Safe harbor for generation services

(1) A generation service is not liable under Section 13-72b-202 if the generation service demonstrates that: (a) the generation service does not hold itself out as providing services for creating counterfeit intimate images; (b) the generation service has implemented and maintains a written policy that: (i) prohibits the generation and distribution of non-consensual counterfeit intimate images; (ii) includes reasonable safeguards designed to prevent the creation of counterfeit intimate images; and (iii) includes procedures for responding to reports of violations; (c) the generation service acted in accordance with the policy described in Subsection (1)(b) with respect to the alleged violation; (d) the generation service published the policy described in Subsection (1)(b) in a clear and conspicuous location accessible to the public on the generation service's website or primary user interface; (e) the generation service published a general description of the reasonable safeguards described in Subsection (1)(b)(ii), which may describe technical measures in general terms without disclosing proprietary implementation details that could be exploited to circumvent the safeguards; (f) the generation service implemented and maintained a consent system that complies with Subsection 13-72b-201(3); and (g) upon receiving notice that a counterfeit intimate image was created or distributed without consent, the generation service took prompt action to prevent further distribution. (2) A generation service qualifies for the safe harbor under Subsection (1) even if a non-consensual counterfeit intimate image was distributed through the service if the generation service demonstrates that: (a) the generation service had no actual knowledge that the image was created or distributed without consent before receiving notice; (b) the generation service's consent system was operating as designed; (c) the generation service reasonably relied on information provided through the consent system; and (d) upon discovering the violation, the generation service took prompt action to prevent further distribution. (3) A generation service that has implemented and maintains a written policy and reasonable technical safeguards that categorically prevent the generation of intimate images by the service is not required to comply with the consent requirements in Subsections (1)(b), (1)(c), (1)(e), (1)(f), (2)(b), and (2)(c) to qualify for safe harbor protection under this section. (4) In determining whether a generation service qualifies for safe harbor protection under this section, the court shall, among other relevant factors, consider whether the generation service's safeguards and policies: (a) are consistent with widely accepted industry standards; (b) are regularly updated to address emerging technologies and methods for creating counterfeit intimate images; (c) include technical measures to detect and prevent the generation of counterfeit intimate images; and (d) include reasonable measures to ensure that users are not attempting to circumvent the safeguards. (5) A generation service may assert the safe harbor protections under this section by motion before trial and is not required to proceed to trial to establish eligibility for the safe harbor.