The NO FAKES Act of 2025 and the Protection of the Right to Digital Identity in the Age of Artificial Intelligence

By: Carlos Castillo, partner and director

The rapid advancement of generative artificial intelligence systems has made it possible to create highly realistic and increasingly sophisticated digital replicas of individuals' image, voice, and likeness, giving rise to unprecedented challenges for traditional legal frameworks designed to protect individual rights. Against this backdrop, the proposed United States legislation S.1367 – NO FAKES Act of 2025introduces an innovative regulatory framework by recognizing an exclusive right over an individual's digital identity, digital identity protecting it against unauthorized uses through artificial intelligence.

This article examines the proposed legislation from the perspective of Salvadoran law, analyzing its underlying principles, scope, and limitations. It evaluates the legal nature of the proposed framework, its relationship with intellectual property rights and rights of personality, as well as its compatibility with the fundamental right to freedom of expression. Finally, it considers the proposal's potential influence as a comparative law model for the development of El Salvador's domestic legal framework.

Personal Identity as an Object of Legal Protection

Article 1 of the Constitution of the Republic recognizes the human person—from the moment of conception—as the origin and ultimate purpose of the State's activities. It then immediately provides, in Article 2, that: "Every person has the right to life, to physical and moral integrity, to liberty, to security, to work, to own and possess property, and to be protected in the preservation and defense of these rights. The rights to honor, personal and family privacy, and one's own image are likewise guaranteed." Building upon these constitutional provisions, among others, Salvadoran constitutional doctrine has developed the concept of the right to identity. This right may be regarded as an implicit fundamental right, whose normative foundation is found across various constitutional provisions that protect its different manifestations. Its constitutional basis may be derived from Article 5, paragraph 3, of the Constitution (the right to identification); Articles 1 and 10 (human dignity); Articles 33 and 34 (the right to family relationships); Article 36, paragraph 3 (the right to a name); Article 36, paragraph 4 (the right to biological truth); and Articles 90 and 91 (the right to nationality).

Personal identity has been defined as the set of attributes and characteristics that enable an individual to be identified and distinguished within society. As such, it encompasses a range of related rights, the specific scope of which depends on the rights-holder and the circumstances of each case. Accordingly, identity cannot be understood in the abstract, but only by reference to a particular individual and the essential characteristics that distinguish that person within the community and differentiate him or her from its other members, including personal beliefs, worldview, origin, family relationships, and other identifying traits.

The General Assembly of the Organization of American States has recognized that the acknowledgment of a person's identity is one of the means through which the effective exercise of the rights to legal personality, a name, nationality, civil registration, and family relationships is facilitated, among other rights protected under international instruments such as the American Declaration of the Rights and Duties of Man and the American Convention on Human Rights.

Artificial intelligence has evolved beyond its role as an auxiliary tool to become a technological system capable of replicating human appearance with a degree of realism that challenges traditional legal categories. The AI-generated reproduction of the voice, image, or likeness of real individuals—without their consent—not only threatens proprietary and economic interests, such as by facilitating fraud and other forms of financial deception, but also undermines fundamental values including human dignity, personal autonomy, authenticity, and protection against identity theft and impersonation[1]moreover, these technologies can be used to place an individual's image in compromising situations, including scenarios that are inconsistent with that person's principles, values, or beliefs.

In response to this emerging reality, legal systems are increasingly compelled to reconceptualize personal identity as a legally protected interest within the digital environment, moving beyond the limitations of traditional legal doctrines such as copyright protection (Article 41 of the Intellectual Property Law), restrictions relating to the registration of trademarks (Article 112(f) and (g) of the Intellectual Property Law), and the protections afforded by privacy and the right to one's own image under the Personal Data Protection Law (Article 4(f) and (g)).

With respect to the right to one's own image, it is important to note that the jurisprudence of the Honorable Constitutional Chamber of the Supreme Court of Justice has consistently held—inter alia, in its judgments of 19 August 2009 and 24 September 2010 in Constitutionality Proceeding No. 91-2007 and Habeas Corpus No. 231-2006—that this right has both a positive and a negative dimension. On the one hand, it entitles its holder to determine the use and disclosure of the visual representation generated by his or her personal physical features (the positive aspect). On the other hand, it protects the individual against the unauthorized capture, reproduction, or publication of his or her image by third parties, regardless of the purpose for which such use is intended (the negative aspect). See also Amparo Judgment No. 635-2015, Constitutional Chamber of the Supreme Court of Justice, San Salvador, rendered at 9:24 a.m. on 4 December 2015.

The NO FAKES Act of 2025: Origins and Purpose

The proposed legislation S.1367 – NO FAKES Act of 2025 (Nurture Originals, Foster Art, and Keep Entertainment Safe Act) emerged as a legislative response to the proliferation of AI-generated digital replicas, particularly within the entertainment industry, although its legal implications extend far beyond that sector.

Its primary purpose is to grant individuals an exclusive right over the digital use of their voice and likenessIt seeks to establish a uniform federal framework for the protection of this right, replacing the previously fragmented legal landscape that relied on individual state right of publicity laws. The right is conceived as an exclusive right.

The Right of Publicity is a legal doctrine under United States law that grants individuals—most commonly celebrities—the exclusive right to control the commercial use of their identity, including their name, image, voice, or likeness. It prevents third parties from exploiting a person's fame or public recognition for commercial gain without authorization, thereby protecting that individual's identity from unauthorized commercial exploitation. The Right of Publicity is generally regarded as a proprietary right that, in many jurisdictions, survives the individual's death and may be inherited by his or her heirs. It protects against false endorsements and other unauthorized uses of a person's identity in advertising, films, video games, and other media. In essence, it confers upon its holder the exclusive authority to monetize and control the commercial exploitation of his or her identity, preventing others from generating economic benefit from that identity without prior authorization.

Digital Replicas and Their Legal Significance

One of the most significant conceptual contributions of the NO FAKES Act is its definition of “digital replica”understood as an artificially generated representation that substantially reproduces the voice or likeness of a real person, even though that individual did not actually participate in the creation of the content and did not authorize its use.

From an academic perspective, this definition serves several important legal purposes:

• Differentiate a digital replica from mere resemblance or artistic imitation;
• Identify a recognize a new autonomous subject of legal protection;
• Define more precisely the boundary between legitimate creative expression and the unlawful appropriation of an individual's identity.

The Legal Nature of the Right to Digital Identity

The proposed United States legislation establishes a right with hybrid legal characteristics:

• Personal in nature (rights of personality);insofar as they derive directly from an individual's identity;
• Proprietary in nature, as they may be licensed, commercially exploited, and monetized by their holder;
• Post mortemas the protection extends beyond the lifetime of the rights holder and may continue after the holder's death.

This approach is particularly significant from a doctrinal perspective, as it aligns the right to digital identity with legal concepts such as copyright and related rights, while preserving its normative foundation in the law governing rights of personality.

Furthermore, it is important to emphasize the broader sphere in which the right to digital identity operates. Its scope is not confined solely to the digital environment; rather, it extends beyond it.

The digital society is one in which digital technologies—including the Internet, mobile technologies, artificial intelligence (AI), and the Internet of Things (IoT)—are deeply integrated into every aspect of daily life, transforming the ways in which individuals communicate, work, learn, and interact. It is characterized by the instantaneous access to information and the creation and dissemination of knowledge through interconnected digital networks, transcending traditional analog structures and fostering new forms of social and economic interaction.

Within this environment, individuals create or acquire a digital identity, which refers to the body of information that represents a person in the online environment. It encompasses personal data, photographs, preferences, opinions, and activities on social media and other digital platforms, collectively forming a virtual profile—or digital footprint—that shapes an individual's online reputation. This reputation is determined not only by the content the individual publishes but also by information shared by third parties about that person.

Digital identity constitutes a virtual representation of the individual, enabling participation in cyberspace and access to digital services. It also serves as a means of authentication through mechanisms such as passwords, biometric identifiers (including fingerprints and voice recognition), and Internet Protocol (IP) addresses, all of which play a fundamental role in ensuring online security.

It is also worth noting that the Salvadoran government has introduced the creation of a Digital Profile,[2]which, through a secure account and user credentials, provides access to online administrative procedures, electronic payments, virtual government portals, and secure digital credentials (https://login.gob.sv/loginLikewise, the Government of El Salvador operates a Digital Identity Validation Portal, (https://login.gob.sv/verificar-duiThe information entered into the system is verified and managed by the National Registry of Natural Persons (Registro Nacional de las Personas Naturales – RNPN), the government entity responsible for safeguarding and certifying digital identity. This service is provided through the SIMPLE SV platform.https://simple.sv/) users can access and complete a wide range of government services entirely online.

Limitations, Exceptions, and Freedom of Expression

Recognizing the inherent tension between the protection of individual rights and the public interest, the NO FAKES Act expressly provides exceptions for informational, educational, satirical, and critical uses. This reflects a deliberate effort to reconcile the protection of digital identity with the First Amendment[3]to the United States Constitution.

From an academic perspective, this aspect is of critical importance, as it helps ensure that the legislation does not evolve into a mechanism for technological censorship or produce a chilling effect on cultural expression and public discourse.

Comparative Perspective and Relevance to the Salvadoran Legal Framework

Although the NO FAKES Act is a legislative proposal in the United States, its potential impact extends well beyond that jurisdiction. For Central American legal systems—where the rights to one's image and voice are traditionally addressed within the framework of constitutional law—this initiative offers:

• A legislative framework for addressing the challenges posed by generative artificial intelligence;
• A benchmark for the protection of digital identity as an autonomous legal interest;
• A foundation for the development of public policies promoting responsible innovation.

In particular, it opens the debate on the need to: update the legal frameworks governing intellectual property and rights of personality to address the challenges posed by disruptive technologies.

It may even be time to amend Article 190 of the Salvadoran Criminal Code, entitled "Unauthorized Use of Another Person's Image or Name," which provides: Any person who, by any means, uses another person's image or name without that person's consent for journalistic, artistic, commercial, or advertising purposes shall be subject to a fine of thirty to one hundred daily fines.

The criminal offense should not be limited to the purposes currently set forth in the statute, nor should it be punishable merely by the imposition of daily fines. Rather, a more robust legal response is required, including the imposition of civil liability for damages in addition to more severe criminal sanctions.

Conclusions

The NO FAKES Act of 2025 represents a significant effort to adapt the law to an ever-evolving technological landscape. Its recognition of the right to digital identity constitutes an important step toward ensuring the comprehensive protection of individuals in the digital environment, while at the same time preserving the fundamental values of freedom of expression and innovation.

From an academic perspective, the proposal invites a reconsideration of the traditional foundations of the law governing rights of personality and intellectual property. It also raises important questions that will undoubtedly remain the subject of legal and scholarly debate in the years to come.

---

[1] Under El Salvador's Special Law Against Cybercrime and Related Offenses, Article 22 (Identity Theft) provides: Any person who impersonates or unlawfully appropriates the identity of a natural or legal person through the use of Information and Communication Technologies (ICTs) shall be punished by imprisonment for a term of three to five years.

Where the conduct described in the preceding paragraph is used to harm, extort, defraud, defame, or threaten another person in order to cause injury or obtain a benefit for oneself or a third party, and the unlawful appropriation involves personal, confidential, or sensitive data as defined in the Law on Access to Public Information, the offender shall be punished by imprisonment for a term of five to eight years. See also Articles 18 and 34 of the Special Law Against Cybercrime and Related Offenses.

[2] Digital profiling is the process of collecting and analyzing information about an individual that exists online. A digital profile may include information relating to personal characteristics, behaviors, affiliations, relationships, and interactions. Digital profiling is widely used across a variety of fields, including marketing, corporate security, criminal justice, and recruitment.

[3] It protects five fundamental freedoms: freedom of religion (by prohibiting the establishment of an official religion and guaranteeing the free exercise of religion), freedom of speech, freedom of the press, the right to peaceful assembly, and the right to petition the government for a redress of grievances.