On July 16, New York City Mayor Zohran Mamdani released a “Rental Ripoff Report,” and one proposal in it got singled out by the press: landlords and brokers would have to make a “clear and conspicuous” disclosure whenever a rental listing uses AI-generated or digitally altered photos or videos, with enforcement coordinated through the listing platforms (official announcement, IBTimes coverage) — note that this is still a policy agenda, not law. The report packs 23 policy items drawn from testimony by more than 2,400 New Yorkers across the five boroughs, gathered at hearings and through online submissions (The Next Web). The rental market already has a name for the practice: housefishing — catfishing’s real-estate cousin, where the apartment in the photos is bright and airy and the one you visit has windows facing a brick wall.

My first reaction to this news wasn’t “another AI regulation.” It was a narrower question: how is this supposed to be enforced? Renters usually discover the mismatch only after touring the unit — sometimes after signing the lease; until then, the photos are all they have. New York’s proposal sounds reasonable, but behind the phrase “require disclosure” sit two problems that, left unsolved, will leave the rule spinning in place.

Problem one: what counts as “AI-edited”

Strictly speaking, almost no listing photo today is unedited. Phone cameras do computational photography by default — one press of the shutter, and algorithms align and merge a burst of frames, then run a long post-processing chain before you ever see an image (Google’s HDR+ paper describes exactly this pipeline, starting from burst raw capture). Take “digitally altered means disclose” literally and every photo gets a label — and once every photo carries the label, the label means nothing. This, to me, is the pit disclosure-style regulation falls into most easily: set the trigger too wide and disclosure degrades into wallpaper.

California’s AB 723, which governs home-sale advertising and took effect January 1 this year (CRMLS industry FAQ), makes the cut with care. The statute explicitly excludes adjustments that don’t change how the property actually looks — lighting, sharpening, white balance, cropping, exposure and other common photo edits — and covers only edits that “add, remove, or change elements” in the image: furniture, flooring, walls, landscaping, including neighboring properties visible from the home. The EU’s AI Act Article 50 (applicable from August 2 — two weeks from now) carves out a similar exception: AI performing an assistive function for standard editing, or edits that don’t substantially alter the content’s semantics, are exempt from marking. All New York has published so far is the “clear and conspicuous disclosure” requirement itself. Where the line gets drawn awaits rulemaking by the Department of Consumer and Worker Protection (DCWP) — and that is precisely the part the whole scheme lives or dies on.

Problem two: who can prove the photo was touched by AI

Suppose the boundary gets defined cleanly. The next problem is evidence. Here’s the intuitive mistake: point an AI detector at the image. Anyone who has worked in content safety knows this road doesn’t go through — detection models generalize poorly to generators they haven’t seen, and even the research aimed specifically at generalization treats “hard to identify outputs from unseen generators” as the accepted premise of the problem (GenDet, arXiv:2312.08880). At that false-positive/false-negative level, detection is fine as a lead; absent other evidence, it shouldn’t carry enforcement on its own. Nor can you count on C2PA-style provenance metadata — Tim Bray’s hands-on testing found that social platforms and publishing software strip image metadata almost universally. If DCWP’s enforcement plan is built on “detect the AI,” it’s built on sand.

The clever thing about AB 723 is that it routes around detection entirely: the disclosure statement must be accompanied by a link or QR code pointing to the unaltered original image. In effect, that reverses the direction of verification — the enforcer doesn’t have to prove the image was AI-edited; put the ad photo next to the posted original and whether anything changed, and what, is obvious at a glance. Anyone who finds the listing doesn’t match reality has their complaint evidence ready-made. There is no AI forensics anywhere in this chain — the statute never mentions detection; verification closes on the disclosure statement plus the side-by-side. My call: whether New York’s eventual rule works comes down to whether DCWP copies the keep-the-original provision.

The other enforcement handle is the platforms. DCWP is already coordinating with StreetEasy and Zillow (The Next Web), which beats auditing landlords door to door: a platform can add a mandatory disclosure field to its upload pipeline and bake the label into the image display layer rather than burying it in the listing text — once an image gets re-shared or syndicated onto another page, a caption won’t necessarily follow it. There’s a nice wrinkle here: Zillow itself launched AI-powered virtual staging last September — buyers on Showcase listings can have AI restyle an empty room in seven design styles. At first glance that’s the referee joining the match. But look at the product design — a dedicated icon on the image, a slider that flips back to the original at any time — and it’s exactly the interaction template for “disclosure plus verifiable original.” The only difference is who turns the filter on: a buyer applying it to themselves versus a seller applying it covertly. Regulation is there for the second case.

What about watermarks? Generated images are labeled; AI-edited ones are barely starting

Anyone working in responsible AI will have thought of the other road by now: watermarking and provenance. For purely AI-generated images, that infrastructure is taking shape — Google’s SynthID embeds an invisible watermark directly into the pixels, and decoding it confirms whether an image came from Google’s own models; China’s Measures for Labeling AI-Generated Synthetic Content, in force since September 2025, go further: Article 5 requires the implicit label to carry the service provider’s name or code and a content ID, so decoding tells you not just “this is AI” but whose AI and which generation job. But housefishing’s home turf isn’t generation — it’s editing. The photo is real; it’s the brick wall outside the window that AI painted away. Do edits get watermarks too?

At the regulation layer, the obligation is already on the books. The machine-readable marking duty in EU AI Act Article 50 reads “detectable as artificially generated or manipulated” — manipulation sits right beside generation, so AI edits are in scope. China’s labeling measures define their object as content “generated or synthesized using AI”; the text never names “editing” as a separate act, but reading AI-edited output as “synthesis” is the natural reading.

Vendor practice is just getting started. Since February 2025, Google has embedded SynthID watermarks in photos edited with the Reimagine feature in Magic Editor (official announcement) — the watermark extended from generation to editing. But the announcement itself states the limitation: some edits — say, changing the color of a small flower in the background — may be too small for SynthID to label or detect. That is problem one replayed at the pixel level: “how small an edit still counts” is a line that runs from the statute books all the way down into the watermark layer.

On the same vendor side, Microsoft bet on a different route: instead of hiding a signal in the pixels, sign the file. C2PA, which keeps showing up in this piece, is a coalition Microsoft co-founded — in 2021 it joined the BBC in bringing Adobe, Arm, Intel and Truepic together to establish it (Microsoft official blog), with earlier groundwork in Microsoft Research’s AMP provenance framework and Project Origin, a media collaboration with the BBC, CBC and The New York Times. In products: Bing Image Creator automatically attaches C2PA-conformant content credentials to generated images, recording creation time and AI origin (Bing official blog); Azure OpenAI’s image models attach a cryptographically signed manifest to every output, with a signature chain tracing back to Microsoft, verifiable at contentcredentials.org (Microsoft Learn documentation). For the “editing” question this essay cares about, the signature route is actually the more expressive one: C2PA credentials are designed to record a content item’s origin and edit history — a manifest can keep appending “who changed what, when,” which holds far more information than a single is-it-AI watermark bit. Its weakness is exactly the one from problem two: credentials live in file metadata, the very layer Tim Bray watched platforms strip — and once stripped, verification returns “no credentials found,” not an alarm. So as I see it, pixel watermarks and signed credentials aren’t an either/or; they patch each other’s holes — one clings to the image but can’t carry more than a few bits; one carries a full résumé but keeps getting lost in the distribution chain.

One research thread flips the direction outright. EditGuard, from CVPR 2024 (arXiv:2312.08883), doesn’t expect AI editors to cooperate in labeling. Instead it embeds a watermark into the original image in advance; after the image is altered, the damage pattern in the decoded watermark localizes the tampered region — the paper reports localization accuracy above 95%. Mechanically, this is the same move as AB 723’s keep-the-original rule: both preserve a checkable record of the pre-edit state — one posts the original behind a link, the other hides the original’s fingerprint in the pixels.

But treating watermarks as an enforcement handle you could use tomorrow skips two steps. First, coverage: watermarking obligations fall on toolmakers. SynthID covers only Google’s own pipeline, and content credentials follow only tools that adopted C2PA; regulators don’t get to pick which tool a landlord edits with, and images from uncooperative tools — a locally run open-weights model, say — come out clean. Second, verification: metadata-based marks (C2PA, and the implicit labels China’s measures require in file metadata) get stripped in distribution — see Bray’s tests above; pixel-level watermarks survive re-saving and re-sharing, but decoding them requires the vendor’s own detection endpoint, so the enforcement loop can’t close without vendor cooperation. My judgment stands: watermarking is long-term infrastructure worth building out, and the EU’s marking obligation kicking in this August will push vendors in that direction — but DCWP’s rules can’t wait out that cycle. What closes the loop today is still keep-the-original plus comparison.

Not just apartments: e-commerce already ran this play

The same script has already played out in China’s e-commerce market — with a fuller plot. A January investigation by Legal Daily (a state-run legal-affairs newspaper) catalogued the typical complaints: a “soft fluffy bunny charm” with glossy fur and bright eyes in the ad arrives with coarse fur and crooked eyes; a Siamese-cat plush pre-sold for four months shows up pilling and unevenly colored, and the seller flatly admits the promo image was AI-generated. A CCTV.com reporter ordered a “Dunhuang flying apsara cat” toy and received something whose face and body looked flattened; the seller’s explanation was that “the pictures look good because our photographer is skilled.” Upstream, there’s a ready supply chain: influencers hawk AI image tools to merchants — 299 yuan a month to batch-generate hundreds of “photo-realistic” product shots. A May field test by Shanghai Observer sampled 20 product images at random across e-commerce platforms; detection tools flagged more than half as showing signs of AI generation.

What’s worth noticing is that e-commerce’s two governance routes map exactly onto the two problems above. Taobao’s rules against AI fake imagery, issued in March 2025 (reportedly the first such rules from an e-commerce platform), cut the violation boundary at the outcome rather than the tool: what’s policed is material or style mismatched with the actual goods, grossly distorted effects, physically impossible human bodies — the “not what was advertised” category — with no interrogation of whether AI was involved. That’s the same idea as California’s routine-adjustment exemption. And the platform built interception straight into the upload pipeline — after deploying its detection model it has reportedly blocked nearly 100,000 fake images. The other route is the labeling measures mentioned earlier: explicit plus implicit labels, with obligations on generators and distribution platforms — the mainline is marking content at the moment of generation, directionally aligned with the EU’s Article 50 machine-readable marking (the measures also require platforms to check unlabeled content for generation traces, but that’s the backstop, not the load-bearing wall). The scholars Legal Daily interviewed point out the other half of enforcement: an unlabeled AI image that misrepresents the goods can constitute fraud, letting consumers claim a refund plus triple compensation under the Consumer Rights Protection Law.

Nor is this script exclusive to China. TikTok Shop’s new AI content rules took effect July 13 — three days before New York’s report. The cut is almost a carbon copy of Taobao’s: no using AI to change a product’s size, color, material or other visible characteristics; no fabricated or exaggerated performance; content fully generated or significantly edited by AI must be labeled; color grading, cropping, noise reduction and other routine edits are exempt; penalties escalate from warnings through reach restrictions to permanent bans for severe fakery. Outcome-based trigger, routine-edit carve-out, enforcement pushed onto the platform — every puzzle piece assembled above, present and accounted for. The US federal action lands in a different spot: the FTC’s rule on fake reviews and testimonials (rule text in the Federal Register) took effect in October 2024 and explicitly bans AI-generated fake reviews, with civil penalties attached — it governs the review section rather than product images, but the logic is the same brand: target the deceptive outcome of impersonating a real consumer, and don’t ask which tool manufactured the fake. In the EU, misleading product imagery was already covered by the 2005 Unfair Commercial Practices Directive — the same role New York’s General Business Law § 349 plays at home; the next round of consumer legislation for digital environments, the Digital Fairness Act, is still at the proposal stage, aimed at dark patterns and misleading influencer marketing.

Meanwhile, China’s consumer-facing practice is drifting back toward the detection road: the National Anti-Fraud Center app shipped an “AI content identification” feature, and Shanghai Observer’s 20-image test used it alongside third-party tools. Detection as a tip-off is fine — it tells consumers to look twice and gives journalists a story to test — but the moment it’s asked to serve as evidence, none of the generalization problems go away. What actually makes e-commerce disputes resolvable is a condition the rental market doesn’t have: the goods ship to the consumer, so the product itself is the original image — comparison happens at delivery, and returns and damage claims come with ready handles. Renting is different: you either waste the trip or discover the deception after signing, and the cost of correcting course is far higher. Which is exactly why property advertising needs the original retained up front: if the goods won’t ship themselves to your door, the advertiser has to be made to post the stand-in.

What’s still missing

Compared side by side, there’s one place New York goes further than California — and will have a harder time landing: scope. AB 723 governs licensed real estate brokers, salespersons, and people acting on their behalf, and covers only home-sale advertising (bill text) — the license is a ready-made enforcement handle, and the bill digest notes that willful violations of the Real Estate Law are crimes. New York’s proposal targets the rental market, which includes plenty of landlord-direct, no-broker listings (the city DCWP’s FARE Act guidance treats these as their own category) — there’s no license to revoke. Putting landlords under the obligation is right (otherwise the rule misses the slice of the market most prone to housefishing), but the report has no answer yet on enforcement costs against small landlords or on penalty design. Nothing published so far specifies fine amounts either — and New York already has a consumer-protection statute banning deceptive business practices (New York General Business Law § 349) under which a misleading photo may already be unlawful. The new rule’s real increment is converting “prove deception” (under the case law’s three-element test — consumer-oriented conduct, materially misleading, causing injury, proven case by case: Himmelstein v. Matthew Bender) into “check the disclosure” (edited or not, labeled or not — ticked off clause by clause), which stands to save a large share of the per-case litigation cost. If the penalties end up set too low to sting, that increment never gets cashed in.

Put the three regimes side by side — the EU reaching model providers (machine-readable marking) and deployers (disclosure duties), California making sale ads keep the original, New York trying to reach landlords through the platforms — and each covers one segment, but assembled they form one enforceable scheme: cut the trigger cleanly (the EU and California both wrote routine-editing exemptions), put the evidence-preservation duty on the advertiser (California already requires the original be accessible), and place the enforcement chokepoint at the platform (New York is coordinating with platforms; details pending). E-commerce confirms the same assembly from the other end: Taobao and TikTok Shop independently defined violations by the not-what-was-advertised outcome and built interception into platform pipelines, while China’s labeling measures put the marking duty on generators. Detection does have a place in these schemes — Taobao’s screening model, the platform-side trace checks in the labeling measures — but always as auxiliary interception; the violation finding rests on labeling obligations and mismatch with reality, and not one of these regimes bets its success on recognizing AI. The least important piece of the puzzle is precisely the one public intuition ranks first: identifying AI. For people building generative image products, that’s a practical signal: rather than wait out the detection arms race, build original-photo retention and display-layer labeling into the product pipeline now — California has already written the former into law, and whether New York’s rules follow suit is worth watching.

References