Illinois’ new school cyberbullying law arrived at the exact moment districts are being forced to confront a faster, more personal form of digital harm. House Bill 3851, effective July 1, 2026, updates Illinois’ School Code so that beginning with the 2026-2027 school year, cyberbullying includes the posting or distribution of an unauthorized digital replica by electronic means when it creates the same kinds of harms already covered by the state’s bullying definition. The law also requires the Illinois State Board of Education to develop statewide guidance on artificial intelligence in schools.
That puts Illinois ahead of many districts that are still treating AI misuse as a technology-policy footnote. Deepfake bullying is not only a student discipline issue. It touches privacy, sexual harassment, image-based abuse, digital literacy, school safety, law enforcement referrals, family communication, and the limits of what administrators can control once synthetic images spread through group chats. The law gives schools a clearer vocabulary. The school year will test whether policy, training, and student support can move just as fast.
What Illinois Changed Before The 2026-2027 School Year
The Illinois General Assembly’s HB3851 record shows how the law evolved. The bill amends 105 ILCS 5/27-23.7, the School Code section dealing with bullying prevention. The legislative synopsis says the bill adds sexually explicit images to the bullying provisions and, beginning with the 2026-2027 school year, expands cyberbullying to include unauthorized digital replicas posted or distributed electronically if the conduct creates bullying-type effects. The bill record identifies Rep. Janet Yang Rohr as the House sponsor and Sen. Meg Loughran Cappel as a lead Senate sponsor, with several co-sponsors across the legislative process.
The law’s wording matters because it does not treat every AI-generated image as school bullying. It focuses on unauthorized digital replicas and ties the conduct to harms already recognized in the bullying definition. That structure gives districts a way to respond to deepfake abuse without claiming that every AI prank, parody, or classroom experiment belongs in the same category.
The official Illinois HB3851 record says “unauthorized digital replica” means use of a digital replica of an individual without the consent of the depicted individual. That definition helps school leaders name the core problem: a student’s likeness can be copied, altered, sexualized, mocked, or weaponized without consent, and the harm can happen even if the image is fake.
For The Parative Project’s ongoing education technology coverage, the law fits into the same accountability sequence as Houston ISD’s AI classroom expansion. Districts are adopting AI tools for instruction, operations, and future-ready learning. At the same time, students can use similar technologies to harm classmates. A credible AI policy must address both sides.
Why Lake Zurich Became A Warning For Illinois Districts
Recent Capitol News Illinois reporting described how Lake Zurich High School administrators confronted an incident earlier in 2026 involving students who used artificial intelligence to create sexually explicit images of classmates. After reporting the matter to police, Lake Zurich Community Unit School District 95 launched student and family education efforts focused on online safety and responsible technology use.
That local example shows why the new law is not theoretical. AI-generated images can move quickly from a private device to a schoolwide safety crisis. A student may be harmed even when no real photo was taken. A fake image can still trigger humiliation, harassment, fear, rumors, retaliation, and school avoidance. Once the image circulates, administrators may need to preserve evidence, protect the targeted student, contact families, involve police, discipline students, and prevent further sharing.
Capitol News Illinois reported that Jean Malek, executive director of communications for Lake Zurich District 95, said the district anticipates continued explicit teaching opportunities for students about safe and responsible technology use and continued information sharing with families. The same reporting said Township High School District 214 Superintendent Scott Rowe viewed the new law as a way to give districts clearer language for policies, student expectations, and family conversations.
Those details point to the gap Illinois is trying to close. A district may already have anti-bullying rules, acceptable-use policies, and harassment procedures. Yet staff members still need language that fits the new harm. Calling an AI-generated sexualized image “fake” can minimize the impact. Calling it bullying, harassment, or possible image-based abuse gives schools a more accurate response path.
Digital Safety Must Move Beyond Device Rules
Many school technology debates this year have focused on reducing screen time, limiting cellphones, or making school-issued devices more transparent. Those debates remain important. Illinois’ deepfake law adds another layer: schools also need policies for what students create and share, not only how long they spend on devices.
A cellphone policy can reduce distraction. A Chromebook monitoring policy can clarify browsing records. An AI classroom policy can govern teacher and student use of generative tools. A deepfake bullying policy must do something different. It has to define consent, likeness, distribution, reporting, preservation of evidence, student support, consequences, family notice, and coordination with law enforcement when conduct may cross into criminal territory.
The distinction is especially important because students do not need advanced technical skills to create harm. Image-generation and face-swapping tools have become easier to use, and some tools can create convincing images from ordinary photos. That means schools cannot wait for an incident before explaining the rule. Students need to know that creating, requesting, forwarding, saving, reposting, or joking about an unauthorized digital replica can extend the harm.
The Center for Democracy & Technology’s 2024 report, In Deep Trouble, found that 40% of public school students surveyed were aware of a deepfake involving someone at their school, and 15% knew of a sexually explicit deepfake depicting a member of their school community. It also found that many educators said their schools had not shared clear policies or procedures about AI-generated sexual imagery.
That data explains why Illinois’ July 1 timing matters. Districts need policy language before school begins, but policy language alone will not be enough. Students, parents, teachers, counselors, school resource officers, and administrators need a shared understanding of what the law means in everyday school life.
What State Guidance Still Needs To Clarify
HB3851 also requires the Illinois State Board of Education to develop statewide guidance on artificial intelligence in schools. Capitol News Illinois reported that ISBE press secretary Lindsay Record said the agency was still developing guidance and that local policies, procedures, and responses to specific incidents remain determined at the district and school level.
That is a practical division of authority. The state can define broad expectations, explain AI-related risks, and help districts align policies. Local districts must still handle incidents, student discipline, family contact, evidence procedures, staff training, and support plans. The strongest ISBE guidance should therefore be specific enough to help districts act, but flexible enough to fit elementary schools, middle schools, large high schools, rural districts, and suburban systems with different staffing levels.
The guidance should clarify several operational issues. Schools need to know how to distinguish ordinary bullying, sexual harassment, image-based abuse, and criminal referral situations. They need guidance on protecting targeted students without forcing them to repeatedly describe the harm. They need procedures for asking students to delete or stop sharing images without destroying evidence needed for an investigation. They need template language for family notices that avoids spreading explicit details.
The state should also address staff training. A principal, counselor, teacher, coach, bus supervisor, and technology director may all be the first adult to hear about an AI deepfake incident. If only administrators understand the policy, the first response may be slow or inconsistent. Staff need a short, clear protocol: receive the report, protect the student, do not request unnecessary copies, preserve available evidence through authorized channels, involve designated administrators, and contact families according to district rules.
Why Students Need Education, Not Only Punishment
Illinois districts will need consequences for harmful conduct. The law’s purpose would be weakened if students could create or distribute unauthorized digital replicas with no school response. Yet punishment alone will not solve the problem, especially when students may not understand that sharing a fake image can be as damaging as making it.
Digital safety education should begin before an incident. Students should learn that consent applies to likeness, not only physical contact. They should learn that “it was AI” does not erase responsibility. They should learn that forwarding, saving, or laughing along can deepen harm. They should learn how to report safely, how to support a targeted peer, and why deleting evidence without telling an adult can make it harder to stop the spread.
This is also a bystander education issue. Many students who encounter a deepfake may not be the creator or the target. They may be in the group chat where the image appears. They may be asked to forward it. They may fear social backlash if they report it. A strong school policy gives those students a clear path to act without turning them into public accusers.
Digital literacy should include AI realism. Students need to understand that synthetic media can look convincing, can travel fast, and can create real harm even when the original image is false. They should also learn that accusations must be handled carefully. Schools should avoid public shaming, rumor amplification, or informal “investigations” by students.
The goal is not to scare students away from every AI tool. It is to teach ethical use. AI can support learning, creativity, accessibility, and future-ready skills. The same tools can be misused for harassment. Schools have to teach that difference plainly.
How District Policies Should Be Updated Before Classes Resume
Illinois districts should treat HB3851 as more than a legal edit to a handbook. The policy update should be visible, trainable, and practical.
A strong district update should include a plain-language definition of unauthorized digital replica, examples that avoid graphic detail, a reporting process for students and families, designated staff roles, preservation-of-evidence steps, student-support procedures, discipline ranges, referral criteria, and prevention lessons. Districts should also align the policy with sexual harassment, nondiscrimination, acceptable technology use, student discipline, Title IX procedures where relevant, and law enforcement memoranda.
| Policy Area | What Districts Should Add |
|---|---|
| Student Handbook | Plain-language rule on unauthorized AI replicas and sharing |
| Bullying Policy | Specific reference to digital replicas under cyberbullying |
| Reporting Procedure | Anonymous and direct reporting paths for students and families |
| Staff Training | First-response protocol for teachers, counselors, and administrators |
| Family Communication | Clear explanation of student rights, privacy, and support steps |
| Digital Literacy | Lessons on consent, AI realism, bystander conduct, and reporting |
The policy should also avoid overpromising. Schools cannot always erase an image from every device or platform. They may not be able to identify every student who viewed it. They may need law enforcement or platform support. What they can promise is a clear, rapid, student-centered response.
The most vulnerable moment is the first report. If a student believes adults will minimize the harm, blame the target, or spread the image further, the student may stay silent. Districts should make reporting feel safe before the first incident of the year.
What Families Should Know About The New Law
Families need a practical explanation of HB3851 before school starts. Parents should know that Illinois now recognizes unauthorized AI-generated digital replicas as a potential form of cyberbullying when the conduct creates bullying-type harm. They should also know that the law does not make every AI image a school discipline matter. Context, consent, distribution, harm, and school policy will matter.
Families should talk with students about ordinary photos too. Many deepfake incidents begin with images taken from social media, school directories, athletic pages, group photos, or student accounts. Parents may want to review privacy settings, photo-sharing habits, and whether public images of minors are necessary. Schools should do the same for event photos, yearbook-style galleries, classroom pages, and athletic promotions.
That does not mean families should panic or remove children from online life. It means the risk environment has changed. A harmless-looking image can become source material for synthetic abuse. Students should understand that using someone’s image without consent is not harmless because the output is fake.
Families should also know what to do if their child is targeted. They should avoid forwarding the image widely, preserve available evidence safely, contact the school’s designated administrator, consider whether law enforcement should be involved, and ask what support will be provided. If the image is sexualized or appears to depict a minor, families should avoid unnecessary distribution and follow school and legal guidance carefully.
Why The Illinois Model Matters Beyond One State
Illinois’ law is a useful model because it connects school policy to the specific features of AI harm. It does not only say “be safe online.” It names unauthorized digital replicas as a cyberbullying concern, requires state-level AI guidance, and gives local districts a clearer starting point for the 2026-2027 school year.
Other states will face the same issue. Deepfake bullying does not stop at state borders, and students often use national platforms, apps, and AI tools. Districts outside Illinois should not wait for their own legislatures to act. They can review policies now, add definitions, train staff, teach students, and create reporting pathways before the first crisis.
The broader lesson is that school digital safety policies must catch up to the tools students already have. Screen-time limits, cellphone restrictions, Chromebook transparency, and AI classroom rules all matter. Yet none of them are complete without a plan for synthetic media abuse. A district can reduce devices during class and still face an after-school deepfake incident that disrupts the entire school community the next morning.
Illinois has given districts a legal vocabulary. The next test is implementation: whether schools can protect targeted students, educate bystanders, hold creators and distributors accountable, work with families, and build digital safety lessons that match the speed of generative AI. The school year will show whether the policy is a handbook update or a real safety system.