By Joshua J. Horowitz · Originally published July 23, 2019 · Update note added October 2026
The law has continued to develop since this post was written.
Deepfakes. In 2023, New York amended Penal Law § 245.15 to cover intimate images “created or altered by digitization,” commonly called deepfakes.
Federal law. The TAKE IT DOWN Act, signed in May 2025, makes it a federal crime to knowingly publish nonconsensual intimate images, including AI-generated ones. Since May 19, 2026, it has also required covered online platforms to remove reported images within 48 hours of a valid request, with enforcement by the Federal Trade Commission. Federal law also gives victims a civil cause of action, 15 U.S.C. § 6851, enacted in 2022.
The technical proof questions discussed below, such as tracing an upload made through a VPN or Tor, are as relevant as ever. The original post follows, edited only to remove an outdated closing line.
Today, New York’s ‘Revenge Porn’ bill was officially signed into law by Governor Cuomo. The bill is laudable for its effort to give victims of revenge porn a sword (or several) to hold accountable those who have violated their most intimate privacy rights. If you’re not familiar with the term, revenge porn is essentially the distribution of sexually explicit images or video of an individual without their consent. In many cases, the explicit content may have been consensually recorded, but then the breakdown of a relationship leads to a release of the content into the wild wild web without consent.
The good news is that New York’s newly enacted law empowers victims by criminalizing the dissemination of revenge porn and creating civil remedies for victims. The first change comes by way of a new section added to the New York Penal Law, § 245.15. This section makes it a class A Misdemeanor (which in NY is a crime punishable by up to one year in jail) to unlawfully disseminate or publish an intimate image. From a criminal law perspective, there are a lot of nuances to this new section which I’m not going to cover today (maybe in a separate post).
In terms of civil remedies, the law adds a new section to Article 5 of the Civil Rights Law, the Right of Privacy at § 52-b, which is entitled, “private right of action for unlawful dissemination or publication of an intimate image.” This new section gives revenge porn victims an opportunity to bring a civil action for injunctive relief (essentially getting the content removed), punitive damages, compensatory damages and reasonable court costs and attorney’s fees. Interestingly, the law provides that even a “threat[] to disseminate or publish” can be sufficient to bring a civil claim. The law also contains a provision establishing jurisdiction over websites that host or transmit content “viewable in this state” for the purpose of getting a court order to have the content removed. That’s an extremely broad definition that covers just about any site available online.
From a technical proof perspective, there will be a number of issues that will undoubtedly arise in these cases. As an example, in order to establish civil liability, a victim must be able to show that the person they are suing “disseminated or published” (unless they’re suing under the threat theory – in which case the victim’s damages will likely be significantly lower) the video or image. To do that, you’d probably need to obtain IP address records from the place or account where the video was uploaded, then try to establish the subscriber for the IP address. But what if the person used a VPN or TOR to upload the video? It will be a lot more difficult to trace who “disseminated or published” the video. Will it be enough for the victim to put in an affidavit claiming that the only other soul who had a copy of the video was the person they’re suing?
These are all questions that courts will grapple with once we start seeing litigation brought under this new section. The law is effective 60 days from the date of its enactment (60 days from today, July 23, 2019).
This article is for general information and is not legal advice. Reading it does not create an attorney-client relationship.