Colorado SB 25-288 (Intimate Digital Depictions Criminal & Civil Actions)

• Authority: Colorado
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2025-06-02

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• False or misleading information
• Fraud, scams, and targeted manipulation

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Exposure to toxic content

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document primarily addresses risks in the domains of Privacy & Security (2.1 - privacy compromise through unauthorized disclosure), Misinformation (3.1 - false/misleading deepfakes), and Malicious Actors (4.3 - fraud and manipulation through synthetic intimate imagery). Coverage is concentrated on protecting individuals from AI-generated intimate depictions used for harassment, extortion, or exploitation. The document does not address AI system safety, socioeconomic impacts, or most other risk domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Educational Services
• Arts, Entertainment & Recreation
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This is a cross-sectoral law that applies broadly to any person who discloses intimate digital depictions, regardless of sector. However, it includes specific exemptions and provisions for the Information sector (interactive computer services, telecommunications services, broadcasters) and implicitly addresses harms that could occur across all sectors. It is not sector-specific legislation but rather general criminal and civil law.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding state statute (Colorado SB 25-288) that creates new criminal offenses (misdemeanors and felonies) and civil causes of action with mandatory language, specified penalties, court enforcement, and damages. It includes both criminal sanctions and civil remedies enforceable through the Colorado court system.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Colorado General Assembly; Colorado State Legislature
• Summary: This is a Colorado Senate Bill (SB 25-288) which indicates it was proposed and enacted by the Colorado General Assembly through the standard legislative process.

Target

• Entity Types: AI_User, AI_Developer, Affected_Stakeholder
• Entities: Any person who discloses intimate digital depictions; Individuals who create intimate digital depictions; Depicted individuals (victims)
• Summary: The law targets any person age 18 or older who discloses intimate digital depictions without consent. It also addresses those who create such depictions and provides protections for depicted individuals. Technology providers and broadcasters have specific exemptions.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Colorado courts; Colorado Attorney General; Law enforcement agencies; Prosecutors
• Summary: Enforcement occurs through both civil court actions (where depicted individuals can sue) and criminal prosecution. The Attorney General is authorized to adopt rules for implementation.

Monitor

• Summary: The document does not specify any formal monitoring body or oversight mechanism. Enforcement is complaint-driven through civil actions and criminal prosecution rather than proactive monitoring.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document focuses primarily on the Deploy and Operate/Monitor stages of the AI lifecycle, specifically addressing the disclosure and distribution of AI-generated intimate digital depictions. It does not cover planning, design, data collection, model building, or validation stages. The legislation regulates the use and dissemination of generative AI outputs rather than the development process.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• Generative AI

Technical Scope Summary

The document explicitly defines and focuses on 'generative AI' as a subset of artificial intelligence used to create new content. It also mentions 'image editing software' and 'computer-generated' means. The document does not distinguish between frontier AI, general purpose AI, task-specific AI, foundation models, or address compute thresholds. The focus is on the outputs (intimate digital depictions) rather than model architecture or capabilities.