Hawaii Site Laws Report: Laws, Updates, and Information That May Affect Your Website and eCommerce

Why Hawaii Site Laws Follow a Different Pattern

Hawaii has considered comprehensive privacy bills in nearly every recent session. In 2026, House Bill 2463 and Senate Bill 3016 both proposed consumer privacy frameworks. Neither bill reached the governor before the session ended on May 8, 2026. So Hawaii still relies on targeted statutes rather than one umbrella law. Those targeted statutes still reach nearly every website.

The 2026 session focused on AI and social media instead. Governor Josh Green signed the AI companion law and the deletion act on July 14, 2026. He also signed House Bill 2137, a deepfake protection measure. The result is a patchwork of Hawaii site laws. The sections below take each piece in turn.

Act 248: The AI Companion Law in Force Since July 14, 2026

The biggest change to Hawaii site laws in 2026 is Senate Bill 3001. Senator Jarrett Keohokalole sponsored the bill after sharing a chatbot’s transcripts with a 12 year old. The House passed the bill without opposition in April 2026. Governor Green signed Act 248, the Artificial Intelligence Disclosure and Safety Act, on July 14, 2026. Unlike the Georgia and Colorado laws, the Hawaii law took effect immediately.

The law covers AI companions, meaning systems designed to simulate a sustained human relationship. A covered system retains prior interactions, asks emotion based questions, and sustains personal dialogue. An operator is anyone who develops and offers such a system to the public. App stores and search engines that merely provide access are not operators. A developer of the underlying model is not liable for a third party’s companion product.

If a reasonable person could believe a human is talking, you must disclose the AI. When you know or have reasonable certainty that a user is under 18, stricter rules apply. The disclosure must stay visible, or appear at each session start and once per hour. The hourly notice must remind the minor to take a break. The law does not prescribe any method for determining age.

Operators must adopt protocols for prompts involving suicidal thoughts or self harm. Those protocols must refer users to crisis hotlines or crisis text lines. You may not present a companion as a licensed mental health professional. For minors, you may not use unpredictable rewards to boost engagement or discourage disengagement. You must also block sexually explicit content and provide parental tools for screen time.

Beginning January 1, 2028, operators must file annual reports with the Department of Health. A violation is an unfair or deceptive practice under HRS section 480-2. The Attorney General enforces the law, and there is no private right of action. For a small business, an order tracking bot falls outside the definition. Any AI assistant that remembers users and chats socially falls inside.

Act 252: The Social Media Data Deletion Act

The second new law is House Bill 1753, the Hawaii Social Media Data Deletion Act. Governor Green signed the bill as Act 252 on July 14, 2026. The law takes effect July 1, 2027. The Act covers social media platforms with one million or more monthly active users nationwide. Platforms must also have at least $25 million in annual gross revenue.

Covered platforms must provide an accessible way for users to delete their accounts. Deletion must permanently erase all personal and sensitive personal information tied to the account. Personal information expressly includes tracking cookies, IP addresses, and digital beacons. Platforms may not use confusing menus or dark patterns to obstruct deletion. The Attorney General may seek injunctions and civil penalties.

Most small business sites fall far below the one million user threshold. Still, the law signals where Hawaii site laws are heading. A clear account deletion path is already a best practice. Users in Connecticut, California, and other states hold deletion rights under their own laws. Building one deletion process now serves every state at once.

Breach Notification Under HRS Chapter 487N

The breach notification statute is one of the older Hawaii site laws. The law appears at HRS sections 487N-1 through 487N-7. The statute applies to any business that owns or licenses personal information of Hawaii residents. Personal information means a name combined with a Social Security number or driver’s license number. Account numbers with access codes also qualify.

After a breach of unencrypted data, you must notify affected residents without unreasonable delay. Hawaii sets no fixed number of days. You may delay notice only at a law enforcement request. Notice may go by mail, telephone, or email under federal E-SIGN rules. Substitute notice applies when direct notice would cost over $100,000 or reach over 200,000 people.

If a breach affects more than 1,000 residents, you must notify the Office of Consumer Protection. You must also notify the consumer reporting agencies at that level. Violations carry civil penalties of up to $2,500 per violation. Affected residents may also sue for actual damages. A written breach plan remains the sensible default.

The Unfair Trade Practices Law and Your Online Store

Hawaii polices advertising through HRS chapter 480, which prohibits unfair or deceptive acts. Section 480-2 adopts the Federal Trade Commission Act standard directly. That means federal advertising rules become part of Hawaii site laws. Consumers may recover treble damages, with a $1,000 minimum, plus attorney fees. The Office of Consumer Protection may seek civil penalties of up to $10,000 per violation.

For your site, this is the law behind the everyday rules. Reference prices that were never charged create exposure. Timers that reset on every visit create exposure. Subscription trials that convert without clear disclosure create exposure. Hidden fees and staff written testimonials do the same.

Hawaii also regulates automatic renewals at HRS section 481B-5.5. Consumer contracts that renew automatically must disclose the renewal terms clearly. Contracts of 12 months or longer that renew for a month or more require advance notice. That notice must arrive 30 to 60 days before the cancellation deadline. Treating every product page as regulated advertising keeps you clear of complaints.

Hawaii Site Laws for eCommerce: The General Excise Tax

Hawaii has no sales tax in the usual sense. Instead, the state imposes a general excise tax, known as GET, on the seller. The base rate is 4 percent, and counties add a surcharge of up to 0.5 percent. Sellers may pass the tax to customers, but the seller owes the tax. The tax also applies to services and digital goods, not only physical products.

Following the 2018 Wayfair decision, Hawaii enacted Act 41, effective July 1, 2018. Remote sellers must register once Hawaii sales exceed $100,000 or 200 separate transactions. Either test in the current or previous calendar year triggers the obligation. Marketplace facilitators have collected on facilitated sales since January 1, 2020. Those marketplace sales do not count toward your own threshold.

Registration runs through the Department of Taxation and costs a one time $20 fee. Once registered, you charge the combined rate for the customer’s county. Software, streaming, and downloads are all taxable under GET. Check your product categories against Department guidance instead of trusting default platform settings. The GET rules surprise more mainland sellers than any other Hawaii rule.

Minors, Age Verification, and Deepfakes

Hawaii has no general age verification mandate for adult content websites. The state also has no law barring minors from social media accounts. House Bill 1782 would have required age assurance for chatbots, but the bill died in conference. So Hawaii site laws reach minors mainly through the AI companion law. Federal COPPA rules still apply if your site targets children under 13.

Governor Green did sign House Bill 2137 on July 14, 2026. That law expands protections against AI generated intimate images of real people. The law exempts parody, satire, commentary, news reporting, and documentary works. If your site hosts user uploads, your takedown process should reflect that law. Federal removal duties under the 2025 federal intimate image law have applied since May 19, 2026.

What You Should Do Now

You do not need a compliance department to satisfy Hawaii site laws. You do need a short list of concrete tasks. Each step below addresses a rule in force or scheduled. Each also positions you well if a privacy bill passes in 2027.

1. Inventory any chatbot on your site and add AI disclosures, crisis protocols, and minor safeguards today, because Act 248 is already in force.
2. Map every place you store personal information, confirm encryption, and write a breach plan that reaches residents and the Office of Consumer Protection.
3. Review pricing displays, subscription flows, and reviews against HRS chapter 480 and FTC guidance.
4. Check your Hawaii sales against the $100,000 and 200 transaction tests and register for GET if needed.
5. Build a clear account deletion path and a takedown process for user uploaded images.

Once those tasks are done, you will be current on the Hawaii site laws covered here. Put two dates on your calendar. Mark July 1, 2027, when Act 252 takes effect. Then watch the 2027 session, which opens in January. A comprehensive privacy bill is expected to return.

Key Takeaways

• Act 248, the AI Disclosure and Safety Act, took effect July 14, 2026, and covers AI companions immediately.
• Act 252, the Social Media Data Deletion Act, takes effect July 1, 2027, for platforms with one million users and $25 million in revenue.
• Breach notices are due without unreasonable delay, with Office of Consumer Protection notice above 1,000 residents.
• Remote sellers owe general excise tax after $100,000 in sales or 200 transactions.
• Hawaii has no comprehensive privacy law and no age verification mandate as of September 2026.

Frequently Asked Questions About Hawaii Site Laws

Does Hawaii have a privacy law like California’s CCPA?

No. House Bill 2463 and Senate Bill 3016 proposed comprehensive frameworks in 2026, but neither passed. Hawaii relies on the breach statute, chapter 480, and the new AI and deletion laws. A new privacy bill is expected in the 2027 session.

Do Hawaii site laws apply to my business if I am located in another state?

Yes, in most cases. Act 248 reaches any operator offering an AI companion to Hawaii users. The breach statute covers anyone holding Hawaii residents’ data. Chapter 480 covers sales to Hawaii consumers. GET rules apply once you exceed $100,000 in sales or 200 transactions.

Do Hawaii site laws require age verification on my website?

No. Hawaii has no age verification mandate for adult content or social media. Act 248 requires safeguards for known minors but sets no verification method. Federal COPPA rules still apply if your site targets children under 13.

Do I need to collect sales tax on orders shipped to Hawaii?

Not sales tax, but general excise tax. Remote sellers must register once Hawaii sales exceed $100,000 or 200 transactions. The base rate is 4 percent plus county surcharges. GET applies to services and digital goods as well as physical products.

Do Hawaii site laws require me to disclose AI chatbots on my website?

Yes, if your chatbot qualifies as an AI companion under Act 248. The law took effect July 14, 2026. You must disclose AI use whenever a reasonable person could believe a human is talking. Minors must receive the disclosure at the start of each session and hourly.

Conclusion

Hawaii site laws in 2026 reward the owner who tracks effective dates rather than headlines. Act 248 brought AI companion rules into force on July 14, 2026, with no waiting period. Act 252 adds account deletion duties for large platforms on July 1, 2027. The breach statute demands prompt action, and chapter 480 imports federal advertising standards. The general excise tax reaches services and digital goods that mainland sellers rarely expect to tax.

The privacy bills failed again in 2026, but a 2027 return seems likely. Finish the five tasks above this fall. You will meet every current requirement while staying ready for the next session.

Take the Next Step

Staying compliant does not require a law degree. You do need a reliable place to check the rules as they change. Bookmark this report and review your chatbot, breach plan, and GET registration before 2027. If you want a second set of eyes, ask a website professional or a Hawaii attorney. A short review today costs far less than an Office of Consumer Protection inquiry tomorrow.