New York enacted its first standalone AI advertising law in December 2025 — the Synthetic Performer Disclosure Act (SB-8420A), effective June 9, 2026. But that law is only the most visible layer of a broader picture. A patchwork of federal rules, existing state statutes, and a parallel NY digital replicas law already creates real compliance obligations. Here's what lead gen operators need to know.
NY SB-8420A: The Synthetic Performer Law
On December 11, 2025, Governor Hochul signed SB-8420A, amending New York's General Business Law. The law defines a "synthetic performer" as a digitally created human image or likeness generated using AI or algorithmic tools — one that does not represent any real, identifiable person. If an advertisement features a synthetic performer and the advertiser has actual knowledge of it, the ad must include a conspicuous disclosure.
The law does not prescribe specific wording, placement, or size — conspicuous is the standard. It also does not apply to ads for motion pictures, TV programs, streaming content, or video games where the synthetic performer's use in the ad is consistent with its use in the underlying work.
Penalties: $1,000 for a first violation, $5,000 for each subsequent violation.
What the law does not cover: AI-written copy, AI-targeted audiences, automated lead scoring, or any other AI use that doesn't involve a generated human likeness in the ad itself. The immediate practical question for lead gen operators: does any creative in your library feature a generated human face? If yes, you need a conspicuous disclosure on or before June 9.
The Parallel Law: Digital Replicas of Deceased Performers
Signed the same day (December 11, 2025), New York's Posthumous Right of Publicity Expansion Act (S.8391) is a companion law with a different scope. It restricts unauthorized commercial use of digital replicas of deceased performers — highly realistic, computer-generated representations of a deceased person's voice or visual likeness that are "readily identifiable" as that person. The law requires consent from heirs, executors, or rights assignees for any commercial use, and provides for statutory damages of $2,000 or actual damages plus punitive damages. Unlike SB-8420A, this law took effect immediately upon signing.
For most lead gen operators, direct exposure is low unless your creative production uses AI to recreate recognizable deceased public figures. The risk is most concrete in AI voice cloning or image generation pipelines without clear provenance controls.
What's Already in Force: The Federal Floor
Three existing frameworks create real obligations before June 9 arrives.
FTC Endorsement Guides (effective July 26, 2023) explicitly address AI-generated testimonials. If your landing pages or ads include testimonials produced or enhanced by AI, disclosure is required — "results not typical" is not sufficient on its own. AI-generated fake reviews are treated as a per se violation. The standard is clear and conspicuous disclosure of any material connection, assessed from the perspective of an ordinary consumer in the targeted audience.
NY SHIELD Act (effective March 2020) imposes data security obligations on any business holding private information of New York residents, regardless of where the business is located. If you collect NY leads, it applies. Critically, SHIELD Act obligations follow the data downstream: if NY consumer PII flows into AI enrichment pipelines, scoring models, or third-party training datasets, your reasonable safeguard obligations attach at every handoff.
NY GBL § 349 prohibits deceptive acts or practices in trade or commerce. AI-generated content that is materially misleading — fabricated quotes, synthetic before/after imagery, fake expert endorsements — falls within its scope and is enforceable by both the NY AG and private plaintiffs.
Other States: What's Already Law
Colorado: The original Colorado AI Act (SB24-205), signed May 2024, has effectively been replaced. After a court-ordered enforcement stay and a federal lawsuit challenging its constitutionality, the Colorado legislature passed SB 26-189 — a substantially scaled-back replacement signed by Governor Polis on May 14, 2026. The new law drops the original's impact assessment mandates and algorithmic discrimination duties in favor of a narrower notice-and-transparency framework. It takes effect January 1, 2027, with enforcement contingent on the AG completing rulemaking. Colorado no longer represents the aggressive compliance model it once did.
California CPRA/ADMT: The California Privacy Protection Agency finalized ADMT regulations on September 22, 2025. Risk assessment requirements for existing ADMT uses apply from January 1, 2026. Consumer opt-out rights and full pre-use notice compliance are required by April 1, 2027. Notably, the regulations define "significant decisions" to include lending and insurance — but explicitly exclude advertising. If you collect California leads and use AI scoring to determine who gets contacted or on what terms, the clock has started. Advertising targeting itself is outside scope, but downstream buyer use of your leads likely is not.
Illinois BIPA: The Biometric Information Privacy Act is relevant if any creative production or targeting infrastructure touches biometric data — face geometry, voiceprints. AI image generation using real people's faces, or AI voice cloning for ad voiceovers, both carry BIPA exposure if the underlying data collection involved Illinois residents without required consent.
Compliance Checklist
- Audit creatives for synthetic performers before June 9, 2026. Flag any ad featuring a generated human face or likeness. Add a conspicuous disclosure to each. There is no prescribed wording — "This ad features an AI-generated performer" is workable — but it must be clearly visible.
- Apply FTC Endorsement Guide disclosures to AI-generated testimonials. Any testimonial that was AI-generated or AI-enhanced needs clear attribution. Fake reviews — including AI-generated ones — are a per se violation. Review landing pages and ad copy now.
- Map your NY consumer data flows. Document where NY lead data goes after collection: enrichment vendors, scoring models, co-reg partners, AI training pipelines. SHIELD Act safeguards attach at every handoff. That documentation is what regulators will ask for.
- Update consent and privacy language for downstream ADMT use. If your leads feed into AI scoring systems at the buyer end, your TCPA consent and privacy disclosures should reflect that. "May be processed by automated decision-making systems" costs nothing to add and creates documented good-faith compliance practice. Align with California ADMT language as the current de facto national standard.
- Monitor Colorado and California deadlines. Colorado's replacement law (SB 26-189) takes effect January 1, 2027 — rulemaking will clarify scope. California ADMT opt-out compliance is required by April 1, 2027 for significant decisions including lending and insurance. If you run volume in either state, put those dates on the calendar now.
What Comes Next
NY's SB-8420A is the first AI advertising law in New York — not the last. It covers one narrow use case: generated human likenesses in ads. The broader regulatory agenda — algorithmic accountability, impact assessments for high-risk automated systems, opt-out rights for consumers subject to AI-driven decisions — remains active in the Albany legislative pipeline. The June 9, 2026 deadline is the immediate task. The compliance infrastructure you build around creative audits, data flow documentation, and disclosure language is not preparation for a hypothetical future. It is the actual work of operating in this market now.
Frequently Asked Questions
What exactly is a "synthetic performer" under NY SB-8420A?
A digitally created human image or likeness generated using AI or algorithmic tools that does not represent any real, identifiable person. The law applies when the advertiser has actual knowledge that the performer is synthetic — it is not a strict liability standard. Ads featuring real people, even if AI-enhanced, are governed by a different framework (NY's digital replicas law).
What does "conspicuous disclosure" mean — is there prescribed wording?
The law doesn't prescribe specific wording, placement, or size. "Conspicuous" is the operative standard, assessed from the perspective of an ordinary consumer in the targeted audience. In practice: the disclosure should be visible while the synthetic performer appears, in a readable size, not buried in fine print. "This ad features an AI-generated performer" is a workable formulation.
Does SB-8420A cover AI-written copy or AI-targeted audiences?
No. The law is narrowly scoped to AI-generated human likenesses in the ad itself. AI-written copy, AI-targeted audiences, automated lead scoring, lookalike modeling, and any other AI use that doesn't involve a generated human face or likeness is outside its scope. The law is about what appears in the creative — not how it was written or how the audience was built.
What's the difference between SB-8420A and the digital replicas law signed the same day?
SB-8420A (effective June 9, 2026) applies to AI-generated fictional performers — generated people who don't represent any real individual. The Posthumous Right of Publicity Expansion Act (S.8391), which took effect immediately upon signing (December 11, 2025), restricts unauthorized commercial use of digital replicas of real deceased people. Different scope, different effective date, different penalty structure.
Does California's ADMT opt-out rule cover advertising targeting?
No. The CPRA ADMT regulations explicitly exclude advertising from the definition of "significant decisions" subject to opt-out rights. However, downstream buyer use of leads for lending or insurance underwriting decisions is covered. If your leads feed into AI-driven pricing or eligibility models at the buyer end, your consent and privacy disclosures should reflect it. Full consumer opt-out compliance is required by April 1, 2027.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Laws and regulations referenced may have changed since publication. Consult qualified legal counsel before making compliance decisions specific to your business.