, and should not treat pending text as operative law.
How a federal digital-replica right relates to existing U.S. obligations
A federal NO FAKES framework would sit alongside, not automatically erase, state right-of-publicity and deepfake regimes. States already address nonconsensual intimate imagery, political deepfakes, and commercial misappropriation of name, likeness, or voice in different ways. Until final preemption language and case law exist, enterprises should assume multi-jurisdiction exposure and design controls to the stricter practical standard across the markets they serve.
Copyright remains a separate interest. Copyright does not by itself grant a general right to control one’s face or voice as personality attributes. Right-of-publicity claims and proposed digital-replica rights protect different interests than copyright in underlying works or training data. Organizations that clear copyright for source media still need identity-linked authorization when synthesizing a real person’s voice or appearance.
Platform terms, advertising and endorsement rules, employment releases, and vendor contracts already constrain synthetic identity use in many enterprises. The practical governance task is to map product generation and distribution workflows to this layered stack: proposed federal civil liability, existing state publicity and deepfake laws, copyright where applicable, and contractual platform or customer requirements.
Practical takeaway: Clear copyright for source media does not substitute for identity-linked authorization when synthesizing a real person’s voice or appearance.
Enterprise workflows that create digital-replica risk
Material risk concentrates where systems can synthesize or clone voices, faces, or performances and where outputs can be published, sold, used operationally, or relied on as authentic. Common paths include text-to-speech and voice conversion, face reenactment, lip-sync, full-body avatars, and multimodal video generation used for marketing, learning content, entertainment, customer support agents, internal communications, or influencer-style campaigns.
Risk increases when reference samples from employees, customers, talent, or public figures enter fine-tunes, adapters, prompt libraries, or vendor tools without scope-limited licenses. Downstream distribution multiplies exposure: CMS and DAM exports, social and ad platforms, partner channels, and model-hosted demos can each republish an unauthorized replica after the original generation event. Procurement and shadow AI use of consumer-grade cloning tools can bypass central review if inventory and tool permissions are incomplete.
Detection alone is not a control strategy. Classifiers and spoof detectors are probabilistic and can false-positive or false-negative. They support triage when paired with human legal review, authorization evidence, and rapid containment. Provenance signals such as content-credentials manifests can record model, operator, and edit history, but they do not prove that the depicted person authorized the replica.
Governance practices while the bill remains pending
Treat NO FAKES as proposed federal civil exposure layered onto current obligations. Assign joint ownership among AI governance, legal and privacy, brand safety, security incident response, and records teams. Distinguish product compliance (prevent unauthorized generation and publication) from trust-and-safety response (detect and remove third-party deepfakes affecting the enterprise or its stakeholders).
- Inventory generative identity surfaces: Catalog enterprise and vendor systems capable of voice cloning, face generation, or performance synthesis, including data flows for reference samples and outputs.
- Require documented, scoped consent: Obtain written licenses or releases before using employee, influencer, customer, or third-party biometric or reference media, and match use to licensed channels and duration.
- Default-deny identity synthesis: Configure product and marketing tooling so models cannot accept celebrity or non-consented identity references without override and recorded approval.
- Operationalize incident playbooks: Predefine intake criteria, legal review, containment, platform notices, evidence preservation, complainant response, and erroneous-takedown restoration.
- Flow obligations into vendors: In AI content contracts, require digital-replica prohibitions, consent documentation, audit rights, takedown cooperation, and indemnity aligned to enterprise standards.
- Align retention with litigation and privacy: Retain consent, model logs, and takedown records long enough for discovery and regulatory needs without violating employee or consumer privacy limits.