North Dakota

House Bill 1351 amended the definition of 'sexually expressive image' at N.D. Cent. Code § 12.1-27.1-01(13) to cover a real, altered, or computer-generated photograph or visual representation exhibiting a nude or partially denuded human figure or sexual conduct, reaching an AI-generated or AI-altered deepfake alongside a real photograph.

Under the operative prohibition, § 12.1-27.1-03.3, a person is guilty of a class A misdemeanor for surreptitiously creating or willfully possessing such an image of an identifiable individual without that individual's written consent, or for distributing or publishing one with intent to cause emotional harm or humiliation, or after being told by the depicted individual or their parent or guardian that they do not consent; a person is guilty of a class B misdemeanor for acquiring and knowingly distributing such an image created without the subject's consent.

A depicted individual identifiable in the image and harmed by a violation committed for sexual arousal, gratification, humiliation, degradation, or monetary or commercial gain has a civil cause of action for the greater of actual and emotional-distress damages or statutory damages capped at ten thousand dollars per defendant, plus any monetary gain the defendant made, exemplary damages, and attorney fees.

House Bill 1351 passed both chambers with only one dissenting vote, was signed by the governor on April 21, 2025, was filed with the secretary of state April 22, 2025, and carried no emergency clause, so it took effect August 1, 2025 under North Dakota's default effective-date rule.

House Bill 1429 amended North Dakota's harassment and stalking statutes to define 'robot' as an artificial object or system that senses, processes, and acts using technology, including the associated elements, communication links, and artificial intelligence, a definition that also reaches a remotely piloted aircraft. Under N.D. Cent. Code § 12.1-17-07(2)(f), a person is guilty of harassment, a class B misdemeanor, for using a robot to engage in offensive conduct with no legitimate purpose.

Under N.D. Cent. Code § 12.1-17-07.1, unauthorized tracking of a person's movements or location through a robot, or a course of conduct that includes an act conducted with a robot in the person's direct control, can constitute stalking, a class A misdemeanor, or a class C felony where the person has a qualifying prior conviction or violates a protective order with notice.

House Bill 1429 passed both chambers without a dissenting vote, was signed by the governor April 21, 2025, and was filed with the secretary of state April 22, 2025, without an emergency clause, so it took effect under North Dakota's default effective-date rule for legislation filed before August first; the Century Code's codified text carries no history note stating the commencement day itself, so the date is left unset rather than computed from that default rule.

Any action taken for a political purpose, including communication or advertising in support of or opposition to a candidate, political committee, or political party, or for promoting passage or defeat of an initiated or referred measure, that contains images, graphics, video, audio, text, or other digital content created in whole or in part with artificial intelligence to visually or audibly impersonate a human, must prominently state the disclaimer 'THIS CONTENT GENERATED BY ARTIFICIAL INTELLIGENCE.'

The duty does not apply to content that solely uses artificial intelligence for text generation, grammar correction, spelling checks, stylistic editing, or otherwise enhancing existing content without creating a new impersonation of a human's likeness or voice.

Artificial intelligence is defined as a machine-based system capable of creating images, graphics, video, audio, text, or other digital content based on human-defined objectives or data patterns, excluding systems explicitly programmed only to assist with grammar, spelling, or word suggestions.

House Bill 1167 passed both chambers without a dissenting vote and was filed with the secretary of state April 11, 2025, without an emergency clause, so it took effect August 1, 2025 under North Dakota's default effective-date rule for legislation filed before that date.

Any person that owns or licenses computerized data including personal information must disclose a breach of the security system to any affected North Dakota resident, and separately to the Attorney General for a breach exceeding 250 individuals, in the most expedient time possible and without unreasonable delay; the chapter sets no numeric consumer-notification deadline and does not itself define or limit person to a private actor.

Personal information is a name combined with a Social Security number, a driver's or nondriver identification card number, a financial account number, a date of birth, a mother's maiden name, medical or health insurance information, an employer-assigned identification number, or a digitized signature, and excludes publicly available government-records information; biometric data is not among the ten enumerated categories, and this chapter does not reach it at all.

Enforcement runs to the Attorney General, who may use all the powers and remedies of chapter 51-15, North Dakota's unlawful-practices chapter, because a violation of this chapter is deemed a violation of chapter 51-15.

Whether that deeming clause makes chapter 51-15's own private-claim provision, Sec. 51-15-09, available to an individual for a bare notification failure is unresolved: that provision arms a claim specifically against a person who acquired any moneys or property by means of the unlawful practice, language that fits a fraud that took money more naturally than a business's mere failure to notify of someone else's breach, and no North Dakota case law construing this combination was found; secondary characterizations of chapter 51-30 disagree with each other on this point, and that disagreement is not resolved here.

A person commits computer fraud, a class C felony, by gaining or attempting to gain access to, altering, damaging, modifying, copying, disclosing, taking possession of, or destroying a computer, computer system, or computer network, without authorization, with the intent to defraud, deceive, prevent authorized use of, or control property or services by false or fraudulent pretenses, representations, or promises.

A person separately commits computer crime, a class A misdemeanor, by intentionally and either in excess of authorization given or without authorization gaining or attempting to gain access to, altering, damaging, modifying, copying, disclosing, taking possession of, introducing a computer contaminant into, destroying, or preventing the authorized use of a computer, computer system, computer network, or any software, program, or data within one; this misdemeanor tier carries no fraud, malice, or deception element, so intentional access in excess of or without authorization is itself enough, closer to a bare authorization test than the malicious-intent-or-deceptive-means standard some neighboring states use.

Subsection 3 gives the owner or lessee of the affected computer, system, or network a civil action for damages, restitution, and attorney's fees. The current codification of this section traces to House Bill 1038, chapter 164 of the 1987 North Dakota Session Laws, which amended and reenacted the section and carried no emergency clause.

Commercial entities that knowingly publish or distribute sexual material harmful to minors on a website where more than one third of the content meets that definition must perform reasonable age verification, such as a digitized identification card or a commercial verification system using a government ID or transactional data.

A commercial entity or third party performing verification may not retain identifying information after access is granted, and enforcement is through private civil suits only.

Substantially identical to companion bill HB 1561: commercial entities that knowingly publish or distribute sexual material harmful to minors on a website where more than one third of the content meets that definition must verify visitors are 18 or older using a digitized identification card or a commercial age verification system relying on government-issued identification, a commercially available age and identity database, or transactional data, and may not retain identifying information after access is granted.

As introduced, the bill would have required device makers, operating systems, and app stores to determine user age and transmit age signals, but the enrolled law dropped that mandate entirely and instead expressly provides that internet service providers, search engines, cloud providers, and application stores are not liable solely for providing access to third-party content. Enforcement is through private civil suits only.