Hawaii

Hawaii's 2024 election-deepfake disclosure law, Haw. Rev. Stat. §§ 11-303 and 11-304 (Act 191), was permanently enjoined statewide by the U.S. District Court for the District of Hawaii on January 30, 2026 in Babylon Bee, LLC v. Lopez, so it does not currently bind anyone even though its text remains on the books.

A 2026 law, Act 248 (S.B. 3001, CD1), adds a new section to Haw. Rev. Stat. chapter 481B requiring an AI companion operator to disclose that a user is interacting with artificial intelligence and to meet added safety, content, and reporting duties for minor users, effective July 14, 2026; two earlier 2025-2026 bills covering similar ground, HB 1782 and HB 639, died without passage and their substance was largely folded into Act 248.

Separately from AI-transparency duties, two existing Penal Code provisions were amended to reach AI-generated and computer-manipulated imagery and bind any person: the promoting-child-abuse statute (Haw. Rev. Stat. §§ 707-750 to 707-752) defines "child pornography" to include a computer-generated image, and the violation-of-privacy statute (Haw. Rev. Stat. § 711-1110.9(1)(c)) reaches a deepfake or composite image giving a real person's likeness a nude or sexual depiction they did not actually appear in.

No Hawaii statute requiring disclosure of AI training data, imposing high-risk AI system conformity duties, or honoring a text-and-data-mining opt-out was identified; those questions are governed by federal law and the scraping profile.

Hawaii has no comprehensive consumer-privacy statute. Article I, Section 6 of the Hawaii Constitution recognizes an explicit right of privacy subject to a compelling state interest standard, the strictest tier of judicial scrutiny, but it binds government action rather than private conduct, so a private business is not directly bound by it.

The Security Breach of Personal Information Act, HRS ch. 487N, is Hawaii's operative private-sector privacy statute, a breach notification duty whose personal information definition covers only a name combined with a Social Security number, driver's license or state ID number, or a financial account number with an access code, excludes information lawfully made public through government records, and has no biometric, genetic, or health category.

A violation is a strong basis for private recovery: HRS Sec. 487N-3 makes a violating business liable to the injured party for actual damages plus attorneys' fees, on top of a state civil penalty, and Hawaii's general Uniform Deceptive Trade Practices Act separately gives any person likely to be damaged by a deceptive trade practice a right to an injunction without needing to prove monetary damage.

A comprehensive Hawaii Consumer Privacy Protection Act, HB 2463 (2026), has been introduced but has not advanced past introduction.

Hawaii adds a general computer-crime statute to the federal baseline but no scraping-specific terms-of-service, database-right, personal-data, or robots.txt rule.

Part IX of the Penal Code (Haw. Rev. Stat. §§ 708-890 to 708-895.7) defines unauthorized access by reference to the permission of the computer's owner or rightful user, a Computer Fraud and Abuse Act (CFAA)-style authorization test, and grades unauthorized computer access, computer fraud, and computer damage into first, second, and third degree offenses carrying class A, B, and C felony penalties depending on financial gain, the value of information obtained, or whether the access furthers another crime.

No reported Hawaii appellate decision applies this statute to automated collection of public web pages, so how the authorization test would read against an unauthenticated, no-login scrape is untested. Terms-of-service enforceability, database rights, text-and-data-mining, and personal-data protection for scraped information rest on federal law and ordinary Hawaii contract and tort doctrine, on which the statute is silent; robots.txt carries no independent legal weight under Hawaii law.

Hawaii's private-sector security law is a records-disposal duty rather than a product-security or general reasonable-security regime.

Haw. Rev. Stat. ch. 487R, the Destruction of Personal Information Records chapter, effective January 1, 2007 (Act 136 of the 2006 Regular Session, SB2292 SD2 HD1 CD1, approved May 25, 2006), requires any business or government agency that conducts business in Hawaii, or that maintains or otherwise possesses a Hawaii resident's personal information, to take reasonable measures to protect against unauthorized access to or use of that personal information in connection with or after its disposal, satisfied by burning, pulverizing, recycling or shredding paper records and destroying or erasing electronic and other nonpaper media so the information cannot practicably be read or reconstructed, or by exercising due diligence over a contracted records-destruction vendor; a financial institution subject to the Gramm-Leach-Bliley Act, a Health Insurance Portability and Accountability Act (HIPAA)-compliant health plan or health care provider, and a Fair Credit Reporting Act-compliant consumer reporting agency are exempt.

A violating business is subject to a civil penalty of not more than $2,500 per violation, brought by the attorney general or the executive director of the office of consumer protection, and is separately liable to the injured party for actual damages and, at the court's discretion, reasonable attorneys' fees; no action under the chapter may be brought against a government agency, and the chapter carries no criminal exposure.

No enacted Hawaii statute is confirmed in the primary text consulted here to set security requirements a connected device or software product must meet before or after it reaches the market: a bill closely modeled on California's and Oregon's connected-device statutes, the Security of Connected Devices Act (identical companion bills HB739 and SB1002, 2021 Regular Session), was deferred by the House committee on Energy & Environmental Protection and Consumer Protection on February 5, 2021, carried over to the 2022 Regular Session on December 10, 2021, and never enacted in either chamber, so this is a researched absence rather than a gap in coverage.

Hawaii has no general private-sector duty to report a security incident or an exploited vulnerability to an authority.

The one sector-specific cyber-resilience regime this jurisdiction runs is the Insurance Data Security Law, Haw. Rev. Stat. secs. 431:3B-101 to 431:3B-306 (Act 112 of the 2021 Regular Session, approved June 28, 2021, effective July 1, 2021, adopting the National Association of Insurance Commissioners' Insurance Data Security Model Law), which requires every insurance licensee to develop, implement and maintain a comprehensive written information security program commensurate with its size and the sensitivity of the nonpublic information it holds, and requires notice to the insurance commissioner as promptly as possible, and in no event later than three business days, from a determination that a cybersecurity event affecting 250 or more consumers has occurred; a licensee with fewer than ten employees is exempt from the program duty, a licensee compliant with HIPAA's own information security program is deemed compliant, and a violation draws the insurance code's general enforcement provision, a fine of $100 to $10,000 per violation or imprisonment of not more than one year, in addition to license suspension, revocation or a monetary penalty and restitution under Haw. Rev. Stat. sec. 431:2-203.

Because the Insurance Data Security Law's bound party is an insurance licensee, a role no activity this profile can flag on expresses, it is recorded here in prose rather than filed as its own instrument, so that no false reach is published for a developer whose app is not an insurance licensee. The Security Breach of Personal Information Act, Haw. Rev. Stat. ch. 487N, is this jurisdiction's privacy-topic row for breach notification and is not repeated here.