United States law applies in OhioOhio is a state of the United States, whose 134 researched instruments are listed on the United States page, not here. The law of Ohio, described on this page below, applies here too.
16 of 17 named instruments researched to a stage, across five of the ten areas of law we track: 11 in force, 1 blocked by a court and 4 proposed. As of .
When each starts11 of 16 carry a date, 5 do not. Earlier is before 2014.
in forcenot yet in forceblocked by a courtproposedno longer in force
As of , Ohio has enacted no AI-specific statute binding a private actor.
Its one enacted AI-specific provision, Ohio Rev. Code § 3301.24 (created by the FY2026-27 biennial budget act, House Bill 96, effective ), requires the Department of Education and Workforce to publish a model AI-use policy and requires public school districts, community schools, and STEM schools to adopt one; it binds only those government bodies and imposes no duty on a private developer or deployer, so it is not catalogued here.
The most advanced private-facing measure is Senate Bill 163 (136th General Assembly), which passed the Senate unanimously on and was referred to the House Technology and Innovation Committee on , with no later action recorded as of .
As passed by the Senate, it would require a generative AI system publicly accessible to Ohio consumers to carry a visible watermark and embedded provenance data on generated images and video, ban knowingly removing that watermark or knowingly distributing fully AI-generated content with false authenticity claims, and separately expand Ohio's child-exploitation statutes (§§ 2907.321 to .323) to reach a computer-generated or artificially generated depiction of a minor, including a "depiction of a purported minor" that a reasonable person would believe shows an actual minor but that may or may not actually do so, while also creating a new prohibition, inside the existing identity-fraud statute (§ 2913.49), on creating, using, or disseminating a nonconsensual AI-generated "replica" of a real person's voice, image, or likeness to induce a financial decision, damage a reputation, or depict the person in nudity or sexual conduct.
Ohio has not enacted an election-deepfake disclosure statute: a tally published in January 2026 counted Ohio among a small number of states with no deepfake-specific election law of any kind, and Ohio's own pending bills on the subject, including House Bill 367 of the 135th General Assembly and House Bill 185 of the 136th General Assembly, have not passed either chamber.
Ohio Rev. Code §§ 2907.321 2907.322, 2907.323, and 2913.49, as proposed to be amended by S.B. 163, 136th General Assembly (2025-2026 Session)bill text as passed by the Ohio Senate, Ohio Legislature (not yet enacted)
Proposed.proposed Not law. It binds no one unless it is enacted.
Before the second chamber, dated , as of .Binds public and private bodies.
What this law does
Senate Bill 163 passed the Ohio Senate on and was referred to the House Technology and Innovation Committee on ; what follows describes it as the Senate passed it. Ohio's child-exploitation statutes currently reach only material showing an actual minor.
As passed by the Senate, §§ 2907.321 to .323 would be amended to add a computer-generated or artificially generated depiction of a minor, and to add a "depiction of a purported minor," defined as a visual representation that appears to depict an actual minor that a reasonable person would believe depicts or represents an actual minor, but that may or may not actually depict a real child; this would reach material generated entirely by artificial intelligence with no real child involved at all, without changing the existing felony-degree structure for these offenses.
Separately, § 2913.49 (Ohio's identity-fraud statute) would be amended to add a "replica of a person's persona," a modified or fabricated version of an individual's voice, photograph, image, likeness, or distinctive appearance created or presented so that it appears to be the individual's authentic persona, including one produced in whole or in part by a generative AI system; new prohibitions would bar creating or using such a replica, without the depicted person's consent, to induce a financial decision or extend credit, to damage a person's or entity's reputation, or, where the depicted person is not a minor or impaired person, to depict them in nudity, sexual activity, or other obscene material.
The bill does not extend a civil action of its own to the new financial-inducement or reputational-harm replica prohibitions: the existing civil action for persons injured by a criminal act (R.C. 2307.60) remains available only for a violation of the identity-theft provisions in divisions (B), (D), or (E) of the amended section, which already reach a replica used with intent to defraud, and the new civil action added by this measure (R.C. 2307.66) reaches only the nonconsensual sexual or nude replica prohibition. The provider or developer of the underlying AI technology is excluded unless it is itself the violator.
Proposed.proposed Not law. It binds no one unless it is enacted.
In committee, dated , as of .Binds public and private bodies.
What this law does
House Bill 469 was introduced on and referred to the House Technology and Innovation Committee on ; what follows describes the bill as introduced. It would declare every AI system a nonsentient entity for all purposes under Ohio law and bar any AI system from legal personhood, so that an AI system cannot be a spouse, an officer or director, an owner of property, or a party that bears liability in its own right.
Any harm an AI system causes, whether used as intended or misused, would be the responsibility of the owner or user who directed or employed it, and a developer or manufacturer could be liable for a design, construction or instruction defect that proximately causes harm.
An owner of an AI system whose outputs could reasonably be expected to affect human welfare, property or public safety would have to maintain proper oversight and control measures, and an owner or developer of a system involved in an incident causing significant bodily harm, death or major property damage would have to notify the relevant authorities promptly and comply with any later investigation.
Proposed.proposed Not law. It binds no one unless it is enacted.
In committee, dated , as of .Binds private bodies.
What this law does
House Bill 525 was introduced on and referred to the House Health Committee on ; what follows describes the bill as introduced. A licensed therapy professional could use artificial intelligence to assist with supplementary support, such as keeping client records and therapy notes, after first obtaining the patient's written informed consent and entering the business associate agreements Health Insurance Portability and Accountability Act (HIPAA) requires.
The professional could not use artificial intelligence to make independent therapeutic decisions, to interact directly with clients in therapeutic communication, to generate therapeutic recommendations or treatment plans without the professional's own review and approval, or to detect emotions or mental states. The professional's licensing board could fine a violation up to $10,000.
Proposed.proposed Not law. It binds no one unless it is enacted.
Before the second chamber, dated , as of .Binds private bodies.
What this law does
Senate Bill 163 passed the Ohio Senate on and was referred to the House Technology and Innovation Committee on ; what follows describes it as the Senate passed it.
A "covered provider," a person or entity that creates, codes, or otherwise produces a generative AI system publicly accessible to Ohio consumers for personal use, would have to program the system to place a distinctive watermark on any image or video it generates that informs the user the content was AI-generated, and to embed provenance data in content the system creates; business-to-business use of a generative AI system for an otherwise lawful purpose is excluded.
It would be a violation, done knowingly and with intent to deceive a third party, to remove a required watermark or to distribute content fully generated by a generative AI system with false information about its authenticity. A person aggrieved by such a violation could bring a civil action for damages, but only after first filing a complaint with the Attorney General and the Attorney General not filing its own action within six months.
The Attorney General could separately seek injunctive relief for a violation of the watermark or false-authenticity bans, and a civil penalty of up to $10,000 specifically for a violation of the watermark-removal ban.
Ohio has no comprehensive consumer personal-data-protection statute; two 2026-session bills, House Bill 801 (the Ohio Privacy Act) and House Bill 807, remain in committee. Ohio's breach notification statute is Ohio Rev. Code Sec. 1349.19.
A person that owns or licenses computerized data including personal information must disclose a breach to an affected Ohio resident in the most expedient time possible and no later than 45 days following discovery, and, once a single breach affects more than 1,000 residents, to every nationwide consumer reporting agency.
Personal information is limited to a name combined with a Social Security number, a driver's license or state identification card number, or a financial account, credit, or debit card number with an access code, and it excludes information lawfully available to the general public from government records or widely distributed media; it carries no biometric, genetic, or student-data element.
Ohio's general definition of person, incorporated by cross-reference and narrowed to a business entity that conducts business in Ohio, does not include a state agency or other governmental body, so the notification duty binds only private actors. The Attorney General has exclusive authority to investigate and bring a civil action for a violation, with escalating per-day civil penalties, and the statute creates no private right of action.
Separately, Ohio Rev. Code ch. 1354 provides a voluntary cybersecurity-framework safe harbor rather than an independent duty. Under Ohio Revised Code section 3319.326, education records that a technology provider creates, receives, maintains or disseminates under a contract with a school district are solely the property of the school district.
Ohio Revised Code section 3319.327 bars a school district or technology provider from electronically accessing or monitoring the location-tracking features, audio or visual features, or student interactions of a school-issued device, except in the circumstances it lists.
Any person that owns or licenses computerized data including personal information must disclose a breach of the security of the system to an affected Ohio resident, in the most expedient time possible and no later than 45 days following discovery, subject to a law-enforcement delay.
Personal information is a name combined with a Social Security number, a driver's license or state identification card number, or a financial account, credit, or debit card number with an access code, and excludes information lawfully available to the general public from government records or widely distributed media; it carries no biometric, genetic, or student-data element.
Person has the meaning given in Ohio Rev. Code Sec. 1.59, an individual, corporation, business trust, estate, trust, partnership, or association with no government or governmental subdivision named, except that a business entity counts as a person only if it conducts business in Ohio, so this duty binds private actors, not the state or its political subdivisions.
A financial institution already subject to federal breach-notice requirements and a Health Insurance Portability and Accountability Act (HIPAA) covered entity are each exempt from this section. Once a single breach affects more than 1,000 Ohio residents, the person must also notify every nationwide consumer reporting agency without unreasonable delay.
The Attorney General has exclusive authority under Ohio Rev. Code Sec. 1349.192 to investigate and bring a civil action for a violation, with a civil penalty of up to $1,000 per day rising to $5,000 per day after 60 days and $10,000 per day after 90 days of an intentional or reckless violation, and the statute creates no private right of action.
Most recently amended by Senate Bill 126 (126th General Assembly), effective ; secondary reporting describes the original enactment as House Bill 104 (126th General Assembly), signed 2005, not independently confirmed against primary text.
Ohio Rev. Code Sec. 3319.327Official text of Ohio Revised Code section 3319.327, Ohio Laws, Legislative Service Commission
In force since .Binds public and private bodies.
What this law does
Section 3319.327 of the Revised Code bars a school district or technology provider from electronically accessing or monitoring the location-tracking features of a school-issued device, its audio or visual receiving, transmitting or recording feature, or student interactions with it, including keystrokes and web-browsing activity, except in the circumstances division (B) lists.
Division (B) excepts activity limited to a noncommercial educational purpose for instruction, technical support or exam-proctoring, activity permitted under a judicial warrant or subpoena, activity once the device is known to be missing or stolen, activity necessary to prevent or respond to a threat to life or safety, activity necessary to comply with federal or state law, and activity necessary to participate in federal or state funding programs.
In any year that a school district or technology provider elects to generally monitor a school-issued device for a division (B) circumstance, the school district must give written notice of that monitoring to the parents of its enrolled students.
When a circumstance in division (B)(2) or (B)(3) is triggered and the school district initiates responsive action, the district must, within seventy-two hours of the access, notify the student's parent and give a written description of the triggering circumstance, including which features of the device were accessed and a description of the threat, if any.
When a circumstance in division (B)(4) is triggered and the school district initiates action in response, the district must, within seventy-two hours of the access, notify the student's parent and give a written description of the triggering circumstance, including which features of the device were accessed and a description of the threat, if any.
The section was enacted by Senate Bill 29 of the 135th General Assembly, effective , and amended by House Bill 432 of the 135th General Assembly, effective .
Ohio Rev. Code Sec. 3319.326Official text of Ohio Revised Code sections 3319.325 and 3319.326, Ohio Laws, Legislative Service Commission
In force since .Binds public and private bodies.
What this law does
Section 3319.325 of the Revised Code defines a technology provider as a person who contracts with a school district to provide a school-issued device for student use and creates, receives, or maintains education records pursuant or incidental to its contract with the district. A technology provider must comply with Chapter 1347 of the Revised Code with regard to the collection, use, and protection of data as if it were a school district.
Education records created, received, maintained, or disseminated by a technology provider pursuant or incidental to a contract with a school district are solely the property of the school district. If education records maintained by the technology provider are subject to a breach of the security of the data, as described in section 1347.12 of the Revised Code, the technology provider must disclose to the school district all information necessary to fulfill the requirements of that section.
Unless renewal of the contract is reasonably anticipated, a technology provider must destroy or return to the school district all education records within ninety days of the expiration of the contract. A technology provider must not sell, share, or disseminate education records, except as section 3319.326 provides or as part of a valid delegation or assignment of its contract with a school district.
A technology provider must not use education records for any commercial purpose, including marketing or advertising to a student or parent. A contract between a technology provider and a school district must ensure appropriate security safeguards for education records and restrict unauthorized access by the provider's employees or contractors.
The section was enacted by Senate Bill 29 of the 135th General Assembly, effective , and amended by House Bill 432 of the 135th General Assembly, effective .
Ohio diverges from the federal baseline through Ohio Rev. Code § 2913.04(B), a computer-misuse statute that reaches any access to a computer, computer network, cable service, or telecommunications service without the owner's consent or beyond the scope of that consent, with no requirement of fraudulent intent, malicious intent, or deceptive means; the base offense is a felony of the fifth degree regardless of the value involved, which is stricter on its face than a peer statute like Virginia's malicious-intent-or-deceptive-means standard.
No Ohio case addressing this statute's application to automated collection of a public web page has been located. Ohio has not enacted a comprehensive consumer data-privacy statute carrying a publicly-available-information exemption comparable to Virginia's VCDPA; the only Ohio data-privacy statute researched for this jurisdiction is the Security Breach Notification Act, filed under the privacy topic.
Copyright, text-and-data-mining, and database rights over scraped Ohio content are federal only. Terms-of-service enforceability rests on ordinary Ohio contract law, with no statutory provision either preserving or displacing it and no Ohio case addressing browsewrap versus clickwrap for a scraping dispute specifically. robots.txt carries no independent legal weight under Ohio law.
Division (B) makes it unlawful for any person, in any manner and by any means, including but not limited to computer hacking, to knowingly gain access to, attempt to gain access to, or cause access to be gained to a computer, computer system, computer network, cable service, cable system, telecommunications device, telecommunications service, or information service without the consent of, or beyond the scope of the express or implied consent of, the owner or another person authorized to give consent.
"Gain access" is defined elsewhere in the chapter to include approaching, instructing, communicating with, storing data in, retrieving data from, or otherwise making use of any resources of a computer, computer system, or computer network, which reaches ordinary automated retrieval of a public page; no malicious intent, deceptive means, or fraudulent purpose is required for the base offense. The base violation of division (B) is a felony of the fifth degree regardless of value.
Two independent factors escalate the degree, and the higher of the two applicable results controls: committing the violation for the purpose of devising or executing a scheme to defraud, obtaining property or services by false pretenses, or committing another criminal offense raises it to a felony of the fourth degree where the value of the property or services or the loss is at least $7,500 and less than $150,000, and to a felony of the third degree at $150,000 or more; and the victim being an elderly person or a disabled adult raises it, independent of any fraud purpose, to a felony of the fourth degree at $1,000 to $7,500 in value or loss, a felony of the third degree at $7,500 to $37,500, and a felony of the second degree at $37,500 or more.
The provisions this entry describes came into force on different days.
Ohio's general product-security and cyber-resilience posture rests on one enacted state statute, the Ohio Data Protection Act, Ohio Revised Code sections 1354.01 to 1354.05 (enacted by Senate Bill 220, 132nd General Assembly, effective , with its definitions section 1354.01 last amended by House Bill 66, 132nd General Assembly, effective ), which gives a covered entity, any business that accesses, maintains, communicates, or processes personal information or restricted information in or through a system located in or outside Ohio, an affirmative defense to a tort claim alleging that a failure to implement reasonable information security controls caused a data breach, if the covered entity voluntarily creates, maintains, and complies with a written cybersecurity program that reasonably conforms to a named industry framework (the National Institute of Standards and Technology (NIST) Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, FedRAMP, the CIS Critical Security Controls, or the ISO/IEC 27000 family, or, for an already-regulated entity, the entirety of Health Insurance Portability and Accountability Act (HIPAA)'s security rule, Gramm-Leach-Bliley Act Title V, FISMA, or HITECH, or the PCI Data Security Standard paired with one of the first group).
This is a safe harbor rather than a duty: no Ohio statute requires any business to build a cybersecurity program, and section 1354.04 bars any private right of action, including a class action, with respect to any act or practice the chapter regulates, so no regulator administers it and nobody can sue to compel one; a covered entity's only exposure is a tort claim brought under other law, against which the chapter's affirmative defense is a shield it may or may not have earned in advance.
No enacted Ohio statute sets security requirements a connected device or software product must otherwise meet to be placed on the market, and none was located imposing a general, sector-neutral duty on a private business to report an exploited vulnerability or a security incident to a state authority.
Ohio binds sectors directly, among them insurance, investment advisers and sports gaming (each described below); for insurance, Ohio Revised Code Chapter 3965, Cybersecurity Requirements for Insurance Companies (enacted by Senate Bill 273, 132nd General Assembly, effective , adopting the NAIC Insurance Data Security Model Law), requires a licensee, any person licensed, authorized, or registered under Ohio's insurance laws including an insurer, to maintain a comprehensive written information security program, investigate a cybersecurity event, and notify the superintendent of insurance within three business days of certain cybersecurity events, enforced through the superintendent's examination and investigation power under section 3965.05; compliance with Chapter 3965 is itself deemed, by that chapter's own section 3965.02(J), to satisfy the Data Protection Act's reasonable-conformance test.
Ohio's breach-notification duty, Revised Code section 1349.19, the Security Breach Notification Act, is already this jurisdiction's privacy row rather than repeated here: the Data Protection Act's own definition of personal information incorporates that section's definition by reference, and Chapter 3965's insurer-specific consumer notification likewise routes through it.
Ohio's insurance data security law, Chapter 3965 of the Revised Code, requires each insurance licensee to develop, implement, and maintain a comprehensive written information security program based on its risk assessment. The same chapter requires an insurance licensee to notify the superintendent of insurance no later than three business days after determining that a qualifying cybersecurity event involving nonpublic information has occurred.
Section 9.64 of the Revised Code requires the legislative authority of an Ohio political subdivision to adopt a cybersecurity program that safeguards its data, information technology, and information technology resources. An Ohio political subdivision must notify the executive director of the division of homeland security of a cybersecurity incident or ransomware incident not later than seven days after discovering it.
Ohio Administrative Code rule 3775-16-15 requires a sports gaming proprietor to maintain an information technology department, IT security insurance approved by the executive director, a restricted secured location for its information technology infrastructure and procedures for responding to security incidents. Rule 3775-16-17 requires a sports gaming proprietor to report to the commission immediately any IT security breach or other compromising IT risk.
Ohio Administrative Code rule 3770:3-6-01 requires a Type C sports gaming proprietor to keep procedures for its sports gaming system that describe the physical and logical security of the sports gaming servers and set out risk management and change management procedures.
Rule 3770:3-6-02 requires a Type C sports gaming proprietor to maintain an information technology department, keep its information technology infrastructure in a secured physical location restricted to authorized employees and adopt procedures for responding to security incidents. Rule 3770:3-6-05 requires a Type C sports gaming proprietor to report to the director immediately any IT security breach or other compromising IT risk.
Ohio Administrative Code rule 3775-9-01 bars a sports gaming proprietor, mobile management service provider or management service provider from operating sports gaming equipment that the executive director has not approved, and requires all sports gaming equipment to be evaluated by a certified independent testing laboratory before approval unless the executive director approves otherwise.
Appendix A to rule 3775-9-01 requires electronic sports gaming equipment to comply with the GLI standard 33 Event Wagering Systems, version 1.1, including all appendices. Rule 1301:6-3-15.1 of the Ohio Administrative Code requires every investment adviser licensed or required to be licensed under Chapter 1707 of the Revised Code to make and keep the books and records listed in its paragraph (E)(1).
Paragraph (E)(1)(u) of rule 1301:6-3-15.1 lists, among those records, written physical security and cybersecurity policies and procedures reasonably designed to ensure the confidentiality, integrity, and availability of physical and electronic records and information. Those policies and procedures must cover at least five functions: identify, protect, detect, respond and recover.
Paragraph (E) of rule 1301:6-3-15.1 does not apply to an investment adviser licensed with the division whose principal place of business is in another state, who is registered as an investment adviser in that state and who complies with that state's record keeping requirements.
Rule 1301:6-3-15.1 of the Ohio Administrative Code requires every investment adviser licensed or required to be licensed under Chapter 1707 of the Revised Code to make and keep the books and records listed in its paragraph (E)(1). Paragraph (E)(1)(u) of rule 1301:6-3-15.1 lists, among those records, written physical security and cybersecurity policies and procedures reasonably designed to ensure the confidentiality, integrity, and availability of physical and electronic records and information.
Those policies and procedures must cover at least five functions: identify, protect, detect, respond and recover. Paragraph (E) of rule 1301:6-3-15.1 does not apply to an investment adviser licensed with the division whose principal place of business is in another state, who is registered as an investment adviser in that state and who complies with that state's record keeping requirements. The rule text now published is effective .
Section 3965.02 of the Revised Code requires each licensee to develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment. A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of Ohio, and the term includes an insurer.
The program must contain administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.
By the fifteenth day of February each year, unless otherwise permitted under division (I)(2) of section 3965.02, each insurer domiciled in Ohio must submit to the superintendent of insurance a written statement certifying that the insurer is in compliance with that section. An insurer domiciled in Ohio and licensed exclusively to conduct business in Ohio may submit that statement as part of its corporate governance annual disclosure required by section 3901.073 of the Revised Code.
A licensee with fewer than twenty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in assets is exempt from section 3965.02. The superintendent of insurance has the power to examine and investigate the affairs of any licensee to determine whether it has engaged in conduct that violates the chapter.
The provisions of the chapter and any rules adopted under it are the exclusive state standards and requirements for licensees on cybersecurity events, the security of nonpublic information, data security, investigation of cybersecurity events, and notification to the superintendent. The Revised Code shows section 3965.02 as effective , with Senate Bill 273 of the 132nd General Assembly as its latest legislation.
Section 9.64 of the Revised Code was enacted by House Bill 96 of the 136th General Assembly and is effective . A political subdivision is a county, township, municipal corporation, or other body corporate and politic responsible for governmental activities in a geographic area smaller than that of the state.
A political subdivision experiencing a ransomware incident must not pay or otherwise comply with a ransom demand unless its legislative authority formally approves the payment or compliance in a resolution or ordinance that states why it is in the best interest of the political subdivision.
The legislative authority of a political subdivision must adopt a cybersecurity program that safeguards the political subdivision's data, information technology, and information technology resources to ensure availability, confidentiality, and integrity. The program must be consistent with generally accepted best practices for cybersecurity, such as the national institute of standards and technology cybersecurity framework and the center for internet security cybersecurity best practices.
A ransomware incident is a malicious cybersecurity incident in which a person or entity introduces software that gains unauthorized access to or encrypts, modifies, or otherwise renders unavailable a political subdivision's information technology systems or data and thereafter demands a ransom.
Ohio Rev. Code sections 1354.01 to 1354.05 (enacted by Senate Bill 220, 132nd General Assembly, effective ; section 1354.01 last amended by House Bill 66, 132nd General Assembly, effective )Official statute text, Ohio Revised Code Chapter 1354, Ohio Laws (Legislative Service Commission)
In force since .Binds private bodies.
What this law does
The Ohio Data Protection Act, sections 1354.01 to 1354.05 of the Ohio Revised Code, extends an affirmative defense to any cause of action sounding in tort that is brought under the laws of this state or in the courts of this state and that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information, to a covered entity that creates, maintains, and complies with a written cybersecurity program that reasonably conforms to an industry recognized cybersecurity framework.
A covered entity is a business that accesses, maintains, communicates, or processes personal information or restricted information in or through one or more systems, networks, or services located in or outside this state, and the defense reaches personal information and restricted information together where the covered entity's program covers both.
The scale and scope of that program is appropriate if it is based on the size and complexity of the covered entity, the nature and scope of its activities, the sensitivity of the information to be protected, the cost and availability of tools to improve information security and reduce vulnerabilities, and the resources available to the covered entity.
Reasonable conformance is satisfied by the current version of the framework for improving critical infrastructure cybersecurity developed by National Institute of Standards and Technology (NIST), NIST special publication 800-171, NIST special publications 800-53 and 800-53a, the FedRAMP security assessment framework, the CIS critical security controls, or the ISO/IEC 27000 family, alone or in combination.
Alternatively, reasonable conformance is satisfied by reasonably conforming to the entirety of the current version of the Health Insurance Portability and Accountability Act (HIPAA) security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act of 2014, or the Health Information Technology for Economic and Clinical Health Act for a covered entity already regulated under one of them, or by complying with the PCI data security standard together with one of the first group's frameworks.
A covered entity must reasonably conform to a revised or amended framework not later than one year after its publication. This is an optional safe harbor and not a duty: sections 1354.01 to 1354.05 shall not be construed to provide a private right of action, including a class action, with respect to any act or practice regulated under those sections, so no covered entity can be sued for lacking a program and no state regulator administers this chapter.
An insurer or other licensee that meets Ohio's separate insurance-sector cybersecurity law, Ohio Revised Code Chapter 3965, is deemed by that chapter's own section 3965.02(J) to have a program that reasonably conforms to an industry recognized cybersecurity framework for purposes of this safe harbor.
Section 3965.04 of the Revised Code requires a licensee to notify the superintendent of insurance as promptly as possible, and in no event later than three business days, after a determination that a cybersecurity event involving nonpublic information in its possession has occurred, when either of two sets of criteria is met.
The first set of criteria is that Ohio is the licensee's state of domicile, in the case of an insurer, or its home state, in the case of an independent insurance agent, and that the event has a reasonable likelihood of materially harming a consumer or a material part of the licensee's normal operations.
The second set of criteria is that the licensee reasonably believes the nonpublic information involved relates to two hundred fifty or more consumers residing in Ohio and that the event is one of two further kinds. A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation itself or through a designated outside vendor or service provider.
A licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the event and produce them upon demand of the superintendent of insurance. A licensee that must notify the superintendent must also give the superintendent a copy of the notice it sent to consumers under section 1349.19 of the Revised Code.
A licensee subject to and in compliance with the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules is deemed to meet the chapter except for its notification requirements under section 3965.04. The Revised Code shows section 3965.04 as effective , with Senate Bill 273 of the 132nd General Assembly as its latest legislation.
The legislative authority of a political subdivision, following each cybersecurity incident or ransomware incident, must notify the executive director of the division of homeland security within the department of public safety as soon as possible but not later than seven days after the political subdivision discovers the incident.
It must also notify the auditor of state, in the manner the auditor of state prescribes, as soon as possible but not later than thirty days after the political subdivision discovers the incident. A cybersecurity incident includes a substantial loss of confidentiality, integrity, or availability of a covered entity's information system or network. Reports of a cybersecurity incident or ransomware incident under the notice duty are not public records under section 149.43 of the Revised Code.
Age gating law2 instruments, 1 in force, 1 blocked by a court
Research summary (137 words)
Ohio has enacted laws in two families.
The Parental Notification by Social Media Operators Act (2023) requires parental consent for minors under 16 to hold social media accounts; it was permanently enjoined by a federal district court in April 2025, but the Sixth Circuit reversed that ruling on and instructed the lower court to enter judgment for the state, so the law is poised to become enforceable once the appellate mandate issues (the Sixth Circuit denied rehearing en banc on , and the Supreme Court extended the time to petition for certiorari to ).
A separate adult content age verification law took effect , though the Attorney General's office has found most major pornography sites are not complying, citing an interactive-computer-service exemption lawmakers are now working to close.
Any entity that sells, disseminates, or presents material or a performance that is obscene or harmful to juveniles on the internet must verify that a user, and any person creating an account or subscription, is 18 or older using reasonable methods such as government-issued identification, a commercial age verification system, or transactional data, and must reverify age every two years.
The law exempts entities that qualify as interactive computer services under federal law, an exemption the Attorney General says most major pornography sites are relying on to avoid compliance, and which lawmakers were considering narrowing as of early 2026.
Blocked by a court.blocked by a court A court paused enforcement on . An injunction can be lifted, so the duty may return.
Binds private bodies.
What this law does
Operators of social media platforms directed to or reasonably expected to be accessed by children must obtain verifiable parental consent, through methods such as a signed form, credit card verification, phone or video call, or government ID, before allowing a child under 16 to create an account. Operators must also disclose available content moderation and parental control features.
Filed and counted under Cybersecurity law. Gives an affirmative defense to a tort claim over a data breach to a business whose written cybersecurity program reasonably conforms to an industry-recognized framework.
Where nothing was found1 area of law
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Reuse law
Ohio has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, and no state equivalent of California's Journalism Preservation Act (AB 886) or a comparable bargaining bill. No Ohio-specific statute or reported appellate decision addressing news aggregation, hot-news misappropriation, or platform-publisher payment has been located.
Snippet and headline reproduction, linking and framing, and text-and-data-mining questions reaching Ohio-based publishers are governed by federal copyright law alone; nothing in the Ohio Revised Code's commercial or intellectual-property titles, or among the AI-specific bills tracked for this jurisdiction, creates or proposes an aggregation-specific duty.
As of .
Reporting clocks that run here20 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Ohio comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the superintendent of insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Ohio is your state of domicile (insurer) or home state (independent insurance agent) and the event has a reasonable likelihood of materially harming a consumer or a material part of your normal operations (section 3965.04(A)(1)).
Give the same notice within the same three business days when you reasonably believe the nonpublic information involved relates to 250 or more Ohio consumers and the event is one you must report to a government body under other law or has a reasonable likelihood of materially harming an Ohio consumer or a material part of your normal operations (section 3965.04(A)(2)).
If you are an assuming insurer, notify your affected ceding insurers and the insurance commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred (section 3965.04(E)(1)).
After each cybersecurity incident or ransomware incident, have the legislative authority notify the executive director of the division of homeland security within the department of public safety, in the manner the executive director prescribes, as soon as possible and no later than seven days after the political subdivision discovers the incident (section 9.64(D)(1)).
Also notify the auditor of state, in the manner the auditor of state prescribes, as soon as possible and no later than thirty days after the political subdivision discovers the incident (section 9.64(D)(2)).
Notify an affected Ohio resident of a security breach involving their personal information in the most expedient time possible and no later than 45 days after discovery or notification of the breach.
Notify every nationwide consumer reporting agency without unreasonable delay if a single breach affects more than 1,000 Ohio residents.
If you are an owner or developer of an AI system involved in an incident causing significant bodily harm, death or major property damage, notify the relevant authorities promptly and comply with any subsequent investigation.
The law of the United States, which applies in Ohio
Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred.
A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.
If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more.
This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.
If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.
If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.
Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
If your organization is an Securities and Exchange Commission (SEC) reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
