In short
- California's AB 723 added Business and Professions Code § 10140.8, operative since January 1, 2026, for real estate licensees and anyone acting on their behalf.
- An advertisement that uses a digitally altered image needs a reasonably conspicuous statement on or next to the image, and a link, URL or QR code to a publicly accessible page showing the unaltered original.
- A visible disclosure mark and a SHA-256 fingerprint do different jobs: the mark tells the viewer the image is altered; the fingerprint proves which exact file was produced.
- Vesta burns the disclosure mark into the pixels of every render, publishes each original on a public page, and records a SHA-256 fingerprint of every render and export in an append-only ledger.
- A fingerprint match proves a file is byte-for-byte what Vesta produced. It does not prove an advertisement complied with the law, and portal copies usually will not match because portals recompress photos.
- Vesta does not embed C2PA content credentials or an invisible watermark.
AI has made it cheap to change a listing photo. A sofa, a greener lawn, a dusk sky or a fresh coat of paint takes minutes. Regulators have noticed, and California now has a statute aimed squarely at altered images in real estate advertising. This article explains what that law asks for, how the two technical tools most often mentioned alongside it, visible disclosure marks and cryptographic hashes, actually work, and where the line sits between what software can do for you and what remains your responsibility.
AB 723 in brief
Assembly Bill 723 was chaptered in October 2025 as Chapter 497 of the Statutes of 2025. It added § 10140.8 to California's Business and Professions Code, and it has applied since January 1, 2026. It is a short section. It applies to a real estate broker or salesperson, or a person acting on their behalf, who includes a digitally altered image in an advertisement or other promotional material for the sale of real property.
What counts as digitally altered
The statute is aimed at images changed with photo-editing software or artificial intelligence to add, remove or change elements of the property, such as furniture, fixtures, appliances, flooring, walls, paint colour, landscaping or the facade, and features outside the property such as utility poles or neighbouring buildings. Routine photographic adjustments such as lighting, white balance, colour correction, sharpening, straightening, cropping and exposure are carved out, provided they do not change how the property is represented.
In practice, treat virtual staging, furniture removal, decluttering, sky replacement, twilight conversion, lawn and season changes, pool water and finish changes as digitally altered. Every tool on the tools page that changes the property's contents falls on that side of the line. Treat a well-exposed, straightened photo of the room as it is as not altered.
The two obligations
| Obligation | What the statute asks | What Vesta provides | What remains with you |
|---|---|---|---|
| Statement | A reasonably conspicuous statement, on or adjacent to the image, that it has been altered | A disclosure mark burned into every render, on every plan | Not cropping or covering it, and adding a statement beside the image where the layout calls for one |
| Original | A link, URL or QR code to a publicly accessible page that includes the unaltered original and clearly identifies it as the original | A public page per staged photo, a QR code on exports by default, and one originals link per listing | Placing the QR or link in every advertisement that uses the altered image |
Where the advertisement is on a website the broker or salesperson controls, such as their own listing site, the statute asks for the unaltered images to be included in the posting itself. It is also sensible to write any statement you add so that it tells the viewer where the original can be found, for example: "Virtually staged. See the original photo at the link below." Vesta's own terms ask users to do that.
Outside California
AB 723 is a California statute, and we do not know of an equivalent in other states as of this article's date. Elsewhere, two sets of rules usually apply. State licensing rules generally prohibit misleading advertising; in Texas, for example, TREC's advertising rules say so. And MLS rules often require virtually staged photos to be labelled, sometimes with an unstaged version of the same room. Because those rules vary and change, check them for each MLS you list in. Disclosing to the California standard everywhere is the simplest way to stay inside all of them. Our Texas guide covers one market in more detail.
Disclosure marks and fingerprints are different tools
The phrase "SHA-256 watermarking" is common, but it blends two separate things. A watermark is something you can see in the picture. A SHA-256 hash is a number computed from the file. They answer different questions, and it helps to keep them apart.
| Visible disclosure mark | SHA-256 fingerprint | |
|---|---|---|
| What it is | Text and a graphic in the image's pixels | A 64-character value computed from the file's exact bytes |
| Who it is for | The buyer looking at the photo | Anyone later checking which file was produced |
| Question it answers | Has this image been altered? | Is this exactly the file that was produced and recorded? |
| Survives recompression | Yes, because it is part of the picture | No; any change to the bytes gives a different fingerprint |
| Required by AB 723 | A statement is required; a mark is one way to provide it | No; it is a record the law does not ask for |
How Vesta's disclosure mark works
When a render finishes, Vesta composites a disclosure chip into the bottom-right corner of the image before anyone sees it. It reads "AB-723 · AI VIRTUAL STAGING · DISCLOSED" and is sized relative to the width of the image so it stays legible at listing sizes. There is no setting that turns it off. A paid plan can remove the separate Vesta studio mark, but never the disclosure. Because the chip is part of the pixels, it travels with the image through every portal and every recompression.
At export, Vesta can also print a QR code in the bottom-left corner, labelled "Scan for the original photo", that opens the public page for that frame. It is on by default. Many MLSs do not allow QR codes inside listing photos, so you can switch it off at export and use the listing's originals link instead. The stored master image is never changed by this step, which keeps its fingerprint valid.
How the originals pages work
Each staged frame can have a public page that shows the photo you uploaded, labelled as the original, beside its staged version. Each listing can have one page that collects every original in it, which is the link to put in MLS remarks. The pages open without an account. Their addresses use long random tokens, created only when a link is first requested, so nothing becomes public by default and a page cannot be found by guessing. If you close your account or delete a project, the pages stay available for 12 months unless you ask for them to be removed sooner.
How the SHA-256 ledger works
What a hash is
SHA-256 is a cryptographic hash function. It turns a file of any size into a 64-character hexadecimal fingerprint. The same bytes always give the same fingerprint, a change of a single byte gives a completely different one, and it is not practical to construct a different file with the same fingerprint. A matching fingerprint therefore means the same file, not a similar one.
What Vesta records
- When a render is finished and the disclosure applied, Vesta fingerprints the result and writes a ledger entry with the fingerprint, the version of the disclosure mark it carries, and the time.
- When you export, the delivered file, which may be resized, re-encoded or carry the QR code, is fingerprinted and recorded again, because it would otherwise not match the render.
- The ledger is append-only. A database trigger rejects any attempt to update or delete an entry, so the record cannot be quietly changed afterwards by a customer, a support request or Vesta.
How anyone can check a file
The compliance page has a public lookup. Choose an image and your browser computes its SHA-256 locally; the image is never uploaded, and only the fingerprint is sent. If Vesta recorded that exact file, the lookup says whether it was a render or an export, which disclosure version it carried, and the date it was recorded. It reveals nothing about who produced it. You can also paste a fingerprint you computed yourself.
What the record proves, and what it does not
- It proves that a file you hold is byte-for-byte a file Vesta produced, and that it carried a given disclosure version on a given date.
- It does not prove that an advertisement complied with AB 723. Compliance also depends on where the image appeared, whether the statement was conspicuous in that layout, and whether the link to the original was there. Vesta cannot see your advertisement.
- It does not survive recompression. MLS systems and portals usually recompress uploaded photos, so a copy downloaded from a portal will almost never match. The disclosure mark is still visible on that copy, because it is in the pixels.
- It is not embedded provenance. Vesta does not write C2PA content credentials or an invisible watermark into the file. The record lives in Vesta's ledger, not inside the image.
For a deeper look at hashing and recompression, see proving what you published.
A compliance workflow for altered listing photos
- Keep every original capture, named so it can be matched to its altered version.
- Alter only what is honest to alter. Furniture, decor, sky and light, with care. Never structure, defects or views.
- Review each altered image against its original before it is published.
- Export for the destination. QR on where it is allowed; QR off and the originals link in the remarks where it is not.
- Place the statement and link in every advertisement: MLS, portals, your own site, social posts, email and print. On your own website, include the original in the posting.
- Keep the exported files exactly as delivered, with the listing records. They are the files the ledger can match.
- Check your MLS's current rules for each market you list in, and record them in your brokerage policy.
Where responsibility sits
Vesta is a software provider, not a real estate licensee, and is not the party disclosure laws regulate. Its disclosure mark, originals pages and ledger are tools that make compliance easier. Using them does not by itself make an advertisement compliant, because the licensee decides where the image appears and how the ad is laid out. If you are building a brokerage process around these tools and want to talk it through, contact us.
Questions this article answers
When did AB 723 take effect?
AB 723, Chapter 497 of the Statutes of 2025, added Business and Professions Code § 10140.8, which has applied since January 1, 2026.
Who does AB 723 apply to?
California real estate brokers and salespeople, and people acting on their behalf, who use a digitally altered image in an advertisement or promotional material for the sale of real property.
Does AB 723 require a SHA-256 hash or watermark?
No. It requires a reasonably conspicuous statement that the image is altered and a link, URL or QR code to the unaltered original. Vesta's SHA-256 ledger is an additional record the law does not require.
Why does my downloaded listing photo not match the Vesta ledger?
Most MLSs and portals recompress uploaded photos, which changes the file's bytes and therefore its SHA-256 fingerprint. Check the file exactly as you exported it from Vesta instead.
Does Vesta embed C2PA content credentials?
No. Vesta burns a visible disclosure mark into each render and records SHA-256 fingerprints in its own append-only ledger. It does not write C2PA credentials or an invisible watermark into the file.
Are lighting and colour corrections digitally altered images under AB 723?
The statute carves out adjustments such as lighting, white balance, colour correction, sharpening, straightening, cropping and exposure, as long as they do not change how the property is represented.