This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives.
STORAGE NAME: h1459.COM
DATE: 1/24/2024
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: CS/HB 1459 Advanced Technology
SPONSOR(S): Commerce Committee, McFarland
TIED BILLS: HB 1461 IDEN./SIM. BILLS: SB 1680
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
1) Commerce Committee 20 Y, 0 N, As CS Wright Hamon
2) Appropriations Committee
3) Judiciary Committee
SUMMARY ANALYSIS
Artificial intelligence (AI) encompasses a large field of existing and emerging technologies, methodologies, and
application areas. AI is generally thought of as computerized systems that work and react in ways commonly
thought to require intelligence. The application of AI extends to areas such as natural language processing,
facial recognition, and robotics. As the use of AI technologies has grown, so too have discussions of whether
and how to regulate them. Potential regulatory options include a broad regulation of AI technologies that could
be used across sectors, or a more targeted approach, regulating the use of AI technologies in particular
sectors.
The bill:
Requires an entity or person who produces or offers for use or interaction AI content or technology for a
commercial purpose, and makes such content or technology available to the Florida public, to create
safety and transparency standards that:
o Alert consumers that such content or technology is generated by AI.
o Allow such content or technology to be recognizable as generated by AI to other AI.
Requires an entity or a person to provide a clear and conspicuous notice on its Internet homepage or
landing page if it provides an AI mechanism to communicate or interact with Florida consumers for a
commercial purpose.
Prohibits any entity or person from knowingly using an image of an identifiable child in producing,
generating, incorporating, or synthesizing child pornography through AI.
Requires any state agency that uses AI to disclose if a person is interacting with AI when interacting
with the agency and ensure that any confidential information accessible to an AI system remains
confidential.
Any violation of the provisions of the bill by a person or entity is an unfair and deceptive trade practice
actionable under FDUTPA solely by the Department of Legal Affairs at the Attorney General’s Office. The bill
does not establish a private cause of action.
The bill amends the definition of child pornography to include “any image or presentation produced, generated,
incorporated, or synthesized through artificial intelligence that uses an image of an identifiable minor to depict
or portray a minor engaged in sexual conduct,” which makes using such technology for such purposes a crime.
The bill also creates an advisory council called the Government Technology Modernization Council to study
and monitor the development and deployment of AI systems and provide reports on such systems to the
Governor and the Legislature.
The bill has no fiscal impact on local governments, and an indeterminate fiscal impact on state government.
The bill provides an effective date of July 1, 2024. STORAGE NAME: h1459.COM PAGE: 2
DATE: 1/24/2024
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Current Situation
Artificial Intelligence
In the 1950s, a generation of scientists, mathematicians, and philosophers, including Alan Turing,
conceptualized the possibility of artificial intelligence (AI). In his 1950 paper Computing Machinery and
Intelligence, Turing discussed “how to build intelligent machines and how to test their intelligence.”
1
The term “artificial intelligence” itself was coined at the Dartmouth Summer Research Project on
Artificial Intelligence, a conference held in 1956. Since 2010, there has been a lot of advancement in AI
research, which has been attributed to the “availability of large datasets, improved machine learning
approaches and algorithms, and more powerful computers.”
2
AI encompasses a large field of existing and emerging technologies, methodologies, and application
areas. The Congressional Research Service has recently stated that AI is “generally thought of as
computerized systems that work and react in ways commonly thought to require intelligence.”
3
The
application of AI extends to areas such as “natural language processing, facial recognition, and
robotics.”
4
Generative Artificial Intelligence
Generative AI (GenAI) refers to “machine learning (ML) models developed through training on large
volumes of data” for the purpose of generating new content, and has undergone rapid advancement
over the past few years.
5
GenAI, and subsets called large language models (LLMs) and generative adversarial networks (GANs),
are developed through training on data sets, largely collected from public internet sites, in order to
generate content. When a user provides a prompt, the model may generate text, image, video, and
computer code responses with “human-like quality.” The Congressional Research Service found that
recent technological advances combined with the open availability of these tools to the public has led to
widespread use.
6
Specifically, to synthesize content, a GAN pits two neural networks—a generator and discriminator—
against each other. Two scholars from the University of Texas at Austin describe the functionality as
follows: “To synthesize an image of a fictional person, the generator starts with a random array of pixels
and iteratively learns to synthesize a realistic face. On each iteration, the discriminator learns to
distinguish the synthesized face from a corpus of real faces; if the synthesized face is distinguishable
from the real faces, then the discriminator penalizes the generator. Over multiple iterations, the
generator learns to synthesize increasingly more realistic faces until the discriminator is unable to
distinguish it from real faces.”
7
1
Rockwell Anyoha, Can Machines Think?, Harvard University, Aug. 28, 2017, https://sitn.hms.harvard.edu/flash/2017/history-artificial-intelligence/
(last visited Jan. 20, 2024).
2
Congressional Research Service, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118
th
Congress, available at
https://crsreports.congress.gov/product/pdf/R/R47644 (last visited Jan. 20, 2024).
3
Id.
4
Id.
5
Id.; See also Congressional Research Service, Generative Artificial Intelligence: Overview, Issues, and Questions for Congress, available at
https://crsreports.congress.gov/product/pdf/IF/IF12426 (last visited Jan. 14, 2024).
6
CRS, supra note 1.
7
Sophie Nightingale and Hany Ford, AI-synthesized faces are indistinguishable from real faces and more trustworthy, Proceedings of the National
Academy of Sciences of the United States of America (PNAS), Feb. 14, 2022, https://www.pnas.org/doi/10.1073/pnas.2120481119 (last visited Jan.
20, 2024). STORAGE NAME: h1459.COM PAGE: 3
DATE: 1/24/2024
Potential Benefits and Risks of Artificial Intelligence
According to PricewaterhouseCoopers, “AI technologies could increase global GDP by $15.7 trillion, a
full 14%, by 2030,” with health, retail, and financial services experiencing the most growth.
8
Some
potential benefits include:
Financial sector –The use of AI and algorithms in the financial sector may:
9
o Make decision-making more efficient, less emotional, and more analytic for investing,
portfolio management, loan applications, mortgages and retirement planning.
o Prevent fraud and detect financial anomalies in large institutions.
Health Sector – The use of AI and algorithms in the health sector may:
10
o Help diagnose and predict disease or illness.
o Help predict potential challenges and allocate resources to patient education, sensing,
and proactive interventions to keep patients out of the hospital.
o Create a multifaceted and highly personalized picture of person’s well-being.
Transportation Sector – The use of AI and algorithms in the transportation sector may:
o Develop vehicle guidance, braking, and lane-changing systems for cars, trucks, buses,
and drone delivery systems.
o Develop systems to prevent collisions with the use of cameras and sensors.
o Provide real-time information analysis and safety measures for the development of
autonomous vehicles.
Government Sector – The use of AI and algorithms in the government sector may:
11
o Help to create smart cities and e-governance. Examples include:
The George AI chatbot, a customer service virtual assistant created by the
Georgia Department of Labor.
AI monitoring of live footage from cameras in forests and mountains for signs of
smoke by western states including California, Nevada, and Oregon.
o Help metropolitan areas adopt systems for citizen service delivery, urban and
environmental planning, energy use, and crime prevention.
Customer Service – The use of AI and algorithms in customer service may:
12
o Provide customer service to consumers through the use of chatbots and other customer
service-oriented tools to increase customer engagement, resulting in increased sales
opportunities with reduced costs to the business.
However, developments in AI raise important policy, regulatory and ethical issues. Potential risks are
associated with removing humans from the decision-making process, as is the case when AI
technology becomes more advanced over time.
13
Some potential risks include:
Bias:
14
o Because AI algorithms are all based on data input by humans, and such data is based
on human choices, responses or decisions, there is a risk that such algorithms can
contain bias, inaccuracies, ethical considerations, and value choices, which can take
many forms including historical, racial, or other discrimination, without intervention.
Workforce:
15
o Integrating AI into the workforce brings uncertainty and challenge to the labor market,
e.g., to what extent will AI replace jobs. There may need to be significant investments
from business leaders and governments for retraining and reskilling the workforce.
Legal Liability:
16
8
National Conference of State Legislatures, Approaches to Regulating Artificial Intelligence: A Primer, Aug. 10, 2023,
https://www.ncsl.org/technology-and-communication/approaches-to-regulating-artificial-intelligence-a-primer (last visited Jan. 20, 2024).
9
Id.; Darrell West and John Allen, How artificial intelligence is transforming the world, Brookings Institute, Apr. 24, 2018,
https://www.brookings.edu/articles/how-artificial-intelligence-is-transforming-the-world/ (last visited Jan. 20, 2024).
10
NCSL, supra note 6.
11
Id.
12
Id.
13
Id.
14
Id.
15
Id.
16
Id. STORAGE NAME: h1459.COM PAGE: 4
DATE: 1/24/2024
o There are questions concerning who is legally liable when AI systems harm or
discriminate against people, especially as new and emerging use cases for AI platforms
are developed and integrated.
Security Risks:
17
o AI systems present cybersecurity and national security risks, including:
AI companies collecting large amounts of personal data for AI training and use.
Bad actors developing advanced cyberattacks, bypassing security measures,
and exploiting vulnerabilities in various private and public systems.
o Traditional cybersecurity risk assessment tools are generally inadequate for addressing
such risks.
Efforts to Regulate Artificial Intelligence
As the use of AI technologies has grown, so too have discussions of whether and how to regulate
them. Potential regulatory options include a broad regulation of AI technologies that could be used
across sectors, or a more targeted approach, regulating the use of AI technologies in particular
sectors.
18
In 2023, 31 states introduced at least 191 bills concerning AI, with 14 of the bills becoming laws.
19
As
reported by the National Conference of State Legislatures:
20
Connecticut required the state Department of Administrative Services to conduct an inventory of
all systems that employ AI and are in use by any state agency and, beginning Feb. 1, 2024,
perform ongoing assessments of systems that employ AI and are in use by state agencies to
ensure that no such system results in unlawful discrimination or disparate impact.
Louisiana adopted a resolution requesting the Joint Committee on Technology and
Cybersecurity to study the impact of AI in operations, procurement and policy.
Maryland established the Industry 4.0 Technology Grant Program to assist certain small and
medium-sized manufacturing enterprises with implementing new “industry 4.0” technology or
related infrastructure. The definition of industry 4.0 includes AI.
Texas, North Dakota, Puerto Rico, and West Virginia created AI advisory councils to study and
monitor AI systems developed, employed or procured by state agencies.
Additionally, the following laws were passed in previous years:
California prohibits any person from using a bot to communicate or interact with another person
online with the intent to mislead the other person about its artificial identity in order to incentivize
a purchase or sale of goods or services in a commercial transaction or to influence a vote in an
election.
21
Illinois requires an employer that asks applicants to record video interviews and uses an AI
analysis of applicant-submitted videos to:
22
o Notify each applicant in writing before the interview that AI may be used to analyze the
applicant's facial expressions and consider the applicant's fitness for the position;
o Provide each applicant with an information sheet before the interview explaining how the
AI works and what characteristics it uses to evaluate applicants; and
o Obtain written consent from the applicant to be evaluated by the AI program.
While there is no broad framework for AI regulation in the United States, federal laws on AI have been
enacted over the past few years to guide actions within the federal government. For example, the
17
Id; Bernard Marr, The 15 Biggest Risks Of Artificial Intelligence, Forbes, Jun. 2, 2023, https://www.forbes.com/sites/bernardmarr/2023/06/02/the-
15-biggest-risks-of-artificial-intelligence/?sh=603d66292706 (last visited Jan. 20, 2024).
18
CRS, supra note 2.
19
National Conference of State Legislatures, State of Play | An Inside Look at Artificial Intelligence Policy and State Actions, Jan. 9, 2024,
https://www.ncsl.org/state-legislatures-news/details/state-of-play-an-inside-look-at-artificial-intelligence-policy-and-state-actions (last visited Jan.
20, 2024).
20
National Conference of State Legislatures, Artificial Intelligence 2023 Legislation, Jan. 12, 2024, https://www.ncsl.org/technology-and-
communication/artificial-intelligence-2023-legislation (last visited Jan. 20, 2024).
21
Cal. B&P Code §§ 17940-17943
22
2019 IL Public Act 101-0260 STORAGE NAME: h1459.COM PAGE: 5
DATE: 1/24/2024
National Artificial Intelligence Initiative Act of 2020, establishes the American AI Initiative and provides
directions for AI research, development, and evaluation activities at federal science agencies.
23
The European Union has proposed the Artificial Intelligence Act (AIA), which would create broad
regulatory oversight for the development and use of a wide range of AI applications, with requirements
varying by risk category, from banning systems with unacceptable risk to allowing free use of those with
minimal or no risk.
24
In an effort to begin implementation of the AIA, a related new rule was agreed to
in December, 2023, which includes requiring human oversight in creating and deploying the systems
and banning indiscriminate scraping of images from the internet to create a facial recognition
database.
25
Artificial Intelligence Used to Create Child Pornography
Recently, there has been an increase in AI production of child pornography. Offenders may use
downloadable open source GenAI and GAN models, which can produce images quickly, to devastating
effects.
26
Hidden inside the foundation of popular AI image-generators are thousands of images of child
sexual abuse, which have made it easier for offenders and AI systems to produce realistic and explicit
imagery of fake children as well as transform social media photos of fully clothed children into child
sexual abuse material (CSAM).
27
In September, 2023, analysts at the Internet Watch Foundation (IWF) found in one dark web CSAM
forum, a total of 20,254 AI-generated photos posted within the prior month. The analysts spent 87.5
hours assessing 11,108 of these images. In total, the IWF judged 2,978 images to be criminal. Most
were realistic enough to be treated the same way as non-AI CSAM.
28
Additionally, Stanford Internet Observatory recently found more than 3,200 images of suspected child
sexual abuse in the giant AI database LAION, an index of online images and captions that’s been used
to train leading AI image-makers.
29
Nishant Vishwamitra, an assistant professor at the University of Texas at San Antonio who is working
on the detection of deepfakes and AI CSAM images online, stated that “the scale at which such images
can be created is worrisome.”
30
Child Pornography Laws
Federal Law
Generally, the First Amendment does not protect child pornography. In New York v. Ferber,
31
the
United States Supreme Court (Supreme Court) recognized that states have a compelling interest in
safeguarding the physical and psychological well-being of minors and in preventing their sexual
exploitation and abuse. The Supreme Court noted that it was “unlikely that visual depictions of children
. . . lewdly exhibiting their genitals would often constitute an important and necessary part of a literary
performance or scientific or educational work.”
32
Under these principles, states have criminalized
possessing, distributing, and other acts involving child pornography. However, the constitutionality of
23
CRS, supra note 2.
24
Id; European Commission, Regulatory Framework Proposal on Artificial Intelligence, https://digital-strategy.ec.europa.eu/en/policies/regulatory-
framework-ai (last visited Jan. 20, 2024).
25
Adam Satariano, E.U. Agrees on Landmark Artificial Intelligence Rules, NY Times, Dec. 8, 2024,
https://www.nytimes.com/2023/12/08/technology/eu-ai-act-regulation.html (last visited Jan. 20, 2024).
26
Matt Burgess, The AI-Generated Child Abuse Nightmare Is Here, Wired, Oct. 24, 2023, https://www.wired.com/story/generative-ai-images-child-
sexual-abuse/ (last visited Jan. 20, 2024).
27
Matt O’Brien and Haleluya Hadero, Study shows AI image-generators are being trained on explicit photos of children, PBS NewsHour, Dec. 20,
2023, https://www.pbs.org/newshour/science/study-shows-ai-image-generators-are-being-trained-on-explicit-photos-of-children (Last visited Jan. 21,
2024).
28
Id.
29
O’Brien and Hadero, supra note 27.
30
Id.
31
458 U.S. 747 (1982).
32
Id. at 762-63. STORAGE NAME: h1459.COM PAGE: 6
DATE: 1/24/2024
criminalizing such acts is less clear when the images at issue are morphed pornography, which is
created when the innocent image of a child is combined with a separate, sexually explicit image,
usually of an adult. The children depicted in these images were not harmed in the image, as they were
not photographed while engaging in a sexual or obscene act.
33
Child Pornography Prevention Action of 1996
Prior to 1996, federal law criminalized a variety of acts relating to child pornography.
34
At that time,
federal statutes described images of a minor actually engaging in sexually explicit conduct.
35
In 1996,
Congress passed the Child Pornography Prevention Action of 1996 (CPPA),
36
creating a definition of
“child pornography” that for the first time criminalized acts relating to morphed child pornography.
In 2002, the Supreme Court decided Ashcroft v. Free Speech Coalition,
37
a case in which a California
trade association for the adult entertainment industry challenged the CPPA as unconstitutionally
overbroad. A provision made it a crime to possess or distribute images depicting sexually explicit
conduct which could be created by using advanced computer imaging techniques to “create realistic
images of children who do not exist” (i.e., virtual child pornography).
38
The Supreme Court held that the speech criminalized in the challenged provision of the CPPA violated
the First Amendment since it extended the federal prohibition against child pornography to sexually
explicit images that “appeared to” depict minors but were “produced without using any real
children.”
39
The Supreme Court decided that “by prohibiting child pornography that did not depict an
actual child,” the CPPA “abridged the freedom to engage in a substantial amount of lawful speech” and
was therefore overbroad and unconstitutional.
40
While the Ashcroft decision did not specifically address the constitutionality of the CPPA provision that
prohibits morphed child pornography, it did note, in dictum, that “[a]lthough morphed images may
fall within the definition of virtual child pornography, they implicate the interests of real
children…”
41
This suggests that morphed child pornography may not be protected by the First
Amendment.
42
Congress attempted to remedy the constitutional issues raised in Ashcroft by passing the
"Prosecutorial Remedies and Other Tools to end the Exploitation of Children Today Act” (Protect Act) in
2003.
43
The Protect Act, in part, narrowed the definition of virtual child pornography in the CPPA to
include only virtual or computer-generated images that are “indistinguishable from” images of actual
minors engaging in sexually explicit conduct.
44
The definition of morphed child pornography in the
CPPA remained unchanged by the Protect Act.
To date, the federal statutes relating to morphed child pornography have been upheld.
45
33
Stacey Steinberg, Changing Faces: Morphed Child Pornography Images and the First Amendment, 68 Emory L.J. 909 (2019).
34
See, e.g., 18 USC §2252 (1994 ed.).
35
U.S. v. Hotaling, 599 F.Supp.2d 306, 309 (N.D.N.Y. 2008); see also 18 USC §§ 2252 and 2256 (1994 ed.).
36
Pub. L. No. 104-208.
37
535 U.S. 234 (2002).
38
Supra, note 8.
39
Supra, note 9, at 256.
40
Id.
41
Id. at 242.
42
McFadden v. Alabama, 67 So.3d 169, 181-82 (Ala. Crim. App. 2010).
43
Pub. L. No. 108-21.
44
18 USC §2256(8)(B).
45
In United States v. Bach, the defendant was convicted of possessing morphed child pornography. The image at issue showed a young nude boy
sitting in a tree, grinning, with his pelvis tilted upward, his legs opened wide, and a full erection. The photograph of a well-known child entertainer’s
head had been “skillfully inserted onto the photograph of the nude boy so that the resulting image appeared to be a nude picture of the child
entertainer sitting in the tree.” The defendant appealed, arguing that his conviction was invalid because the definition of morphed child pornography
violated the First Amendment. The United States Court of Appeals for the Eighth Circuit disagreed, holding that morphed child pornography
“implicate[s] the interests of real children” and creates a lasting record of an identifiable minor child seemingly engaged in sexually explicit activity.
United States v. Bach, 400 F.3d 622, 632 (8th Cir. 2005); United States v. Ramos, 685 F.3d 120, 134 (2d Cir. 2012), cert. denied, 133 S.Ct. 567
(2012); see also Doe v. Boland, 630 F.3d 491, 497 (6th Cir. 2011); see also United States v. Hotaling, 634 F.3d 725 (2d Cir. 2008), cert. denied, 132 STORAGE NAME: h1459.COM PAGE: 7
DATE: 1/24/2024
In 2014, in United States v. Anderson,
46
the defendant was charged with distribution of morphed child
pornography relating to an image in which the face of a minor female was superimposed over the face
of an adult female engaging in sex with an adult male.
47
The defendant moved to dismiss the charge,
arguing that the definition of morphed child pornography was unconstitutionally overbroad.
48
The court
noted that in the image at issue “no minor was sexually abused.”
49
However, the court held that
because such images falsely portray identifiable children engaging in sexual activity, such images
implicate the compelling governmental interest in protecting minors.
50
Using this reasoning, the court
applied a strict scrutiny balancing test and held that the definition of morphed child pornography was
constitutional as applied to the facts of Anderson.
In an MSNBC report, the U.S. Justice Department claims AI-generated CSAM may be prosecutable
under existing federal child pornography laws. However, the U.S. Justice Department could not show
such a prosecution to date.
51
Florida Law
Currently, Florida law defines “child pornography” as:
Any image depicting a minor engaged in sexual conduct; or
Any image that has been created, altered, adapted, or modified by electronic, mechanical, or
other means, to portray an identifiable minor engaged in sexual conduct.
52
Current law defines “sexual conduct” as:
Actual or simulated
53
sexual intercourse, deviate sexual intercourse, sexual bestiality,
54
masturbation, or sadomasochistic abuse;
55
Actual or simulated lewd exhibition of the genitals;
Actual physical contact with a person’s clothed or unclothed genitals, pubic area, buttocks, or, if
such person is a female, breast, with the intent to arouse or gratify the sexual desire of either
party; or
Any act or conduct which constitutes sexual battery
56
or simulates that sexual battery is being or
will be committed.
57, 58
As it relates to child pornography, Florida law defines “identifiable child” as a person:
Who was a minor at the time the image was created, altered, adapted, or modified, or whose
image as a minor was used in the creating, altering, adapting, or modifying of the image; and
Who is recognizable as an actual person by the person’s face, likeness, or other distinguishing
characteristic, such as a unique birthmark, or other recognizable feature.
59, 60
S.Ct. 843 (2011) (citing Bach, the Court held that “child pornography created by digitally altering sexually explicit photographs of adults to display
the face of a child is not protected expressive speech under the First Amendment.).
46
759 F.3d 891 (8th Cir. 2014).
47
Id.
48
Id.
49
Id. at 895.
50
Id. at 896.
51
Frank Figliuzzi, A loophole makes it hard to punish these despicable AI-generated nude photos, MSNBC, Nov. 7, 2023,
https://www.msnbc.com/opinion/msnbc-opinion/ai-generated-nudes-new-jersey-students-rcna123931 (last visited Jan. 20, 2024).
52
S. 827.071(1)(b), F.S.
53
“Simulated” means the explicit depiction of conduct set forth in current law which creates the appearance of such conduct and which exhibits any
uncovered portion of the breasts, genitals, or buttocks. S. 827.071(1)(n), F.S.
54
“Sexual bestiality” means any sexual act between a person and an animal involving the sex organ of the one and the mouth, anus, or female
genitals of the other. S. 827.071(1)(k), F.S.
55
“Sadomasochistic abuse” means flagellation or torture by or upon a person, or the condition of being fettered, bound, or otherwise physically
restrained, for the purpose of deriving sexual satisfaction from inflicting harm on another or receiving such harm oneself. S. 827.071(1)(i), F.S.
56
“Sexual battery” means oral, anal, or female genital penetration by, or union with, the sexual organ of another or the anal or female genital
penetration of another by any other object; however, “sexual battery” does not include an act done for a bona fide medical purpose. S. 827.071(1)(j),
F.S.
57
S. 827.071(1)(l), F.S.
58
A mother’s breastfeeding of her baby does not under any circumstance constitute “sexual conduct.” Id.
59
S. 827.071(1)(e), F.S.
60
The term may not be construed to require proof of the actual identity of the identifiable minor. Id. STORAGE NAME: h1459.COM PAGE: 8
DATE: 1/24/2024
Florida law contains a variety of provisions prohibiting acts relating to child pornography, including
under ch. 827, F.S., relating to “Abuse of Children,” and ch. 847, F.S., relating to “Obscenity.”
Current law makes it a:
Second degree felony for a person to possess with the intent to promote any photograph,
motion picture, exhibition, show, representation, or other presentation which, in whole or in part,
includes child pornography. Possession of three or more copies of such photographs, etc., is
prima facie evidence of a person’s intent to promote.
61
Third degree felony for any person to knowingly possess, control, or intentionally view
62
a
photograph, motion picture, or other image that, in whole or in part, he or she knows includes
any child pornography.
63
Third degree felony for any person who knew or reasonably should have known that he or she
was transmitting child pornography to another.
64
Advisory Councils
Under Florida law, an “advisory council” means an advisory body created by specific statutory
enactment and appointed to function on a continuing basis. Generally, an advisory council is enacted to
study the problems arising in a specified functional or program area of state government and to provide
recommendations and policy alternatives.
65
The Code of Ethics for Public Officers and Employees
66
establishes ethical standards
for public officials, which includes any person elected or appointed to hold office in any agency and any
person serving on an advisory council.
67
The code is intended to ensure that public officials conduct
themselves independently and impartially, and do not use their offices for private gain other than
compensation provided by law. The code pertains to various ethical issues, such as ethics trainings,
voting conflicts, full and public disclosure of financial interests, and standards of conduct.
68
Florida Cybersecurity Advisory Council
The Department of Management Services (DMS) oversees information technology (IT)
69
governance
and security for the executive branch in Florida.
70
The Florida Digital Service (FLDS) is housed within
DMS and was established in 2020 to replace the Division of State Technology.
71
FLDS works under
DMS to implement policies for information technology and cybersecurity for state agencies.
72
An advisory council under Chapter 282, F.S., regulating communications, technology, and
cybersecurity, is the Florida Cybersecurity Advisory Council (CAC) within DMS.
73
CAC assists state
agencies in protecting IT resources from cyber threats and incidents.
74
The CAC must assist FLDS in
61
S. 827.071(4), F.S.
62
“Intentionally view” means to deliberately, purposefully, and voluntarily view. Proof of intentional viewing requires establishing more than a
single image, motion picture, exhibition, show, image, data, computer depiction, representation, or other presentation was viewed over any period of
time. S. 827.071(1)(b), F.S.
63
S. 827.071(5)(a), F.S. The statute also specifies that the possession, control, or intentional viewing of each such photograph, or other image, is a
separate offense. If such photograph or other image includes child pornography depicting more than one child, then each child in each photograph or
image that is knowingly possessed, controlled, or intentionally viewed is a separate offense.
64
S. 847.0137, F.S.
65
S. 20.03(7), F.S.; See also s. 20.052, F.S.
66
See Part III, Chapter 112, F.S.
67
S. 112.313(1), F.S.
68
See Part III, Chapter 112, F.S.
69
The term “information technology” means equipment, hardware, software, firmware, programs, systems, networks, infrastructure, media, and
related material used to automatically, electronically, and wirelessly collect, receive, access, transmit, display, store, record, retrieve, analyze,
evaluate, process, classify, manipulate, manage, assimilate, control, communicate, exchange, convert, converge, interface, switch, or disseminate
information of any kind or form. S. 282.0041(19), F.S.
70
See s. 20.22, F.S.
71
Ch. 2020-161, L.O.F.
72
See s. 20.22(2)(b), F.S.
73
S. 282.319(1), F.S.
74
S. 282.319(2), F.S. STORAGE NAME: h1459.COM PAGE: 9
DATE: 1/24/2024
implementing best cybersecurity practices, taking into consideration the final recommendations of the
Florida Cybersecurity Task Force – a task force created to review and assess the state’s cybersecurity
infrastructure, governance, and operations.
75
The CAC meets at least quarterly to:
Review existing state agency cybersecurity policies;
Assess ongoing risks to state agency IT;
Recommend a reporting and information sharing system to notify state agencies of new risks;
Recommend data breach simulation exercises;
Assist FLDS in developing cybersecurity best practice recommendations; and
Examine inconsistencies between state and federal law regarding cybersecurity.
76
The CAC must work with NIST
77
and other federal agencies, private sector businesses, and private
security experts to identify which local infrastructure sectors, not covered by federal law, are at the
greatest risk of cyber-attacks and to identify categories of critical infrastructure as critical cyber
infrastructure if cyber damage to the infrastructure could result in catastrophic consequences.
78
The CAC must also prepare and submit a comprehensive report to the Governor, the President of the
Senate, and the Speaker of the House of Representatives that includes data, trends, analysis, findings,
and recommendations for state and local action regarding ransomware incidents as stated below:
Descriptive statistics, including the amount of ransom requested, duration of the incident, and
overall monetary cost to taxpayers of the incident;
A detailed statistical analysis of the circumstances that led to the ransomware incident which
does not include the name of the state agency or local government, network information, or
system identifying information;
Statistical analysis of the level of cybersecurity employee training and frequency of data backup
for the state agencies or local governments that reported incidents;
Specific issues identified with current policy, procedure, rule, or statute and recommendations to
address those issues; and
Other recommendations to prevent ransomware incidents.
Florida Deceptive and Unfair Trade Practices Act (FDUTPA)
FDUTPA is a consumer and business protection measure that prohibits unfair methods of competition,
unconscionable acts or practices, and unfair or deceptive acts or practices in trade or commerce.
79
FDUTPA was modeled after the Federal Trade Commission (FTC) Act.
80
The Department of Legal Affairs (DLA) or the Office of the State Attorney (SAO) may bring actions on
behalf of consumers or governmental entities when it is a matter of public interest.
81
The SAO may
enforce violations of FDUTPA if the violations take place within its jurisdiction. The DLA has
enforcement authority when the violation is multi-jurisdictional, the state attorney defers to the DLA in
writing, or the state attorney fails to act within 90 days after a written complaint is filed.
82
In certain
circumstances, consumers may also file suit through private actions.
83
75
S. 282.319(3), F.S.
76
S. 282.319(9), F.S.
77
NIST, otherwise known as the National Institute of Standards and Technology, “is a non-regulatory government agency that develops technology,
metrics, and standards to drive innovation and economic competitiveness at U.S.-based organizations in the science and technology industry.” Nate
Lord, What is NIST Compliance, DataInsider (Dec. 1, 2020), https://www.digitalguardian.com/blog/what-nist-compliance (last visited Jan. 20, 2024).
78
S. 282.319(10), F.S.
79
Ch. 73-124, L.O.F.; s. 501.202, F.S.
80
D. Matthew Allen, et. al., The Federal Character of Florida’s Deceptive and Unfair Trade Practices Act, 65 U. MIAMI L. REV. 1083 (Summer
2011).
81
S. 501.207(1)(c) and (2), F.S.; see s. 501.203(2), F.S. (defining “enforcing authority” and referring to the office of the state attorney if a violation
occurs in or affects the judicial circuit under the office’s jurisdiction; or the Department of Legal Affairs if the violation occurs in more than one
circuit; or if the office of the state attorney defers to the department in writing; or fails to act within a specified period); see also David J. Federbush,
FDUTPA for Civil Antitrust: Additional Conduct, Party, and Geographic Coverage; State Actions for Consumer Restitution, 76 FLORIDA BAR
JOURNAL 52, Dec. 2002 (analyzing the merits of FDUPTA and the potential for deterrence of anticompetitive conduct in Florida), available at
http://www.floridabar.org/divcom/jn/jnjournal01.nsf/c0d731e03de9828d852574580042ae7a/99aa165b7d8ac8a485256c8300791ec1!OpenDocument
&Highlight=0,business,Division* (last visited on Jan. 6, 2024).
82
S. 501.203(2), F.S.
83
S. 501.211, F.S. STORAGE NAME: h1459.COM PAGE: 10
DATE: 1/24/2024
The DLA and the SAO have powers to investigate FDUTPA claims, which include:
84
Administering oaths and affirmations;
Subpoenaing witnesses or matter; and
Collecting evidence.
The DLA and the State Attorney, as enforcing authorities, may seek the following remedies:
Declaratory judgments;
Injunctive relief;
Actual damages on behalf of consumers and businesses;
Cease and desist orders; and
Civil penalties of up to $10,000 per willful violation.
85
FDUTPA may not be applied to certain entities in certain circumstances, including:
86
• Any person or activity regulated under laws administered by the Office of Insurance Regulation
or the Department of Financial Services; or
• Banks, credit unions, and savings and loan associations regulated by the Office of Financial
Regulation or federal agencies.
Effect of the Bill
Government Technology Modernization Council
The bill creates an advisory council the Government Technology Modernization Council (council) within
DMS under Chapter 282, F.S.
The bill provides that the purpose of the council is to study and monitor the development and
deployment of AI systems and provide reports on such systems to the Governor and the Legislature.
The bill requires the council to meet at least quarterly to:
Assess and provide guidance on necessary legislative reforms and the creation of a state code
of ethics for AI systems in state government.
Assess the effect of automated decision systems on constitutional and other legal rights, duties,
and privileges of residents of this state.
Study the potential benefits, liabilities, and risks that this state, residents of this state, and
businesses may incur as a result of implementing automated decision systems.
Recommend legislative and administrative actions that the Legislature and state agencies may
take to promote the development of data modernization in Florida.
Assess where AI is deployed today.
Evaluate common standards for AI safety and security measures.
Assess how governmental entities and the private sector are using AI with a focus on
opportunity areas for deployments in systems across this state.
Determine how AI is being exploited by bad actors, including foreign countries of concern.
87
The bill requires the council to submit annual legislative recommendations it considers necessary to
modernize government technology to the President of the Senate and the Speaker of the House of
Representatives any legislative, beginning June 30, 2024.
84
S. 501.206(1), F.S.
85
Ss. 501.207(1), 501.208, and 501.2075, F.S. Civil Penalties are deposited into general revenue. Enforcing authorities may also request attorney fees
and costs of investigation or litigation. S. 501.2105, F.S.
86
S. 501.212(4), F.S.
87
Section 287.138(1), F.S., lists the following as foreign countries of concern: People’s Republic of China, the Russian Federation, the Islamic
Republic of Iran, the Democratic People’s Republic of Korea, the Republic of Cuba, the Venezuelan regime of Nicolás Maduro, and the Syrian Arab
Republic. STORAGE NAME: h1459.COM PAGE: 11
DATE: 1/24/2024
The bill requires the council to submit an annual comprehensive report that includes data, trends,
analysis, findings, and recommendations for state and local action regarding ransomware incidents to
the Governor, the President of the Senate, and the Speaker of the House of Representatives,
beginning December 1, 2024. At a minimum, the report must include:
A summary of recommendations by relevant national entities on technology systems in state
government, including, but not limited to, AI, cloud computing, identity management, and
financial technology.
An assessment of the impact of using AI systems on the liberty, finances, livelihood, and privacy
interests of residents of Florida.
Recommended policies necessary to:
o Protect the privacy interests of Florida residents from any decrease in employment
caused by AI systems.
o Ensure that residents of this state are free from unfair discrimination caused or
compounded by the employment of AI systems.
o Promote the development and deployment of AI systems in Florida.
Any other information the council considers relevant.
The bill provides that the council is comprised of the following members:
The Lieutenant Governor.
The state chief information officer.
The State Surgeon General.
The Secretary of Health Care Administration.
A representative of the computer crime center of the Department of Law Enforcement,
appointed by the executive director of the Department of Law Enforcement.
The Chief Inspector General.
Thirteen representatives of institutions of higher education located in this state or the private
sector with senior level experience or expertise in AI, cloud computing, identity management,
data science, machine learning, government procurement, and constitutional law, with seven
appointed by the Governor, three appointed by the President of the Senate, and three
appointed by the Speaker of the House of Representatives.
One member of the Senate, appointed by the President of the Senate or his or her designee.
One member of the House of Representatives, appointed by the Speaker of the House of
Representatives or his or her designee.
The Secretary of DMS, or his or her designee, who serves as the ex officio, nonvoting executive
director of the council.
The bill provides that members serve a term of 4 years, except that sitting members of the Senate and
the House of Representatives serve terms that correspond with their terms of office.
88
A vacancy is
filled for the remainder of the unexpired term in the same manner as the initial appointment. All
members of the council are eligible for reappointment.
The bill provides that members of the council serve without compensation, but are entitled to receive
reimbursement for per diem and travel expenses.
89
Members of the council must maintain the confidential and exempt status of information received in the
performance of their duties and responsibilities. A current or former member of the council must follow
the Code of Ethics for Public Officers and Employees, and may not disclose or use information not
available to the general public and gained by reason of his or her official position, except for information
relating exclusively to governmental practices, for his or her personal gain or benefit or for the personal
gain or benefit of any other person or business entity. Members of the council must sign an agreement
acknowledging such requirements.
Artificial Intelligence Transparency
88
For the purpose of providing staggered terms, the initial appointments of members made by the Governor are for terms of 2 years.
89
As allowed under s. 112.061, F.S. STORAGE NAME: h1459.COM PAGE: 12
DATE: 1/24/2024
The bill provides that "artificial intelligence" means software that is developed with machine-learning,
logic and knowledge-based, or statistical approaches and can, for a given set of human-defined
objectives, generate or synthesize outputs such as content, predictions, recommendations, or decisions
influencing certain environments.
The bill requires an entity or person who produces or offers for use or interaction AI content or
technology for a commercial purpose, and makes such content or technology available to the Florida
public, to create safety and transparency standards that:
Alert consumers that such content or technology is generated by AI.
Allow such content or technology to be recognizable as generated by AI to other AI.
If a natural person in Florida is able to communicate or interact with an entity or person for commercial
purposes through an AI mechanism, the bill requires such entity or a person to provide a clear and
conspicuous statement on its Internet homepage or landing page that such mechanism is generated by
AI.
The bill prohibits any entity or person from knowingly using an image of an identifiable child in
producing, generating, incorporating, or synthesizing child pornography through AI.
Any violation of the bill by a person or entity is an unfair and deceptive trade practice actionable under
FDUTPA solely by DLA
90
In addition to other FDUTPA remedies, DLA may collect a civil penalty of up
to $50,000 per violation. DLA may also adopt rules to implement the bill.
The bill does not establish a private cause of action.
For purposes of bringing an action pursuant to the bill, any entity or person who produces or uses AI
that is distributed to or viewable by the public in this state is considered to be both engaged in
substantial and not isolated activities within this state and operating, conducting, engaging in, or
carrying on a business, and doing business in this state, and is therefore subject to the jurisdiction of
the courts of this state.
The bill requires any state agency
91
that uses AI to disclose if a person is interacting with AI when
interacting with the agency and ensure that any confidential information accessible to an AI system
remains confidential.
Criminal Acts
The bill amends the definition of child pornography to include any image or presentation produced,
generated, incorporated, or synthesized through artificial intelligence that uses an image of an
identifiable minor to depict or portray a minor engaged in sexual conduct, which makes using such
technology for such purposes a crime
This definition will apply to criminal acts related to child pornography.
The bill provides an effective date of July 1, 2024.
B. SECTION DIRECTORY:
Section 1: Creates s. 282.802, F.S.; creating the Government Technology Modernization Council.
Section 2: Creates s. 501.174, F.S.; providing requirements for entities using AI systems; providing
penalties.
Section 3: Amends s. 775.0847, F.S.; amending a definition.
90
Unlike under general FDUTPA actions, DLA is not prohibited from bringing an action against a social media platform that is also a:
Person or activity regulated under laws administered by OIR or DFS; and
Bank, credit union, and savings and loan association regulated by OFR or federal agencies.
91
As defined in s. 282.318(2), which is any official, officer, commission, board, authority, council, committee, or department of the executive branch
of state government; the Justice Administrative Commission; and the Public Service Commission. The term does not include university boards of
trustees or state universities. STORAGE NAME: h1459.COM PAGE: 13
DATE: 1/24/2024
Section 4: Amends s. 827.071, F.S.; amending a definition.
Section 5: Provides an effective date.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
There may be an increase in civil penalties collected by DLA.
2. Expenditures:
The bill may require additional expenditures for creating and running the council. There may be an
increase of regulatory costs to DLA from enforcing the bill.
See Fiscal Comments.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
See Fiscal Comments.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
The bill will require entities that use AI in certain circumstances to provide disclaimers.
D. FISCAL COMMENTS:
The bill may have a positive impact on jail and prison beds by creating new felony offenses relating to
construction fraud, which may result in increased admissions to such facilities.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not applicable. This bill does not appear to affect county or municipal governments.
2. Other:
Generally, the First Amendment does not protect child pornography. In New York v. Ferber,
92
the
United States Supreme Court recognized that states have a compelling interest in safeguarding the
physical and psychological well-being of minors and in preventing their sexual exploitation and abuse.
Under these principles, states have criminalized possessing, distributing, and other acts involving child
pornography. The constitutionality of criminalizing such acts when the images at issue are morphed
pornography has generally been upheld,
93
but the constitutionality of criminalizing such acts when the
images are generated or synthesized using AI from a database of identifiable children, but creating an
image not of an identifiable child, is less clear.
92
458 U.S. 747 (1982).
93
United States v. Bach, 400 F.3d 622, 632 (8th Cir. 2005); United States v. Ramos, 685 F.3d 120, 134 (2d Cir. 2012), cert. denied, 133 S.Ct. 567
(2012); see also Doe v. Boland, 630 F.3d 491, 497 (6th Cir. 2011); see also United States v. Hotaling, 634 F.3d 725 (2d Cir. 2008), cert. denied, 132
S.Ct. 843 (2011). STORAGE NAME: h1459.COM PAGE: 14
DATE: 1/24/2024
B. RULE-MAKING AUTHORITY:
The bill allows DLA to adopt rules related to enforcing provisions related to AI disclaimers, and use of
AI in certain material.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
On January 23, 2024, the Commerce Committee adopted a proposed committee substitute and reported
the bill favorably as a committee substitute. The committee substitute changed the bill in the following
ways:
Removed provisions requiring certain permissions or disclosures for political advertisements
produced and image and likeness used by AI, and conformed related provisions.
Expanded the criminal definition of “child pornography” to include AI creations.
Clarified language.
This analysis is drafted to the committee substitute as passed by the Commerce Committee.