(1) The distribution of a counterfeit intimate image by a generation service without the consent of the identifiable individual depicted in the image is a violation of the individual's reasonable expectation of privacy.
(2) A generation service may not distribute a counterfeit intimate image without first obtaining consent from the identifiable individual depicted in the counterfeit intimate image.
(3) To obtain consent sufficient to meet the requirements of Subsection (2), a generation service shall implement and maintain a consent system that:
(a) requires the identifiable individual depicted in the counterfeit intimate image to affirmatively provide consent before the counterfeit intimate image is distributed;
(b) assures the identity of the individual providing consent with reasonable accuracy; and
(c) maintains a record of the consent for a period of not less than seven years.
(4) A generation service may not require an individual to disclose personally identifiable information beyond what is reasonably necessary to assure the individual's identity and obtain valid consent.