Alabama HB168: What the Synthetic Media Law Means for Child Protection

On October 1, 2024, Alabama’s House Bill 168 (HB168) became law, extending the state’s existing prohibitions on child sexual abuse material (CSAM) to cover artificial intelligence (AI)-generated synthetic content depicting anyone under 18.

The legislation came at a moment of accelerating harm: a 2024 survey by Thorn found that 1 in 10 US minors aged 9 to 17 report knowing peers who have used AI tools to generate explicit images of other children. Alabama’s AI child content law, enacted in 2024, treats synthetic media as legally equivalent to real material under the state criminal code. This article explains what HB168 prohibits, how its penalties work, and what the law means for platforms operating in Alabama.

What does Alabama HB168 prohibit regarding synthetic media?

HB168 amends Sections 13A-6-240 and 13A-12-190 through 13A-12-198 of the Alabama Code, incorporating AI-generated and algorithmically synthesised sexual content within the same prohibitions that govern real child sexual abuse material. The law covers any synthetic depiction, regardless of whether a real child was involved or whether the output is photorealistic, as long as the depicted person is under 18. From October 2024, the “it was AI-generated” argument carries no legal weight under Alabama state law.

What synthetic content does the law cover?

Under the amended Alabama criminal code, the prohibitions cover producing, possessing with intent to distribute, displaying for sale, and distributing sexually explicit synthetic media depicting a minor. This includes content generated by image-generation tools, video deepfake applications, or any algorithm that creates a realistic depiction of a person under 18 in a sexual context. The word “synthetic” in HB168 extends to altered real footage as well as entirely computer-generated content. The law’s scope is deliberately broad. Content that would qualify as CSAM if it depicted a real, photographed child now qualifies equally when the minor is AI-fabricated.

School and institutional requirements

HB168 also directs local school boards to adopt written policies prohibiting AI-generated, private, explicit, or pornographic imagery involving students. Schools operating in Alabama must have these policies in place as a condition of compliance with state law. The requirement places obligations on district administrators in addition to individuals, acknowledging that educational settings are one of the primary environments where peer-to-peer synthetic media abuse occurs. Alabama’s 2024 child deepfake legislation was designed to reach institutional actors, not only individual perpetrators.

What are the penalties under Alabama HB168 for AI-generated child content?

Alabama HB168 creates two parallel tracks of liability, covering criminal prosecution under the amended CSAM code and a standalone civil claim, and both apply from October 1, 2024. The civil track is the more unusual element. It creates a private right of action allowing victims to pursue compensatory and punitive damages without waiting for a criminal prosecution to conclude.

HB168’s scope covers any visual depiction of a minor created or modified through AI, including photorealistic images generated from text prompts, deepfake video overlays, and digitally altered photographs. The law does not require that a real child be involved in the underlying source material. A purely synthetic depiction of a realistic-looking minor meets the legal threshold. This provision directly closes the gap that older CSAM statutes left open, where prosecutors had to connect content to a specific, identifiable victim.

On the criminal side, the Alabama minor synthetic media criminal law extends the existing CSAM framework under amended Sections 13A-12-190 through 13A-12-198. Violations carry felony-level charges. HB168 also raised the maximum age threshold for covered offences, expanding protection for a broader class of persons under the state’s criminal code.

The civil track creates a private right of action covering three categories of defendant: individuals who commit crimes involving the possession of synthetic CSAM, parents or guardians who permit a child to participate in producing such material, and individuals who directly produce it. Plaintiffs may recover full actual damages, court costs, and attorney fees. Where clear and convincing evidence establishes that a defendant acted with conscious deliberation, wantonness, or malice, punitive damages are also available. That combination of actual and punitive exposure makes Alabama’s deepfake CSAM law one of the most aggressive civil liability frameworks for synthetic child content currently in force in any US state.

How Alabama’s law fit the national child protection picture?

Alabama’s deepfake child protection measures were part of a broader legislative push that accelerated sharply in 2024 and 2025. The scale of the underlying problem explains the pace. Across US states and at the federal level, lawmakers moved to close the enforcement gap that had allowed AI-generated content to avoid the legal consequences that applied to photographed material.

As of 2025, 45 US states have enacted laws criminalising AI-generated or computer-edited CSAM, with most of that legislation passing in 2024 and 2025. The National Center for Missing and Exploited Children (NCMEC) documented a 1,325% increase in AI-CSAM CyberTipline reports between 2023 and 2024, rising from approximately 4,700 to 67,000 reports, according to Thorn’s analysis of NCMEC data. The Internet Watch Foundation (IWF) tracked an even steeper trajectory in video content, identifying 3,443 AI-generated child sexual abuse videos in 2025, against 13 the previous year, a 26,385% increase in a single year.

The federal response came in May 2025. The TAKE IT DOWN Act, signed on May 19, 2025, established a national floor for deepfake child protection by criminalising the knowing publication of nonconsensual intimate images of minors and requiring covered platforms to remove flagged content within 48 hours of a valid notice. Alabama’s HB168 predates the federal law by eight months and goes further on civil liability, meaning platforms operating in Alabama face obligations under both the state statute and the federal act.

The IWF’s data also shows that girls account for 97% of AI-generated CSAM subjects and that 65% of the videos identified in 2025 were classified at the most severe level under UK law. These figures underline that deepfake child protection in Alabama, and in other states that have passed similar statutes, is responding to a real and measurable harm pattern, not a theoretical risk. The Financial Action Task Force (FATF) Horizon Scan report on AI and deepfakes further documents how AI-generated content is being used to circumvent identity and safeguarding controls in regulated environments, reinforcing the urgency behind HB168’s design.

How Shufti helps platforms detect AI-generated synthetic media?

For platform operators and compliance teams reviewing exposure under HB168 and the TAKE IT DOWN Act, the practical question is what technical controls demonstrate that a platform took reasonable steps to prevent or detect synthetic child content. Shufti addresses this through two overlapping capabilities, deepfake detection and age verification, both directly relevant to the Alabama deepfake CSAM law and the federal 48-hour takedown standard.

Shufti’s deepfake detection covers 56+ anti-spoofing attack vectors, including AI-generated faces, face-swap outputs, video injection attacks, and replay attacks, at a false acceptance rate below 0.001. Platforms integrating this layer gain automated detection against the categories of synthetic media most commonly documented in AI-CSAM reporting. Shufti is a DHS RIVR 2025 top performer, validated across diverse demographic profiles. For an operator that needs to demonstrate due diligence under state or federal law, government-grade validation matters as a documentary record.

For platforms where minor access is a live compliance risk, Shufti’s age verification combines document-based age extraction with biometric age estimation. Each verification event produces an auditable record that establishes a platform took a documented, reasonable step before granting access. For any operator reviewing its position under HB168, that audit trail is the difference between demonstrable due diligence and an absence of evidence.