Alaska Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why Alaska Site Laws Look Different From Other States

Alaska takes a different path than California, Colorado, Texas, or Virginia. Those states have comprehensive consumer privacy statutes that set broad rules for collecting and using personal data. Alaska does not currently have one statewide comprehensive consumer-data privacy law for private businesses. Instead, website owners should focus on a patchwork of rules: Alaska’s constitutional privacy provision, the Alaska Personal Information Protection Act, the Alaska Unfair Trade Practices and Consumer Protection Act, local remote-sales tax rules, and applicable federal law.

That patchwork matters in two ways. First, there is no single Alaska privacy-law checklist for a typical website. Second, Alaska has no statewide sales tax, but participating local governments impose sales taxes that can apply to remote ecommerce sales. The sections below cover the rules most likely to affect an online store, SaaS business, customer portal, or content platform.

The Alaska Personal Information Protection Act: Data-Breach Duties

The principal Alaska breach-notification law is the Alaska Personal Information Protection Act, AS 45.48.010-.090. It generally applies when a covered business owns, licenses, or maintains personal information about an Alaska resident and a qualifying security breach occurs. The statute defines personal information narrowly compared with modern comprehensive privacy laws: it generally requires a person’s name together with specified sensitive data elements, such as a Social Security number, driver’s-license or state-ID number, financial-account credentials, certain health or medical information, or biometric information.

When the law applies, notice to affected Alaska residents must be made in the most expeditious time possible and without unreasonable delay, subject to the statute’s investigation, system-restoration, and law-enforcement-delay provisions. The law permits written, electronic, and, in specified circumstances, substitute notice. Businesses should review the statutory definitions and notice methods against the facts of the incident rather than assuming that every security event triggers the same response.

Alaska also has a limited risk-of-harm exception. After an appropriate investigation, a business may decide not to notify consumers if it determines there is not a reasonable likelihood of harm; the business must provide written notice of that determination to the Alaska Attorney General and retain the written determination for five years. If notice is required for more than 1,000 Alaska residents, the business must also notify nationwide consumer reporting agencies of the timing, distribution, and content of the consumer notice.

A breach-notification violation by a nongovernmental information collector is an unfair or deceptive act or practice under Alaska law. The statute also provides for state civil penalties of up to $500 for each resident who was not notified, subject to a $50,000 cap, and limits certain private remedies to actual economic damages. For a website owner, the practical takeaway is straightforward: know what personal information your vendors and systems hold, maintain an incident-response process, and preserve the records needed to assess and document a breach.

Consumer Protection Rules That Reach Your Online Store

The Alaska Unfair Trade Practices and Consumer Protection Act, AS 45.50.471-.561, prohibits unfair or deceptive acts or practices in trade or commerce. It is the broad state-law backstop for online advertising, product descriptions, pricing representations, subscriptions, endorsements, and checkout disclosures. The Alaska Department of Law’s Consumer Protection Unit administers consumer-protection enforcement.

For a small business website, the safest operating habit is to make material terms clear before purchase: accurately describe the product or service, disclose mandatory charges and recurring-payment terms where applicable, avoid misleading price or availability claims, and do not present reviews or endorsements in a deceptive way. Federal rules enforced by the Federal Trade Commission may apply to the same conduct, so Alaska compliance does not replace federal advertising, endorsement, negative-option, or children’s-privacy obligations.

Sales Tax: Alaska Rules for Ecommerce Sellers

Alaska has no statewide sales tax. However, local governments may impose sales tax, and many participating jurisdictions use the Alaska Remote Seller Sales Tax Commission (ARSSTC) and its Uniform Code for remote-sales collection and filing.

Under the ARSSTC’s current guidance, a remote seller or marketplace facilitator that has at least $100,000 in gross sales into Alaska in either the current or prior calendar year must register. The former 200-transaction threshold was removed effective January 1, 2025. The threshold calculation generally includes Alaska sales regardless of destination or the buyer’s taxability status, including marketplace-facilitator sales when measuring whether the seller has crossed the threshold.

Once a seller meets the threshold, ARSSTC says it must register within 30 days and collect and remit applicable tax for sales delivered into ARSSTC member jurisdictions. A business that sells exclusively through a marketplace facilitator generally does not need to register itself, but ARSSTC directs the marketplace seller to submit its Marketplace Seller Affidavit. A seller with both marketplace and direct website sales should review ARSSTC’s separate reporting instructions carefully.

These are local and commission-administered rules, not a statewide Alaska sales tax. Physical-presence sales may be reportable directly to the relevant local jurisdiction rather than through ARSSTC, and participating jurisdictions, rates, exemptions, and filing requirements can change. Check the ARSSTC tax lookup and member-jurisdiction information before configuring checkout tax.

New in 2026: HB 239 and Generated Child Sexual Abuse Material

Alaska enacted House Bill 239, an omnibus criminal-law measure that became effective July 1, 2026. Among many criminal-law changes, it added offenses addressing the distribution and possession of generated obscene child sexual abuse material and made related updates to Alaska’s child-sexual-abuse-material laws. It also changed several provisions that use the age of 16 to use the age of 18 instead.

This is a criminal-law development, not a general website privacy or platform-governance statute. HB 239 does not create a general requirement for every website to verify users’ ages, obtain parental consent for social-media accounts, disable recommendation feeds, or impose a platform curfew. It also does not establish a general private compliance checklist for ordinary publishers or ecommerce sites.

Businesses that provide image-generation tools, host user uploads, or operate interactive communities should nevertheless review their existing safety controls, terms, escalation paths, and reporting procedures. The enacted law includes limited provisions relevant to provider personnel acting in good-faith efforts to prevent, detect, report, or otherwise respond to specified unlawful material. That does not eliminate the need to assess a service’s particular role and conduct under the statute and other applicable law.

Social-Media and Age-Verification Proposals Did Not Become Law

Several 2026 proposals would have imposed much broader duties on online services. The House-passed version of HB 47 included social-media provisions, but the Senate committee substitute removed those provisions and the bill did not complete the legislative process. Separately, SB 262 proposed restrictions concerning social-media accounts and minors but also did not become law.

As of September 21, 2026, Alaska therefore has not enacted a statewide social-media age-verification mandate for ordinary websites or a statewide requirement that platforms obtain parental consent before a minor may create an account. Federal laws, including COPPA where applicable, and laws of other states may still affect a business based on its audience and operations.

The Comprehensive Privacy Bill That Did Not Pass: HB 367

If you heard that Alaska adopted a broad consumer privacy law in 2026, that is not correct. HB 367, the Consumer Data Privacy Act, was introduced on February 23, 2026 and was reported from the House Judiciary Committee to House Finance on May 12, 2026. It did not receive final legislative approval before the end of the 34th Legislature.

HB 367 would have created consumer rights and business duties concerning personal information, including proposed access, deletion, and opt-out rights, and it would have created data-broker registration requirements. Those proposed duties are not currently enforceable Alaska law. Businesses should not represent HB 367’s proposal as an enacted Alaska privacy statute.

What You Should Do Now

Knowing the rules only helps if you turn them into a short, practical plan. The following steps address the current Alaska rules discussed above and can also improve general readiness for future legal changes:

1. Inventory the personal information your site collects, where it is stored, and which service providers can access it.
2. Maintain a written incident-response plan that covers investigation, legal review, customer notice, regulator notice, and preservation of breach-decision records.
3. Audit product descriptions, pricing, recurring-payment disclosures, and endorsements for accuracy and clarity.
4. Review current and prior-calendar-year Alaska sales against the $100,000 ARSSTC threshold, including sales made through marketplace facilitators.
5. If your service supports user uploads or generated images, review moderation and escalation procedures for unlawful child sexual abuse material and other prohibited content.

These steps are practical compliance measures, not legal advice. A business with a significant Alaska customer base, sensitive-data operations, regulated products, or interactive user content may need advice tailored to its facts.

Key Takeaways

• Alaska has no comprehensive consumer data privacy law as of September 21, 2026; HB 367 did not become law.
• The Alaska Personal Information Protection Act remains the state’s principal private-sector data-breach-notification statute.
• HB 239 took effect July 1, 2026 and added criminal provisions concerning generated obscene child sexual abuse material.
• Alaska did not enact a general social-media age-verification or parental-consent mandate in 2026.
• For ARSSTC remote-sales rules, the current economic threshold is $100,000 in Alaska gross sales; the 200-transaction threshold has been removed since January 1, 2025.

Frequently Asked Questions About Alaska Site Laws

Does Alaska have a privacy law like California’s CCPA?

No. As of September 21, 2026, Alaska has not enacted a comprehensive consumer-data privacy statute for private businesses. It does have a breach-notification law and broad consumer-protection law, among other targeted rules.

Do Alaska site laws apply to a business located in another state?

They can. Alaska’s breach-notification statute can apply to covered personal information of Alaska residents, and ARSSTC remote-sales rules can apply to businesses selling into participating Alaska jurisdictions once the applicable threshold is met. The exact result depends on the statute, the business’s conduct, and the transaction.

Does Alaska require age verification on my website?

Not under a general statewide website or social-media law as of September 21, 2026. The broader 2026 social-media proposals did not become law. That answer does not address federal requirements, other states’ laws, or age checks that may be appropriate for a particular regulated product or service.

How quickly must I report a data breach in Alaska?

The Personal Information Protection Act uses a promptness standard: notice must be made in the most expeditious time possible and without unreasonable delay, subject to statutory exceptions. It does not set a single numerical deadline for all breaches.

When must an online seller register with ARSSTC?

ARSSTC says remote sellers and marketplace facilitators must register when they reach $100,000 in gross Alaska sales in either the current or prior calendar year. Registration is due within 30 days of meeting the threshold, subject to the commission’s rules and the seller’s physical-presence and marketplace facts.

Conclusion

Alaska site laws reward a business owner who separates enacted law from legislative proposals. Today, the core Alaska issues for most websites are breach response, truthful online selling, and local remote-sales tax compliance. The 2026 criminal-law changes involving generated child sexual abuse material are important for businesses with user-content or image-generation features, but they did not create a general social-media age-verification system. HB 367 and the 2026 social-media proposals may be useful signals of policy interest, but they are not current compliance mandates.