Hawaii

House Bill 2137 of 2026 adds a new chapter to the Hawaii Revised Statutes on artificial intelligence, digital imitation, and personal likeness. It is unlawful for any person to knowingly publish a realistic digital imitation of an identifiable individual without that individual's consent if the imitation is used in connection with an advertisement, causes harm, or is used to commit fraud, defamation, harassment, or other criminal acts.

A digital imitation is any highly realistic AI-generated depiction, audio, or video that is derived from or based upon identifying characteristics of an actual, particular individual and portrays that individual's voice, face, or likeness in a sound recording or audiovisual work in which the individual did not actually perform or appear. Consent means express, written permission from a depicted individual or the depicted individual's authorized representative.

The chapter does not apply to content generated or altered by artificial intelligence that is a form of parody, satire, commentary, criticism, scholarship, or political or educational expression. The chapter does not apply to news reporting where the content generated or altered by artificial intelligence is used to illustrate a story.

The chapter does not apply to any medium used for the publication or dissemination of third-party content, but only as to the medium's role in publishing or disseminating that content. The individual, or the individual's estate for up to ten years after the death of the individual, may bring a civil action for injunctive relief and for monetary damages of up to $25,000 per advertisement or recovery of actual damages.

The attorney general may bring a cause of action for injunctive or other equitable relief in instances in which the distribution of realistic digital imitations involves broad public interest or widespread harm. The Governor signed House Bill 2137 as Act 247 on July 14, 2026. The act takes effect upon its approval.

Hawaii's promoting-child-abuse statute defines "child pornography" to include any pornographic visual representation, including a "computer or computer-generated image or picture," where either the production used a real minor or the image "has been created, adapted, or modified to appear that an identifiable minor is engaging in sexual conduct," reaching an AI-generated or AI-altered depiction with no real minor involved at all.

Producing such material is promoting child abuse in the first degree (class A felony); disseminating it, or possessing thirty or more qualifying images, is the second degree (class B felony); simple possession is the third degree (class C felony). This computer-generated language was added by 2002 Session Laws Act 200 to address, in the legislature's words, "the problem of utilizing computer technology in committing crimes against children."

Subsection (1)(c), added by 2021 Session Laws Act 59, makes it violation of privacy in the first degree to intentionally create, disclose, or threaten to disclose an image or video of a "composite fictitious person" depicted nude or in sexual conduct that includes a real, identifiable person's recognizable physical characteristics, so the image appears to depict that known person, with intent to substantially harm the depicted person or as an act of revenge or retribution; this reaches a deepfake or AI-generated composite image regardless of whether any genuine nude or sexual image of the depicted person ever existed.

The offense is a class C felony. A provider of an "electronic communication service" or "remote computing service" is not liable for an image or video another person discloses through that service.

Requires an operator of an AI companion (a system using artificial intelligence, generative artificial intelligence, or emotional-recognition algorithms designed to simulate a sustained human-like relationship) to clearly and conspicuously disclose that it is not human whenever a reasonable person could otherwise mistake it for one, and adds a recurring, more frequent disclosure duty, content restrictions, and parental controls where the operator knows or reasonably believes the user is a minor.

An operator must adopt an evidence-based protocol for responding to a user's suicidal-ideation or self-harm prompts by referring the user to crisis-intervention services, and beginning January 1, 2028 must file an annual, de-identified report on crisis referrals with the Department of Health's Behavioral Health Administration.

A violation is an unfair or deceptive trade practice under Haw. Rev. Stat. § 480-2, enforceable by the Department of the Attorney General and the Office of Consumer Protection; the section expressly creates no private right of action, and expressly imposes no liability on the developer of an AI model for a third party's violation using that model. Not yet assigned a permanent section number on the state code site as of the date shown; the bill designates it a new section of chapter 481B, part I.

A business that owns or licenses personal information of Hawaii residents, a business conducting business in Hawaii that owns or licenses such information, and a government agency that collects personal information for government purposes must each provide notice, without unreasonable delay, to a person affected by a security breach.

Notice must be clear and conspicuous, describe the incident and the type of personal information exposed, describe remedial steps taken, give a contact number, and advise the recipient to monitor credit reports; substitute notice is available above a $100,000 cost or 200,000-person threshold. Above a 1,000-person notice threshold, the business must also notify the State of Hawaii's Office of Consumer Protection and nationwide consumer reporting agencies.

Hawaii's personal information definition covers only a name combined with a Social Security number, driver's license or state ID number, or a financial account number with an access code or password, excludes information lawfully made public through federal, state, or local government records, and has no biometric, genetic, or health category, so a breach of biometric data alone triggers no notice duty.

A business that violates any provision of the Security Breach of Personal Information Act is subject to a penalty of not more than $2,500 per violation, brought by the Attorney General or the executive director of the Office of Consumer Protection. Separately and additionally, a violating business is liable to the injured party for actual damages sustained as a result of the violation, and the court may award reasonable attorneys' fees to the prevailing party.

No action under either route may be brought against a government agency, so the private right of action and the state enforcement action both reach only private businesses despite the notice duty itself extending to government agencies.

A person likely to be damaged by a deceptive trade practice of another may bring an action for an injunction, without needing to prove monetary damage, loss of profits, or intent to deceive.

This is a second, independent private-action route into Hawaii's data-privacy landscape, broader than the Security Breach of Personal Information Act's own private right of action in the conduct it reaches (any deceptive trade practice, not only a chapter 487N breach) but narrower in remedy, since it reaches only injunctive relief rather than damages, and it carries discretionary fee-shifting against a groundless or knowingly deceptive claim.

A person commits unauthorized computer access in the first, second, or third degree by knowingly accessing a computer, computer system, or computer network without authorization, with the first degree requiring an aggravating fact (commercial or private financial gain, furtherance of another crime, information worth more than $20,000, or information a statute or court rule protects from disclosure) and each lower degree dropping that requirement; the same Part separately grades computer fraud (access with intent to commit theft, sections 708-891 to 708-891.6) and computer damage (sections 708-892 to 708-892.6) into parallel first-through-third-degree tiers.

Section 708-890 defines "without authorization" as without the permission of, or in excess of the permission granted by, the computer's owner, lessor, or rightful user, the same permission-based test the federal Computer Fraud and Abuse Act uses. Section 708-893 separately makes using a computer to further certain listed offenses, including harassment, stalking, and violation of privacy, an offense one class or grade higher than the underlying crime. The sections this entry groups came into force on different days.

A licensee is every licensed insurer, producer, and any other person licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered, under chapter 431 or 432, or holding a certificate of authority under chapter 432D. Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment, containing administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.

The licensee must designate one or more employees, an affiliate, or a third-party service provider to act on its behalf and be responsible for the information security program. Based on its risk assessment, the licensee must determine which of the listed security measures are appropriate and implement them.

A licensee's board of directors, or an appropriate committee of the board, must require the licensee's executive management or its delegates to develop, implement, and maintain the information security program. A licensee must exercise due diligence in selecting its third-party service provider. Each licensee must establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event.

Each insurer domiciled in the State must annually submit to the commissioner a written statement by March 31 certifying that it is in compliance with part II of the article. A licensee with fewer than ten employees, including any independent contractors, is exempt from part II of the article.

A licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains an information security program under that Act is considered to have met part II, if it is compliant and submits a written statement certifying its compliance. Licensees other than risk retention groups chartered and licensed in the State had one year from the effective date of the Act to implement sections 201, 202, 203, 204, 206, 207 and 208 of the new article.

Licensees other than risk retention groups chartered and licensed in the State had two years from the effective date of the Act to implement section 205 of the new article. The Act that added the Insurance Data Security Law took effect on July 1, 2021. The Governor approved the Act that added the Insurance Data Security Law on June 28, 2021. A licensee that violates the article may be penalized in accordance with section 431:2-203 of the Insurance Code.

A violation of a provision of the Insurance Code is punishable by a fine of not less than $100 nor more than $10,000 per violation, or by imprisonment for not more than one year, or both.

The chief information officer must provide for periodic security audits of all executive branch departments and agencies regarding the protection of government information and data communication infrastructure. Executive branch departments, agencies, boards, or commissions subject to the security audits must fully cooperate with the entity designated to perform the audit.

The chief information officer may direct specific remedial actions to mitigate findings of insufficient administrative, technical, and physical controls necessary to protect state government information or data communication infrastructure. Act 265 of 2013, which added the security audit section, took effect upon its approval on July 3, 2013.

Haw. Rev. Stat. ch. 487R, effective January 1, 2007 (Act 136, 2006 Regular Session, SB2292 SD2 HD1 CD1), requires any business or government agency that conducts business in Hawaii, or that maintains or otherwise possesses a Hawaii resident's personal information, to take reasonable measures to protect against unauthorized access to or use of that personal information in connection with or after its disposal.

The duty is satisfied by burning, pulverizing, recycling or shredding paper records and destroying or erasing electronic and other nonpaper media so the information cannot practicably be read or reconstructed, or by exercising due diligence over a contracted records-destruction vendor. A financial institution subject to the Gramm-Leach-Bliley Act, a Health Insurance Portability and Accountability Act (HIPAA)-compliant health plan or health care provider, and a Fair Credit Reporting Act-compliant consumer reporting agency are exempt.

A violating business is subject to a civil penalty of not more than $2,500 per violation, brought by the attorney general or the executive director of the office of consumer protection, and is separately liable to the injured party for actual damages and, at the court's discretion, reasonable attorneys' fees. No action under the chapter may be brought against a government agency, which instead must report a material breach of disposed records to the legislature under section 487R-4.

A licensee is every licensed insurer, producer, and any other person licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered, under chapter 431 or 432, or holding a certificate of authority under chapter 432D. If the licensee learns that a cybersecurity event has or may have occurred, the licensee or the third-party service provider designated to act on its behalf must conduct a prompt investigation.

The licensee must maintain records concerning all cybersecurity events for at least five years from the date of the cybersecurity event and produce those records upon demand of the commissioner. Each licensee must notify the commissioner as promptly as possible, but in no event later than three business days from a determination that a cybersecurity event impacting two hundred fifty or more consumers has occurred.

If law enforcement officials instruct a licensee not to distribute information regarding a cybersecurity event, the licensee is not required to provide notification until instructed to do so by law enforcement officials. Notification is required when the licensee is domiciled in the State, in the case of an insurer, or the licensee's home state is Hawaii, in the case of an independent insurance producer.

Notification is also required when the licensee reasonably believes that the nonpublic information involved is of two hundred fifty or more consumers residing in the State and is a cybersecurity event that has a reasonable likelihood of materially harming any consumer residing in the State or any material part of the normal operation of the licensee.

The section on notification of a cybersecurity event does not supersede any reporting requirements in chapter 487N. An assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred. An insurer must notify the producers of record of all affected consumers as soon as practicable as directed by the commissioner.

The Act that added the Insurance Data Security Law took effect on July 1, 2021. The Governor approved the Act that added the Insurance Data Security Law on June 28, 2021. A licensee that violates the article may be penalized in accordance with section 431:2-203 of the Insurance Code. A violation of a provision of the Insurance Code is punishable by a fine of not less than $100 nor more than $10,000 per violation, or by imprisonment for not more than one year, or both.