North Dakota

House Bill 1351 amended the definition of 'sexually expressive image' at N.D. Cent. Code § 12.1-27.1-01(13) to cover a real, altered, or computer-generated photograph or visual representation exhibiting a nude or partially denuded human figure or sexual conduct, reaching an AI-generated or AI-altered deepfake alongside a real photograph.

Under the operative prohibition, § 12.1-27.1-03.3, a person is guilty of a class A misdemeanor for surreptitiously creating or willfully possessing such an image of an identifiable individual without that individual's written consent, or for distributing or publishing one with intent to cause emotional harm or humiliation, or after being told by the depicted individual or their parent or guardian that they do not consent; a person is guilty of a class B misdemeanor for acquiring and knowingly distributing such an image created without the subject's consent.

A depicted individual identifiable in the image and harmed by a violation committed for sexual arousal, gratification, humiliation, degradation, or monetary or commercial gain has a civil cause of action for the greater of actual and emotional-distress damages or statutory damages capped at ten thousand dollars per defendant, plus any monetary gain the defendant made, exemplary damages, and attorney fees.

House Bill 1351 passed both chambers with only one dissenting vote, was signed by the governor on April 21, 2025, was filed with the secretary of state April 22, 2025, and carried no emergency clause, so it took effect August 1, 2025 under North Dakota's default effective-date rule.

House Bill 1429 amended North Dakota's harassment and stalking statutes to define 'robot' as an artificial object or system that senses, processes, and acts using technology, including the associated elements, communication links, and artificial intelligence, a definition that also reaches a remotely piloted aircraft. Under N.D. Cent. Code § 12.1-17-07(2)(f), a person is guilty of harassment, a class B misdemeanor, for using a robot to engage in offensive conduct with no legitimate purpose.

Under N.D. Cent. Code § 12.1-17-07.1, unauthorized tracking of a person's movements or location through a robot, or a course of conduct that includes an act conducted with a robot in the person's direct control, can constitute stalking, a class A misdemeanor, or a class C felony where the person has a qualifying prior conviction or violates a protective order with notice.

House Bill 1429 passed both chambers without a dissenting vote, was signed by the governor April 21, 2025, and was filed with the secretary of state April 22, 2025, without an emergency clause. The North Dakota Legislative Council's own report on the effective dates of 2025 legislation states that House Bill 1429 took effect August 1, 2025.

Any action taken for a political purpose, including communication or advertising in support of or opposition to a candidate, political committee, or political party, or for promoting passage or defeat of an initiated or referred measure, that contains images, graphics, video, audio, text, or other digital content created in whole or in part with artificial intelligence to visually or audibly impersonate a human, must prominently state the disclaimer 'THIS CONTENT GENERATED BY ARTIFICIAL INTELLIGENCE.'

The duty does not apply to content that solely uses artificial intelligence for text generation, grammar correction, spelling checks, stylistic editing, or otherwise enhancing existing content without creating a new impersonation of a human's likeness or voice.

Artificial intelligence is defined as a machine-based system capable of creating images, graphics, video, audio, text, or other digital content based on human-defined objectives or data patterns, excluding systems explicitly programmed only to assist with grammar, spelling, or word suggestions.

House Bill 1167 passed both chambers without a dissenting vote and was filed with the secretary of state April 11, 2025, without an emergency clause, so it took effect August 1, 2025 under North Dakota's default effective-date rule for legislation filed before that date.

Any person that owns or licenses computerized data including personal information must disclose a breach of the security system to any affected North Dakota resident, and separately to the Attorney General for a breach exceeding 250 individuals, in the most expedient time possible and without unreasonable delay; the chapter sets no numeric consumer-notification deadline and does not itself define or limit person to a private actor.

Personal information is a name combined with a Social Security number, a driver's or nondriver identification card number, a financial account number, a date of birth, a mother's maiden name, medical or health insurance information, an employer-assigned identification number, or a digitized signature, and excludes publicly available government-records information; biometric data is not among the ten enumerated categories, and this chapter does not reach it at all.

Enforcement runs to the Attorney General, who may use all the powers and remedies of chapter 51-15, North Dakota's unlawful-practices chapter, because a violation of this chapter is deemed a violation of chapter 51-15.

Whether that deeming clause makes chapter 51-15's own private-claim provision, Sec. 51-15-09, available to an individual for a bare notification failure is unresolved: that provision arms a claim specifically against a person who acquired any moneys or property by means of the unlawful practice, language that fits a fraud that took money more naturally than a business's mere failure to notify of someone else's breach, and no North Dakota case law construing this combination was found; secondary characterizations of chapter 51-30 disagree with each other on this point, and that disagreement is not resolved here.

The provisions this entry describes came into force on different days.

A person commits computer fraud, a class C felony, by gaining or attempting to gain access to, altering, damaging, modifying, copying, disclosing, taking possession of, or destroying a computer, computer system, or computer network, without authorization, with the intent to defraud, deceive, prevent authorized use of, or control property or services by false or fraudulent pretenses, representations, or promises.

A person separately commits computer crime, a class A misdemeanor, by intentionally and either in excess of authorization given or without authorization gaining or attempting to gain access to, altering, damaging, modifying, copying, disclosing, taking possession of, introducing a computer contaminant into, destroying, or preventing the authorized use of a computer, computer system, computer network, or any software, program, or data within one; this misdemeanor tier carries no fraud, malice, or deception element, so intentional access in excess of or without authorization is itself enough, closer to a bare authorization test than the malicious-intent-or-deceptive-means standard some neighboring states use.

Subsection 3 gives the owner or lessee of the affected computer, system, or network a civil action for damages, restitution, and attorney's fees. The current codification of this section traces to House Bill 1038, chapter 164 of the 1987 North Dakota Session Laws, which amended and reenacted the section and carried no emergency clause.

The Century Code carries no history note stating the day this section came into force, and no record of the enacting session's general effective date has been located.

Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.

A licensee is any person licensed, authorized to operate, registered, or required to be licensed, authorized, or registered under the insurance laws of North Dakota, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.

A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession. An insurer domiciled in North Dakota must submit annually to the commissioner a written statement, by April fifteenth, certifying that the insurer complies with the information security program section.

A licensee with less than five million dollars in gross revenue or less than ten million dollars in year-end assets is exempt from subsections 2 through 10 of the information security program section. A licensee that is subject to, governed by, and compliant with the federal health privacy, security, and breach notification rules and maintains nonpublic information in the same manner as protected health information is deemed to comply with the information security program section.

A licensee that violates the chapter may be penalized in accordance with section 26.1-01-03.3 of the North Dakota Century Code. A person who violates title 26.1 is subject, after hearing by the commissioner, to payment of an administrative monetary fine of up to ten thousand dollars for each violation, unless otherwise provided by law.

Under the original Act, a licensee had to implement subsections 1, 2, 3, 4, 5, 8, and 9 of the information security program section no later than August 1, 2022, and subsections 6 and 7 no later than August 1, 2023. Chapter 280 of the Session Laws of 2025 repealed the section that set those implementation dates.

An entity must disclose to the information technology department an identified or suspected cybersecurity incident that affects the confidentiality, integrity, or availability of information systems, data, or services. The disclosure must be made in the most expedient time possible and without unreasonable delay. An entity is an executive branch state agency or a political subdivision within the state.

Until a cybersecurity incident is resolved, an entity must disclose clarifying details to the department, including the number of potentially exposed records, the type of records, its mitigation and remediation efforts, and the expected impact of the incident. The legislative and judicial branches may disclose cybersecurity incidents to the department but are not required to.

The department must establish and make known the methods an entity must use to securely disclose cybersecurity incidents to the department. The department must report all disclosed cybersecurity incidents to the legislative management, including the status of each incident and any response or remediation.

A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation, or have an outside vendor or service provider designated to act on its behalf conduct one. A licensee must notify the commissioner as promptly as possible, but no later than three business days from a determination that a cybersecurity event has occurred, if either of the two sets of conditions in the notification section is met.

The first set of conditions is met where North Dakota is the licensee's state of domicile, in the case of an insurer, or its home state, in the case of a producer, and the event triggers notification to a consumer residing in the state under chapter 51-30 or has a reasonable likelihood of harming any material part of the normal operations of the licensee.

The second set of conditions is met where the licensee reasonably believes the nonpublic information involved is of two hundred fifty or more consumers residing in the state and the event requires notice to a government body or supervisory body under state or federal law or has a reasonable likelihood of materially harming a consumer or any part of the licensee's normal operations.

The licensee must provide the notice in electronic form as directed by the commissioner and must update and supplement the initial and any subsequent notifications regarding material changes. An assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.

The chapter establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification to the commissioner. Senate Bill 2088 of the 69th Legislative Assembly amended and reenacted the notification section. A licensee that violates the chapter may be penalized in accordance with section 26.1-01-03.3 of the North Dakota Century Code.

A person who violates title 26.1 is subject, after hearing by the commissioner, to payment of an administrative monetary fine of up to ten thousand dollars for each violation, unless otherwise provided by law.

Commercial entities that knowingly publish or distribute sexual material harmful to minors on a website where more than one third of the content meets that definition must perform reasonable age verification, such as a digitized identification card or a commercial verification system using a government ID or transactional data.

A commercial entity or third party performing verification may not retain identifying information after access is granted, and enforcement is through private civil suits only.

Substantially identical to companion bill HB 1561: commercial entities that knowingly publish or distribute sexual material harmful to minors on a website where more than one third of the content meets that definition must verify visitors are 18 or older using a digitized identification card or a commercial age verification system relying on government-issued identification, a commercially available age and identity database, or transactional data, and may not retain identifying information after access is granted.

As introduced, the bill would have required device makers, operating systems, and app stores to determine user age and transmit age signals, but the enrolled law dropped that mandate entirely and instead expressly provides that internet service providers, search engines, cloud providers, and application stores are not liable solely for providing access to third-party content. Enforcement is through private civil suits only.