A friend texted me last week with a question I have been getting a lot lately. She had just watched a fake video of a celebrity hawking a crypto scam, and she wanted to know one simple thing. "If someone did that with my face, is it even illegal where I live?" I started to answer, then stopped. Because the honest answer is that it depends entirely on which state you happen to wake up in.

That bothers me. Your face does not change when you cross a state line. Your right to it should not either. But right now, the protection you have against someone cloning your likeness is basically a patchwork, and most people have no idea which patch they are standing on.

So let me give you the lay of the land as it actually stands in the middle of 2026, because the map has been filling in fast.

Here is the encouraging part. Forty-six states now have laws on the books addressing sexually explicit deepfakes, according to the team at MultiState, which tracks this legislation week by week. Thirty states now regulate deepfakes in political ads, up from 28 at the start of the year. Two years ago those numbers were a fraction of that. The wall is being built, brick by brick, and faster than I expected when we started writing about this.

The trouble is the gaps between the bricks. A law that covers fake intimate images might do nothing about a fake video of you endorsing a product you have never heard of. A law that polices political deepfakes during an election might go quiet the day after. And four states still have no specific deepfake statute at all, which means a victim there is stuck stretching old defamation and harassment laws to cover a problem those laws were never written for.

I have watched people try to do exactly that, and it is exhausting. It is the legal equivalent of using a butter knife to change a tire. You might get there, but you will be miserable the whole way, and you will wonder why nobody handed you the right tool.

The good news is that the right tools are starting to appear. Connecticut just gave victims of synthetic intimate images a private right of action, meaning you can take the person to court yourself rather than waiting on a prosecutor, building on a law the state's attorney general first championed back in 2015. Washington's new digital likeness law takes effect June 10, and I broke down what it actually changes in my piece on Washington making your face harder to steal. Ohio moved in the same direction this spring, which I covered in our look at Ohio protecting digital likeness rights.

Then there is the federal layer, which is where things get interesting. The TAKE IT DOWN Act became law in May 2025, and as of May 19 this year it forces covered platforms to pull non-consensual intimate images within 48 hours of a valid request. The DEFIANCE Act, which the Senate passed unanimously back in January, would let victims of sexually explicit forgeries sue for statutory damages starting at $150,000 per violation, climbing to $250,000 when the deepfake is tied to stalking or assault, according to the Senate Judiciary Committee. It is still waiting on the House, so it is not law yet, but the direction is unmistakable.

If you are wondering what those numbers translate to in a real courtroom, I walked through the practical math of suing a deepfaker in a separate post on whether you can actually sue and what you can recover. And if you are sitting there right now realizing you would not even know what to do first, start with our step-by-step guide for when someone deepfakes you. Save it somewhere. I hope you never need it.

Here is what I keep coming back to. The law is moving in the right direction, and that genuinely gives me hope after years of feeling like the technology was running unopposed. But the law moves at the speed of legislatures, and the fakes move at the speed of a download. A statute passing in your state next year does nothing for the video that goes up tonight. The map is filling in, just not fast enough to be your whole plan.

So know where your state stands, because that knowledge is power when something goes wrong. And then do the thing the law cannot do for you, which is get out ahead of it. If you want a clear read on how exposed you actually are, take our free 2-minute Deepfake Risk Assessment. It will not change the laws in your state, but it will tell you exactly where you stand today, and that is a better place to start than a text from a worried friend.