H.R. 6334: Deepfake Liability Act

Section 230 is the 1996 law that says a website generally cannot be treated as the publisher of what its users post. H.R. 6334 does not repeal it. It makes the protection conditional: a platform keeps it only while it is running a reasonable process for addressing cyberstalking and intimate privacy violations.

The bill sets a floor for what that process has to include. A platform would need a way to prevent the abuse to the extent practicable, and a clear, accessible takedown system. It would have to keep logs that preserve the data needed for legal proceedings, and it could not use that data for anything else. It would need a way to remove or block content a court has found unlawful. The Federal Communications Commission could add further requirements.

Two kinds of harm are covered. An intimate privacy violation is an intimate image obtained or shared without the consent of a person shown in it, or a sexually explicit digital forgery made or shared without that consent. The bill defines a forgery as an intimate depiction of an identifiable person that has been created, manipulated, altered, or annotated until it is virtually indistinguishable from an authentic one. Cyberstalking is a deliberate course of conduct directed at a specific person that causes substantial emotional distress or fear of bodily harm, and would do the same to a reasonable person.

The takedown system builds on a law already on the books. The TAKE IT DOWN Act, signed in 2025, requires platforms to remove nonconsensual intimate images within 48 hours of a valid request. H.R. 6334 rewrites that process so it also reaches content relating to cyberstalking. If the content depicts you or is directed at you, you could file a signed written request, and the platform would have 48 hours to remove it and make reasonable efforts to remove known identical copies.

A request has to identify the content well enough for the platform to find it, include a good-faith statement that it was published without your consent, give your contact information, and state under penalty of perjury that you are the person depicted or targeted. An authorized person can file for you. The process has limits written into it: the content must not concern a matter of public concern, and its publication must cause distress or fear that a reasonable person would also feel.

The bill's answer to AI-generated content is one phrase. Section 230 protects a platform only for content that came from someone else, not for content the platform is itself responsible for creating or developing. H.R. 6334 adds that creating or developing content includes doing so "through solicitation, encouragement, or the use of a generative model." Under that wording, a party responsible for content through any of those routes counts as its creator, not as a host of someone else's material.

The takedown process applies to any website, online service, or app that is accessible to the public, with no minimum size. Broadband providers, email, messaging services, and data storage services are excluded. A platform that removes reported material in good faith cannot be sued over the removal, even if the content later turns out to be lawful.

The bill also edits the criminal provisions of the TAKE IT DOWN Act, applying the new forgery definition there and striking one listed exception from each of the two prohibitions. The Federal Trade Commission would write the implementing rules within 180 days, consulting the FCC and, as appropriate, the Attorney General. The changes would apply to content made available on or after the date of enactment, and the bill states that none of it may be read to infringe First Amendment rights.