Georgia Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why Georgia Site Laws Look Different in 2026

Georgia has tried repeatedly to pass a comprehensive privacy statute. Senate Bill 111, the Georgia Consumer Privacy Protection Act, passed the Senate in 2025. A House committee substitute stripped the privacy text in March 2026. The bill Governor Kemp signed on May 11, 2026, became an unrelated tax credit measure. So Georgia still has no privacy law of the Virginia or Connecticut type.

The 2026 session, which ran from January 12 through April 6, 2026, focused on AI instead. Lawmakers sent three AI bills to the governor, including the chatbot bill that drew national attention. The result is a patchwork of Georgia site laws. Minors’ safety, breach notification, advertising, and sales tax each have a separate statute. The sections below walk through each one.

Senate Bill 540: The AI Chatbot Law Effective July 1, 2027

The biggest change to Georgia site laws in 2026 is Senate Bill 540. Senate Majority Leader Jason Anavitarte sponsored the bill, which passed the Senate on March 6, 2026. The House approved the bill on March 25, 2026, and the Senate agreed two days later. Governor Brian Kemp signed SB 540 on May 11, 2026. The law takes effect July 1, 2027.

The law covers AI companion chatbots, meaning systems that give adaptive, human like responses over time. A covered chatbot retains information across sessions, asks emotion based questions, or builds open ended companionship. Customer service bots, internal business bots, and video game characters are excluded. That exclusion holds only if the bot does not elicit emotional attachment. Unlike most states, Georgia grants no exemption for chatbots embedded in large platforms.

Covered operators must disclose at the start of each session that users are talking to AI. The disclosure repeats every three hours for adults and every hour for minors. Operators must block sexually explicit content with minors and may not simulate romantic relationships with children. Operators must maintain protocols that refer users expressing suicidal thoughts to crisis resources. Parental control tools are required for minor accounts.

The Attorney General enforces the law with civil penalties of up to $10,000 per knowing violation. For a small business, an order tracking bot falls outside, but a social assistant falls inside. Colorado and Connecticut chatbot rules start January 1, 2027. Building disclosure and crisis response now serves several states. Georgia gives you until July 1, 2027.

Senate Bill 351: Two Rules with Two Very Different Fates

Senate Bill 351, the Protecting Georgia’s Children on Social Media Act, was signed April 23, 2024. The law was written to take effect July 1, 2025. The social media provisions require platforms to verify age and get parental consent under 16. Those provisions also bar targeted advertising to minors and limit data collection from minor accounts. NetChoice sued, and Judge Amy Totenberg blocked the social media provisions on June 26, 2025.

The state appealed, and the Eleventh Circuit heard oral argument on March 10, 2026. As of this update, the injunction remains in place and no merits ruling has issued. The same court allowed Florida to enforce a similar law in November 2025. So the Georgia social media provisions could return quickly. If your site lets users create profiles and post content, watch this case closely.

The second part of SB 351 covers commercial websites with 33.3 percent or more harmful content. The injunction did not cover that provision. The age verification rule has applied since July 1, 2025. Covered sites must use a commercially reasonable method to confirm users are 18. Most business sites never need one.

Breach Notification Under O.C.G.A. 10-1-912

The breach notification statute is one of the older Georgia site laws, found at O.C.G.A. 10-1-910 through 10-1-915. The statute applies to information brokers and data collectors, including businesses holding computerized personal information. Personal information means a name combined with a Social Security number or driver’s license number. Account numbers with access codes, and usernames with passwords, also qualify.

After a breach of unencrypted data, you must notify affected residents as quickly as possible. Georgia sets no fixed number of days. You may delay notice only to complete an investigation or at law enforcement’s request. Notice may go by mail, telephone, or email. Substitute notice applies when direct notice would cost over $50,000 or reach over 100,000 people.

Georgia does not require notice to the Attorney General. If more than 10,000 residents are affected, you must notify the consumer reporting agencies. The statute has no express penalty provision. The Attorney General enforces security duties through the Fair Business Practices Act instead. A written breach plan remains the sensible default, and a multistate plan should include regulator notice.

The Fair Business Practices Act and Your Online Store

Georgia polices advertising through the Fair Business Practices Act at O.C.G.A. 10-1-390, which prohibits unfair or deceptive acts in consumer transactions. The Attorney General enforces the statute with civil penalties of up to $5,000 per violation. Consumers may sue for actual damages, and treble damages apply for intentional violations. Georgia courts look to Federal Trade Commission interpretations for guidance.

For your site, this is the law behind the everyday rules. Reference prices that were never charged create exposure. Timers that reset on every visit create exposure. Subscription trials that convert without clear disclosure create exposure. Hidden fees and staff written testimonials do the same.

Georgia also regulates automatic renewals within the Fair Business Practices Act. Consumer contracts with automatic renewal terms must disclose those terms clearly. Contracts of 12 months or more that renew for a month or longer require advance notice. That notice must arrive 30 to 60 days before the cancellation deadline. Treating every product page as regulated advertising keeps you clear of complaints.

Georgia Site Laws for eCommerce: Sales and Use Tax

Georgia imposes a 4 percent state sales tax, and local taxes push combined rates to 9. Following the 2018 Wayfair decision, Georgia enacted House Bill 61, which took effect January 1, 2019. That law set a $250,000 threshold. House Bill 182 lowered the figure to $100,000 effective January 1, 2020. Today, remote sellers must register once Georgia sales exceed $100,000 or 200 transactions yearly.

Marketplace facilitators such as Amazon and Etsy have collected on facilitated sales since April 1, 2020. Those marketplace sales do not count toward your own threshold. Georgia uses destination sourcing, so you charge the rate for the customer’s delivery address. The Department of Revenue publishes rate charts and a registration portal. Registration runs through the Georgia Tax Center.

Digital goods delivered electronically, such as e-books and streaming, have been taxable since January 1, 2024. That change came from House Bill 170, signed in 2023. Prewritten software delivered electronically remains exempt. Shipping charges are taxable when tied to a taxable sale. Check your product categories against Department guidance instead of trusting default platform settings.

The Privacy Bill That Did Not Pass

If privacy headlines led you to Georgia site laws, you heard about Senate Bill 111. Senator John Albers introduced the bill in 2025 as the Georgia Consumer Privacy Protection Act. The bill passed the Senate in 2025 with broad support. The proposal would have applied to businesses processing data of 35,000 or more Georgia consumers. Consumers would have gained access, deletion, correction, and opt out rights.

In March 2026, a House committee replaced the entire text with a hospital tax credit measure. The stripped bill passed and became Act 462 on May 11, 2026. The privacy provisions died with the session on April 6, 2026. Georgia has now failed to pass comprehensive privacy legislation in four straight sessions. Senator Albers has signaled another attempt in January 2027.

For your website, this means Georgia imposes no privacy notice requirement today. However, most Georgia businesses serve customers in states that do. A clear privacy policy that describes collection, sharing, and opt outs remains the sensible default. Building consumer request systems now avoids a scramble if a 2027 bill passes.

What You Should Do Now

You do not need a compliance department to satisfy Georgia site laws. You do need a short list of concrete tasks. Each step below addresses a rule in force or scheduled. Each also positions you well if the social media injunction lifts.

1. Inventory any chatbot on your site and plan disclosures, crisis protocols, and parental controls before July 1, 2027.
2. Map every place you store personal information, confirm encryption, and write a breach plan that reaches residents quickly.
3. Review pricing displays, subscription flows, and reviews against the Fair Business Practices Act and FTC guidance.
4. Check your Georgia sales against the $100,000 and 200 transaction tests and register through the Georgia Tax Center if needed.
5. If your site hosts user profiles and posts, prepare age verification and parental consent tools in case the SB 351 injunction lifts.

Once those tasks are done, you will be current on the Georgia site laws covered here. Put two dates on your calendar. Watch for the Eleventh Circuit’s ruling on SB 351. Then mark July 1, 2027, when SB 540 takes effect. The 2027 session convenes in January, and a new privacy bill is expected.

Key Takeaways

• SB 540, signed May 11, 2026, requires AI companion chatbot disclosures and minor protections beginning July 1, 2027.
• SB 351’s age verification rule for adult content sites has applied since July 1, 2025, but its social media provisions remain enjoined.
• Breach notices are due in the most expedient time possible, with consumer reporting agency notice above 10,000 residents.
• Remote sellers collect Georgia sales tax after $100,000 in sales or 200 transactions.
• SB 111, the privacy bill, was stripped of its privacy text in March 2026, leaving Georgia without a comprehensive privacy law.

Frequently Asked Questions About Georgia Site Laws

Does Georgia have a privacy law like California’s CCPA?

No. Senate Bill 111 would have created one, but a House committee removed the privacy text. Georgia relies on the breach notification statute, the Fair Business Practices Act, and federal law. A new privacy bill is expected in the 2027 session.

Do Georgia site laws apply to my business if I am located in another state?

Yes, in most cases. SB 540 reaches any operator offering a companion chatbot to Georgia users. The breach statute covers anyone holding Georgia residents’ data. The Fair Business Practices Act covers sales to Georgia consumers. Sales tax rules apply once you exceed $100,000 in sales or 200 transactions.

Do Georgia site laws require age verification on my website?

Only in two situations. Sites with 33.3 percent or more harmful content must verify that users are 18. Social media platforms would need to verify age under SB 351, but that rule is blocked. A typical business site meets neither test. Federal COPPA rules still apply if your site targets children under 13.

How quickly must I report a data breach in Georgia?

Georgia requires notice in the most expedient time possible and without unreasonable delay. The statute sets no fixed deadline and requires no notice to the Attorney General. If more than 10,000 residents are affected, you must notify the consumer reporting agencies.

Do Georgia site laws require me to disclose AI chatbots on my website?

Beginning July 1, 2027, yes for AI companion chatbots under SB 540. Operators must disclose AI at the start of each session and every three hours after. Minors receive the reminder every hour. Customer service bots are exempt unless they build emotional attachment.

Conclusion

Georgia site laws in 2026 reward the owner who tracks court orders and effective dates. SB 540 brings companion chatbot rules on July 1, 2027, with no exemption for big platforms. SB 351 applies to adult content sites today, while the social media rules await appeal. The breach statute sets no fixed deadline but demands prompt action. The Fair Business Practices Act and the sales tax rules reach nearly every online seller.

The privacy bill failed again in 2026, but a 2027 return seems likely.