Georgia

Georgia has no comprehensive AI risk-management statute; its AI-specific enactments are narrow and sector-specific.

Senate Bill 9 (2025-2026 session), the “Ensuring Accountability for Illegal AI Activities Act,” which would have criminalized AI-generated child sexual abuse material and provided enhanced sentencing for AI-assisted crimes, died when the Senate disagreed to the House's committee substitute on January 28, 2026 and the 2025-2026 biennium ended at Sine Die on April 2, 2026 with no further recorded action.

Several trackers and AI-generated legal summaries describe a Georgia ‘SB 9’ as an election deepfake disclosure and criminalization measure amending Title 21 (Elections); no such measure exists under that bill number for the 2025-2026 session, and the SB 9 on file at the General Assembly is the AI-generated child sexual abuse material bill described above.

Senate Bill 540 was enacted as 2026 Ga. Laws Act 518, signed May 11, 2026 and effective July 1, 2027, adding O.C.G.A. § 39-5-6 to Title 39, Chapter 5 to regulate 'AI companion chatbots' with disclosure, minor-protection, crisis-response, and age-assurance duties enforced by the Attorney General; the enacted text is narrower than an earlier committee substitute that would have reached 'conversational AI services' generally.

Senate Bill 444 (2025-2026 session), published by the Governor's office among Georgia's 2026 signed legislation, adds O.C.G.A. § 33-46-7.1 to the private review agent certification chapter: a private review agent or utilization review entity may use artificial intelligence in a utilization review, but the system may not issue an adverse coverage determination until a natural person qualifying as a private review agent, with a clinical peer participating, has reviewed it; the Act's own text sets its effective date as January 1, 2027.

A broader AI Accountability Act, Senate Bill 37, which would have required state agencies and municipalities to publish AI usage plans and created a Georgia Board for Artificial Intelligence, died in committee without a floor vote when the 2026 session ended and binds nobody. Georgia has not enacted a general AI risk-obligations, training-data-transparency, or algorithmic-discrimination statute.

Georgia has no comprehensive consumer-privacy statute. A genuine comprehensive bill, SB 111 (2026), titled the Georgia Consumer Privacy Protection Act, passed the Senate, but the House replaced its entire text with unrelated rural-hospital tax-credit provisions before Governor Kemp signed the substituted bill on May 11, 2026, so no privacy law was actually enacted under that number.

Georgia's operative privacy statute is the narrow Georgia Personal Identity Protection Act, O.C.G.A. Secs. 10-1-910 to 10-1-915, a breach notification and identity-theft statute whose personal information definition covers only a name combined with a Social Security number, driver's license or state ID number, or an account, credit card, or debit card number, with no biometric, genetic, or health category and no general data-subject rights; Georgia courts have held the Act creates no freestanding data-security duty.

The identity-theft statute itself creates no private right of action, but Georgia's general Fair Business Practices Act separately arms a person injured by a deceptive trade practice with an individual civil action for injunctive relief and damages.

O.C.G.A. Sec. 10-1-911's definition of personal information names no biometric, genetic, or health category, and the Attorney General's Consumer Ed guidance describes the covered data in the same terms (a name combined with a driver's license or credit card number).

Georgia diverges from the federal baseline through its own Computer Systems Protection Act, O.C.G.A. § 16-9-93, which criminalizes computer theft, computer trespass, computer invasion of privacy, computer forgery, and computer password disclosure whenever committed 'without authority,' a term the Act defines to include use that 'exceeds any right or permission granted by the owner of the computer or computer network.'

Unlike Virginia's narrower malicious-intent standard, Georgia's authorization test tracks the federal Computer Fraud and Abuse Act's own exceeds-authorized-access language, so ordinary unauthenticated access to a public page that grants and denies no permission at all does not, on its own text, satisfy the statute's authorization element, though no Georgia court decision applying the Act to a scraping or automated-collection fact pattern specifically was located.

The Act arms a private civil action for damages alongside its felony-level criminal penalties. A companion provision in the same article, O.C.G.A. § 16-9-93.1, separately criminalizes using a computer network to falsely identify oneself as another person, organization, or trademark holder (misappropriation of computer identity), a spoofing offense rather than one reaching automated collection of public data.

Copyright, text-and-data-mining, and database rights are federal only; Georgia adds nothing there. Terms-of-service enforceability rests on ordinary Georgia contract law, and no Georgia-specific browsewrap or clickwrap precedent was located. robots.txt carries no independent legal weight under Georgia law. Georgia has no comprehensive privacy statute reaching scraped public personal data; see this jurisdiction's privacy topic document for the narrow breach-notification statute that does exist.

Georgia's private-sector security-topic footprint is narrow: one enacted state statute imposes a genuine record-disposal duty distinct from breach notification, no enacted state law sets market-entry security requirements for a connected device or software product, no state law creates a general private-sector duty to report a vulnerability or a security incident to an authority, and no state regime was located adopting the newer NAIC Insurance Data Security Model Law.

O.C.G.A. Sec. 10-15-2 (Title 10, Commerce and Trade), part of a chapter (O.C.G.A. Secs. 10-15-1 to 10-15-7) that already had at least one provision in force by July 1, 2004 (the same chapter's receipt-truncation section, O.C.G.A. Sec. 10-15-3(b)(1), states that date for its own first phase-in; the disposal duty's own commencement date is not stated in the unannotated code text consulted here), requires a 'business,' defined broadly to include a sole proprietorship, partnership, corporation, association, or other group organized for profit or not, and expressly including a financial institution and an entity that destroys records, to shred, erase, modify to make unreadable, or otherwise take reasonable action to prevent unauthorized access to a customer's record before discarding it, where that record combines personally identifiable data with a customer's medical condition, an account or credit balance, information supplied when opening an account or applying for a loan or credit, or a federal, state, or local income tax return.

The duty carves out a bank or financial institution subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a hospital or health care institution subject to Health Insurance Portability and Accountability Act (HIPAA)'s privacy and security provisions, and any other entity governed by a federal law that itself requires disposal of such records in the same manner.

The same chapter's O.C.G.A. Sec. 10-15-3 requires a merchant accepting a payment card to truncate the account number and omit the expiration date on a printed receipt, phased in from July 1, 2004 for machines first used on or after that date to July 1, 2006 for all machines; because that duty binds a merchant printing a payment receipt rather than a duty over a software product's security posture or a business's general handling of covered information, and because it substantially overlaps the federal Fair and Accurate Credit Transactions Act's own truncation requirement, it is named here rather than filed as its own instrument.

The same chapter's O.C.G.A. Sec. 10-15-4, which makes it a crime for a person to use a scanning device or reencoder to capture or transfer payment-card magnetic-strip data with intent to defraud, and O.C.G.A. Sec. 10-15-7's felony penalties for that offense (one to three years' imprisonment or a fine of up to $10,000.00 for a first offense, three to ten years or up to $50,000.00 for a second or subsequent offense), bind the intruder who captures the data rather than the system's operator or manufacturer, so both sit with the scraping topic's computer-misuse family rather than here.

O.C.G.A. Sec. 10-15-5 authorizes the Attorney General to enforce the chapter using the Fair Business Practices Act's investigative powers, and O.C.G.A. Sec. 10-15-6 caps an administrative penalty for a violation of the disposal duty at $500.00 per wrongfully discarded customer record with a $10,000.00 total ceiling per order, subject to an affirmative due-diligence defense, with hearings and judicial review under the Georgia Administrative Procedure Act; the chapter states no private right of action of its own.

No enacted Georgia statute was located that sets security requirements a connected device or software product must meet before or after it reaches the market, comparable to California's or Oregon's connected-device statutes or the Cyber Resilience Act, and no enacted Georgia statute creates a general private-sector duty to report an exploited vulnerability or a security incident to a state authority; both are researched absences rather than gaps in coverage.

Georgia's Insurance Code, Title 33, carries a chapter on insurers' collection, use, and disclosure of information (O.C.G.A. Secs. 33-39-1 et seq., the older NAIC Insurance Information and Privacy Protection Act model, itself a privacy-topic matter), but the full Title 33 chapter listing read here, dated by its publisher to March 28, 2024 and running from Chapter 1 through Chapter 65, carries no chapter addressing an insurer's or insurance licensee's information-security program, a cybersecurity event, or a data-security duty comparable to the newer NAIC Insurance Data Security Model Law already adopted in South Carolina, Hawaii, Alaska, Arizona, and Wisconsin, and the Georgia Department of Insurance and Safety Fire Commissioner's own website carries no reference to a data-security or cybersecurity regulatory program either.

A 2025 or 2026 session enactment of the newer model law is not confirmed in the primary text consulted here: the Georgia General Assembly's own legislation-search site, www.legis.ga.gov, serves only a JavaScript application that returned no readable statute text, so a very recent adoption cannot be fully ruled out from the sources read here.

The Georgia Technology Authority (O.C.G.A. Title 50, Chapter 25) has the statutory power 'to establish technology security policies, standards, and services to be used by all agencies' (O.C.G.A. Sec. 50-25-4(a)(20)); nothing in the section read here extends that duty to a vendor or contractor doing business with the state, so it is a government's own information-security programme rather than a duty this topic tracks, and it is not filed as an instrument here.

Georgia's breach-notification statute, the Georgia Personal Identity Protection Act (O.C.G.A. Secs. 10-1-910 to 10-1-915), is already this jurisdiction's privacy-topic row rather than repeated here, and the Georgia Computer Systems Protection Act's hacking, computer theft, trespass, invasion-of-privacy, forgery, and password-disclosure offenses (O.C.G.A. Sec. 16-9-90 et seq.) bind an intruder rather than a system's operator and belong to the scraping topic.

Georgia's SB 351 (2024) was enacted as a single act that both restricts minors' social media accounts, requiring parental consent under age 16, and requires age verification on websites publishing material harmful to minors, with both provisions effective July 1, 2025. The social media provisions were preliminarily enjoined in NetChoice v. Carr in June 2025 and remain unenforceable pending Georgia's appeal, argued at the Eleventh Circuit in March 2026.

The separate harmful to minors age verification provision is not part of that suit (the district court's opinion states the case challenges only Section 3-1 of the act, O.C.G.A. Secs. 39-6-1 to 39-6-5) and is currently in effect. Georgia has not enacted an app store age verification or design code law, though state senators have called for one.