Mississippi

Mississippi's child-exploitation statute already defined a morphed image to include a computer or computer-generated image or picture of sexually explicit conduct created, adapted, or modified to appear to depict a minor engaging in the conduct.

House Bill 1308 (2025), enacted primarily to create a new child-grooming offense, also amended Section 97-5-31 to remove the definition of identifiable child and to remove identifiable child in the definition of child and morphed images, so prosecuting a morphed-image offense no longer requires proof of the specific real-world identity of the depicted minor.

The underlying offenses that reach transporting, selling, and knowingly possessing such a depiction (Section 97-5-33(3) to (5)) are still worded in terms of an actual child, so whether a depiction generated entirely by artificial intelligence, with no real child's likeness involved at all, falls within them is not settled by the statute's text.

A first conviction under Section 97-5-33 is a felony punishable by a fine of $50,000 to $500,000 and imprisonment of 5 to 40 years; a second or subsequent conviction is punishable by a fine of $100,000 to $1,000,000 and imprisonment of 20 years to life. Signed by the Governor April 17, 2025, effective July 1, 2025.

Makes it a crime to disseminate, or contract to disseminate, a digitization, defined to include an image or audio altered or created using software, machine learning, artificial intelligence or other computer-generated or technological means (a deepfake), within ninety days of an election, without the depicted individual's consent, and with intent to injure a candidate, influence the election result, or deter voting.

A first violation is a misdemeanor; a violation committed with intent to incite violence or bodily harm, to deter voting, or a second or subsequent violation within five years is a more serious offense. Carrying a clear and prominent disclosure throughout the digitization that the depicted individual did not actually engage in the shown speech or conduct is a defense to prosecution. Signed by the Governor April 30, 2024.

A person who conducts business in Mississippi and whose data includes personal information must disclose a breach of security to all affected individuals without unreasonable delay, subject to completing an investigation; notification is not required if the person reasonably determines, after investigation, that the breach will not likely result in harm.

Personal information is an individual's name combined with a Social Security number, a driver's license, state identification card, or tribal identification card number, or an account or credit or debit card number with a required access credential, and excludes publicly available information lawfully made available from government records or widely distributed media; it has no biometric element.

Enacted as HB 583 (2010), effective July 1, 2011, and amended by HB 277 (2021, effective July 1, 2021), which added the tribal identification card number as a qualifying element; every other subsection, including the enforcement clause, is unchanged since 2010.

Failure to comply with Mississippi's breach notification duty constitutes an unfair trade practice enforced by the Attorney General, but the same sentence that deems the violation an unfair trade practice expressly forecloses any private right of action: this closes, in one clause, the exact route that opens a private action in other states whose breach statutes deem a violation an unfair trade practice without an express carve-out.

The Insurance Data Security Law expressly may not be construed to create or imply a private cause of action for its violation, nor to curtail a private cause of action that would otherwise exist absent the law, the same two-part structure as Michigan's parallel statute. The law establishes the exclusive Mississippi standards for a licensee's data security and notification to the Commissioner of Insurance, who enforces it.

Mississippi adopted the NAIC Insurance Data Security Model Law as SB 2831 (2019 Regular Session), signed April 3, 2019 and effective July 1, 2019, codified at Miss. Code Ann. Sections 83-5-801 to 83-5-825.

Nonpublic information (Section 3(k)) includes electronic information that is not publicly available and that, combined with an identifying element, includes a Social Security number, driver's license or nondriver identification card number, financial account or card number, a financial-account access credential, or biometric records.

Biometric records is a bare, undefined term with no elaboration anywhere in Section 3's definitions and no photograph, video, or audio-recording exclusion or clawback clause, the same shape found in Michigan's parallel adoption of the same model law, so whether it excludes a recording-derived identifier cannot be tested against this text and is not recorded. This law binds insurance licensees only, not a general private-sector actor.

Computer fraud (Section 97-45-3) is intentionally accessing or causing to be accessed a computer, computer system, or computer network with intent to defraud, to obtain money, property or services by fraudulent means, or to insert malicious code. An offense against computer users (Section 97-45-5) is intentionally denying an authorized user access without consent, or disclosing access codes without consent.

An offense against computer equipment (Section 97-45-7) is intentionally modifying or destroying computer equipment or supplies without consent. An offense against intellectual property (Section 97-45-9) is intentionally destroying, inserting, or modifying intellectual property without consent, or disclosing, using, copying, taking, or accessing it without consent. Section 97-45-9(6) exempts disclosure, use, copying, taking, or accessing by proper means.

Section 97-45-1(v) defines proper means to include observation of the property in public use or on public display, alongside independent invention, lawful reverse engineering, license, and published literature. Each offense escalates through four value-based tiers of fine and imprisonment, with an enhanced Penitentiary term for a third or subsequent conviction.

Requires commercial entities that publish or distribute material harmful to minors, where a substantial portion (one third or more) of the site is such material, to perform reasonable age verification before granting access, using a commercial age verification system or transactional data method.

Requires digital service providers that let users socially interact, create profiles, and post content to verify the age of all users and obtain express parental or guardian consent before a known minor (under 18) may hold an account, with default privacy protections for minor accounts.