Kansas

Kansas has enacted two narrow artificial-intelligence statutes, both outside the consumer AI-transparency model other states use, and only one of them binds a private actor.

Signed April 8, 2025, 2025 Kan. Sess. Laws ch. 84 bars any state-agency-owned or state-issued electronic device from accessing an artificial intelligence platform of concern (DeepSeek by name, or any AI model owned or controlled by a country of concern: China, Cuba, Iran, North Korea, Russia, or Venezuela, explicitly excluding Taiwan), requires state agency networks to block such access, and requires an agency already using such a platform to deactivate and delete its account, subject to an exception for law-enforcement or cybersecurity-investigation activities.

2025 Kan. Sess. Laws ch. 120 (HB 2183), effective July 1, 2026, amended Kansas's sexual-exploitation-of-a-child, unlawful-transmission, and breach-of-privacy statutes to expressly cover images produced or altered by artificial intelligence: an artificially generated visual depiction indistinguishable from a real child, or morphed from a real child's image, is now itself sexual exploitation of a child, and non-consensual dissemination of an intimate image of an identifiable adult now expressly includes one created, altered, or modified by artificial intelligence.

Two further AI-specific bills died without reaching a floor vote in either chamber in the 2025-2026 session: a Companion Chatbot Safety Act (HB 2671) and an AI-training restriction bill (SB 405).

A third bill a legacy tracker describes as an AI-imagery expansion of the blackmail statute (HB 2594) passed both chambers unanimously but died before enrollment; read on its own text, it only would have decoupled the blackmail offense's cross-reference to the breach-of-privacy statute and separately described the image's content, adding no artificial-intelligence-specific element, so it is not recorded here as an AI instrument.

Kansas has no consumer-facing AI-transparency, chatbot-disclosure, or high-risk-system statute of the kind Colorado and Utah have enacted; the Kansas Consumer Protection Act's general deceptive-acts prohibition, K.S.A. 50-626, remains available against AI-related consumer deception on the same non-AI-specific terms as any other deceptive practice.

Kansas has no comprehensive consumer personal-data statute.

Its privacy law is sectoral: the Kansas Breach Notification Act (K.S.A. 50-7a01 to 50-7a02) requires notice to affected residents without a fixed numeric deadline and to the Attorney General, with no biometric element in its personal information definition; the Student Data Privacy Act (K.S.A. 72-6312 to 72-6320) requires a school district to obtain written parental or adult-student consent before collecting a K-12 student's biometric data and layers its own immediate breach-notice duty for student data; and a genetic-testing insurance-underwriting statute (K.S.A. 40-2259) bars health-benefit insurers from conditioning coverage or rates on a genetic test result.

No provision creates a private right of action; enforcement runs to the Attorney General (and, for insurers, the insurance commissioner) or, for student data, the Attorney General or a district attorney seeking injunctive relief. Kansas has not adopted the NAIC Insurance Data Security Model Law.

Kansas's general computer-crime statute, K.S.A. 21-5839, reaches automated web access in a way comparable to a peer state such as Arizona: alongside three paragraphs requiring an added element (intent to defraud, or knowing damage, alteration, destruction, copying, disclosure, or taking possession without authorization or in excess of it), paragraph (a)(5) separately criminalizes knowingly and without authorization accessing, or attempting to access, any computer, computer system, social networking website, computer network, or computer software, program, documentation, data, or property, with no further intent element required, a bare unauthorized-access offense standing on its own, though Kansas grades it only as a class A nonperson misdemeanor rather than a felony.

Nothing in the statute's text exempts ordinary, non-disruptive automated access to a publicly available page from the authorization requirement, and no reported Kansas case applying section 21-5839 to an automated web-scraping or bulk-data-collection fact pattern was located.

A claim-of-right defense (property or services appropriated openly and avowedly under a claim of title made in good faith) is available for the damage-based paragraphs but is not extended to the bare unauthorized-access paragraph. Kansas has no comprehensive consumer privacy statute reaching scraped public personal data at the state level; its Breach Notification Act and Student Data Privacy Act are sectoral and are covered under the privacy topic, not restated here.

Terms-of-service enforceability rests on ordinary Kansas contract law, with no statutory modification located. Copyright, text-and-data-mining, database rights, unfair competition, and robots.txt's legal weight raise only the federal and common-law questions the national document already covers; Kansas adds no state-specific statute on any of them.

Kansas's private-sector security-law posture rests on one enacted baseline statute rather than a product-security, sector-specific, or safe-harbor regime: K.S.A. 50-6,139b, part of and supplemental to the Kansas Consumer Protection Act (History: L. 2016, ch. 103, section 2; effective July 1, 2016), requires any holder of personal information, a term defined broadly enough to include a government or governmental subdivision alongside a private business, to implement and maintain reasonable safeguards and to destroy unneeded records containing personal information, enforceable only by the Kansas Attorney General as an unconscionable act or practice with a civil penalty of up to $10,000 per violation and no private right of action.

Kansas has not enacted a conditioned cybersecurity safe-harbor act of the kind Utah, Ohio, Iowa, and Connecticut have passed, an affirmative defense to a data-breach claim available to a business that adopts a named security framework: the closest instrument, the Kansas financial institutions information security act (K.S.A. 9-551 to 9-554, enacted 2023), is a mandatory information-security-program duty rather than a liability shield, and it binds a financial-sector role, a credit services organization, mortgage company, supervised lender, money transmitter, trust company, or technology-enabled fiduciary financial institution, that the LexLint activity vocabulary cannot yet express, so it is recorded here rather than flagged on a guess (#6740): no instrument for it is filed here.

No enacted Kansas statute is confirmed in the primary text and searches consulted here to set security requirements a connected device or software product must meet before or after it is placed on the market, comparable to California's or Oregon's connected-device statutes or the Cyber Resilience Act, and none imposes a private-sector duty to report an exploited vulnerability or a security incident to an authority or to users: the state's own incident-reporting duty, K.S.A. 75-7244, binds a public entity and a government contractor handling state networks or systems, a government-accountability duty rather than a private-sector one, and is recorded here rather than filed as an instrument.

Kansas's breach-notification statute, the Kansas Consumer Information Security Breach Notification Act at K.S.A. 50-7a01 through 50-7a04, is this jurisdiction's privacy-topic row rather than repeated here.

Kansas has required age verification for adult websites since 2024, backed by both attorney general enforcement and a private right of action. An app store accountability bill requiring age verification and parental consent for app downloads by minors passed the Senate in February 2026 and cleared a House committee in March 2026 but died without a House floor vote. No social media minor-access law or design code law has advanced past introduction.