Skip to content
Kennmarq.com, home
Menu

Washington and Utah

Two states follow California in 2027: Utah from 1 January, Washington from 1 February. Both ask generative AI providers with over a million users to embed provenance data in the images, video and audio their systems make. Washington's law names the C2PA standard as a way to comply, and every Kennmarq.com mark is C2PA.

In short

  • Washington, HB 1170: from 1 February 2027: provenance data, hard to remove; a C2PA-style standard is considered compliant.
  • Utah, HB 276: from 1 January 2027: a latent disclosure with the time, the date and digital signatures; large platforms must show it.
  • Who: providers whose systems have over a million users in the state.
  • Kennmarq.com: signed, time-stamped C2PA provenance data and a watermark in every mark. Send markets=us-wa or us-ut for a receipt.
Checked on 24 October 2026 against the enacted texts. This page explains what Kennmarq.com does; it isn't legal advice.

The two laws

Washington's HB 1170 and Utah's HB 276 compared
TopicWashingtonUtah
LawE2SHB 1170, chapter 167, Laws of 2026H.B. 276, the Digital Content Provenance Standards Act (Utah Code 13-72c)
Signed24 March 202624 March 2026
Applies from1 February 20271 January 2027; capture devices made for sale from 1 January 2028
Providers coveredGenerative AI systems for images, audio or video with over 1,000,000 monthly users, open to the public in WashingtonGenerative AI systems with over 1,000,000 monthly visitors or users, open to the public in Utah
Providers mustInclude provenance data in images, video and audio the system creates or materially alters, as far as commercially and technically reasonable, hard to remove or tamper with, showing it came from the provider's systemEmbed a latent disclosure in images, video and audio the system creates or substantially modifies, with the time and date and digital signatures that prove AI made or altered it, consistent with widely accepted industry standards
StandardsA commonly supported standard for watermarking or metadata, "such as the coalition for content provenance and authenticity specification", is considered compliant (sec. 2(2))Widely accepted industry standards
Platforms—Platforms with over 2,000,000 monthly users detect provenance data, let users inspect it, and don't strip it
Enforced byThe Attorney General: up to USD 7,500 per violation (RCW 19.86.140)The Division of Consumer Protection: up to USD 2,500 per violation

Washington leaves out minor edits (brightness, colour, filters, resizing, cropping, format changes, noise removal), business-to-business uses, and systems used only to upscale, denoise or compress. Utah leaves out systems used only inside a business.

What one call adds

  • Provenance data, signed: C2PA Content Credentials saying the file was made or edited by AI, with your company, your AI system and its version, signed and time-stamped. That's the standard Washington names, and the time, date and digital signatures Utah asks for.
  • Hard to remove: an invisible watermark that leads back to the credential when platforms strip the metadata.
  • Nothing personal: marks say how a file was made, never who made it or with which prompt.
  • A receipt: name the market and each file gets a receipt of what it carries for that law. us-wa needs your provider, app name and version.
curl
curl https://api.kennmarq.com/v1/mark \
  -H "Authorization: Bearer $KENNMARQ_API_KEY" \
  -F file=@image.png -F source=created \
  -F provider="Acme Inc." -F app_name="Acme Studio" -F app_version="2.1" \
  -F markets=us \
  -o image.marked.png

markets=us stands for California, Washington and Utah together.

What stays with you

  • Being the provider, and knowing whether your user numbers bring you under each law.
  • Large platforms in Utah: detecting and showing provenance data on what users upload.

Sources