On May 1st, President Donald Trump posted an AI-generated picture of himself to Truth Social. He is floating in the reflecting pool on the National Mall on a gold inner tube, shirtless, giving a thumbs up. J.D. Vance, Marco Rubio and Doug Burgum are in the water beside him, also shirtless. A woman in a checked bikini reclines at one edge of the picture. The joke was about the money being spent repairing the pool.
From August 1st, making that picture in Minnesota could expose the company whose software produced it to a civil penalty of $500,000. Make ten of them and the exposure is $5 million. The people depicted could sue separately for triple damages, punitive damages and legal fees.
That image appears on page 19 of a complaint xAI filed on 27 July in the U.S. District Court for the District of Minnesota, asking a federal judge to stop the state’s attorney general, Keith Ellison, from enforcing House File 1606. The law is the first of its kind in the United States. It targets the software, not the people who make deepfakes or the people who spread them.
We obtained a copy of the complaint for you here.
Minnesota has a problem it is trying to solve but statute the legislature actually wrote reaches an enormous amount of ordinary, protected speech.
What HF 1606 does
The operative text is now Minn. Stat. § 325E.91. It says that a person who owns or controls a website, application, software, program or other service must not “allow a user to access, download, or use” that service “to nudify an image or video,” and must not nudify an image on a user’s behalf. A separate subdivision bans advertising or promoting such a service.
The violation belongs to the owner. The conduct belongs to the user. The person who makes the image, the person who posts it to a group chat, the person who emails it to the subject’s employer: subdivision 2 touches none of them. The statute’s entire enforcement weight lands on whoever built the tool.
“Nudify” is defined as altering or generating an image so that it depicts “an intimate part not depicted in an original unaltered image or video of an identifiable individual,” where the result is realistic enough that a reasonable person would believe the body part belongs to that person.
The whole statute turns on what counts as an intimate part. And here the legislature made a choice that will probably decide the case.
The definition that swallowed the law
For “intimate part,” HF 1606 borrows a definition from Minn. Stat. § 609.341, subdivision 5, part of Minnesota’s criminal sexual conduct code. That statute defines intimate parts to include “the primary genital area, groin, inner thigh, buttocks, or breast of a human being.”
That definition was written to determine when unwanted touching becomes criminal sexual contact. There it makes obvious sense: grabbing someone’s thigh or breast without consent is an assault regardless of what they were wearing. Transplanted into a statute about images, the same list produces something else entirely. Inner thighs are visible in shorts. Buttocks are visible in swimwear. Men’s “breasts” are visible any time a man takes his shirt off. The definition is also open-ended since the statute says the term “includes” those areas rather than limiting it to them.
The shirtless reflecting pool image is covered. So is an image a user made of a former and current governor from opposite sides of the political spectrum in a sumo match, which xAI reproduces on page 20 of its filing; both individuals’ breasts and inner thighs have been “depicted” where they were not before. So is a viral picture of Trump, Xi Jinping, Elon Musk and Tim Cook eating skewers on a Chinese street in vests and shorts.
The legislature knew about the alternative. As introduced in February 2025, HF 1606 cross-referenced Minnesota’s existing deepfake statute, which uses a much tighter list: the genitals, pubic area, anus, or a partially or fully exposed nipple. That version names discrete anatomical features rather than whole regions of the body. Lawmakers considered it and adopted the broader one instead. A court asked to save the statute by reading it narrowly will have to explain why the legislature’s deliberate rejection of the narrow definition should be undone by judicial construction.
The second definitional term is nearly as loose. An “identifiable individual” is someone identifiable “from the image itself, by the person depicted in the image, or by another person,” or from personal information displayed alongside it. The only genuine limit in the statute is realism, which means photorealistic output is regulated and cartoons are not.
The statute is silent on consent. An adult editing a photograph of themselves triggers the same liability as a stranger targeting a classmate. The omission was deliberate. When a Senate Judiciary and Public Safety Committee staffer flagged during a February hearing that the prohibition “applies to consensual images,” the bill’s Senate sponsor, Erin Maye Quade, explained “that is intentional.”
Why “just build better filters” is not an answer
The law contains no knowledge requirement, no intent requirement and no safe harbor. Liability attaches the moment a user succeeds, whatever the provider knew, prohibited or built, and no matter how hard the user worked to get around it. Senator Kreun asked during the same hearing whether anything in the bill would protect a company making best efforts to prevent prohibited generations. According to xAI’s account of the recording, the sponsor did not answer.
A modern image model has no single switch for nudity. These are diffusion or autoregressive systems, and what they produce is governed by a chain of imperfect controls: filters that scan the prompt before generation, filters that scan the input image, classifiers that inspect the output before it reaches the user, plus reinforcement training that pushes the model away from certain outputs. Those controls are all statistical, and all of them can be attacked by rephrasing, by encoding the request obliquely, by chaining innocuous edits, or by feeding the system an image that is already borderline.
Even a perfect nudity classifier would not help here, since the statute is not about nudity. A filter tuned to block explicit content will pass a picture of a man in swim trunks every time. To comply with HF 1606 as written, a provider would need a classifier that reliably detects newly visible inner thigh in photorealistic output, and it would need that classifier to be right on the first attempt, forever, across every user in Minnesota, at half a million dollars per miss.
xAI’s response has been to announce that it will restrict Grok Imagine’s editing features for Minnesota users before the law takes effect. Smaller developers would do the same, or fold. Geographic feature-blocking is the cheap option, and it is exactly what the First Amendment’s chilling-effect doctrine is meant to prevent. The Supreme Court held in Counterman v. Colorado (2023) that even unprotected categories of speech require a subjective mental-state requirement before liability can attach, and the Eighth Circuit held in Video Software Dealers Ass’n v. Webster that a statute chilling First Amendment activity must contain a knowledge element.
There is one carve-out: the prohibitions fall away where the service “requires the technical skill of a user to nudify an image,” with technical skill defined as substantial individualized technological or artistic skill and judgment by a human creator in directing, shaping or controlling the output. Photoshop, in other words, is fine. A tool anyone can use is not.
Minnesota has written a statute in which the identical image is lawful when produced by someone with training and unlawful when produced by someone without it. What the state has regulated is the democratization of image-making itself. Whatever else that is, it is a law that favors one class of creators over another, and content-based laws that sort speakers this way start at a serious constitutional disadvantage.
The case for the law, made properly
Molly Kelley learned in 2024 that a close family friend had used a nudification site to make nonconsensual deepfakes of her and other women in his life. Around 80 women in Minnesota were affected by the same perpetrator. She spent two years pushing for this bill. The Senate passed it 65-0. Governor Walz signed it. The ACLU of Minnesota, which is supposed to spend its time opposing speech restrictions, backed HF 1606 and calls it a win.
Laws keyed to distribution arrive after the harm has happened. By the time a nonconsensual image is circulating in a school, the removal process under the federal TAKE IT DOWN Act can take the image down but cannot undo its spread. Minnesota’s existing criminal deepfake statute and its civil counterpart both require the plaintiff to prove dissemination, non-consent and knowledge, which is difficult when the maker is anonymous and the distribution happens in closed groups. Targeting the tool tries to stop the image from being made at all, rather than chasing an anonymous maker after the fact.
HF 1606 cannot be enforced without examining what an image depicts. Under Reed v. Town of Gilbert (2015) that makes it content-based and presumptively unconstitutional, and it must then be narrowly tailored, serving an interest of the highest order through the least restrictive means available. Minnesota’s interest in stopping nonconsensual sexual deepfakes clears that bar, and xAI concedes it in the complaint. Tailoring is where the state runs into trouble.
What is actually at stake
Texas and California have already passed laws aimed at nudification services, but the model Minnesota chose, strict liability on the toolmaker with per-image penalties, is the most aggressive available. If it survives, it becomes the template.
The people who lose under that template are not xAI, which can afford to geofence a feature and go to court. The losers are the open-source image model with four maintainers, the small photo-editing startup that adds a background-removal feature and finds it has acquired unlimited liability, and the Minnesota user cut off from tools that everyone else in the country can use for satire, restoration of damaged family photographs, virtual staging or teaching material. RAINN, a main force behind the bill, says it consulted numerous technology companies to keep the law from creating unintended consequences for general products. The statute it produced still offers no safe harbor for a developer acting in good faith.
HF 1606 takes effect on 1 August 2026. xAI’s motion seeks preliminary and permanent injunctive relief.
