{
 "jurisdiction_id": "US-AK",
 "jurisdiction": "United States – Alaska",
 "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-05",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 20,
  "sub_modules": 57,
  "source_register": 15
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "A functioning breach-notification/PII-protection statute and an insurance-sector security law exist and are enforced by the AG and Division of Insurance, but there is no omnibus privacy statute, no dedicated DPA, and no general registration/filing regime.",
   "claims": [
    {
     "statement": "The Alaska Attorney General's office is the enforcing authority for the Alaska Personal Information Protection Act (breach notification, SSN protection, disposal, credit freeze).",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "Federal Trade Commission / Alaska Dept. of Law",
     "source_url": "https://www.ftc.gov/system/files/documents/public_events/597241/sniffen_data_breaches.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alaska Attorney General is a listed data contributor to the FTC's Consumer Sentinel Network, evidencing its consumer-protection enforcement role relevant to data-privacy complaints.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/enforcement/consumer-sentinel-network/data-contributors",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Personal Information Protection Act under AS 45.48.010 et seq. of Chapter 47 of Title 45 of the Alaska Statutes was signed into law and entered into force on July 1, 2009.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Alaska enacted an Insurance Data Security Act (SB134) which became law without the Governor's signature, imposing data security standards on insurance licensees.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/alaska-insurance-data-security-becomes-law-without",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "APIPA's protections are structured around specific categories -- Social Security numbers, credit/financial account information, and records requiring disposal -- rather than a broad definition of 'processing' of personal data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Alaska's breach-notification and SSN-protection obligations apply to any business or government entity holding personal information of Alaska residents, regardless of the entity's state of establishment.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "Federal Trade Commission / Alaska Dept. of Law",
     "source_url": "https://www.ftc.gov/system/files/documents/public_events/597241/sniffen_data_breaches.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No general data-controller or processor registration/filing regime applies in Alaska outside of insurance-sector security-program obligations under the new Insurance Data Security Act.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/alaska-insurance-data-security-becomes-law-without",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "red",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "No state-level lawful-basis, consent, sensitive-data, or anonymisation framework exists; reliance is entirely on federal sectoral law.",
   "claims": []
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "red",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "No omnibus subject-rights framework exists at state level; only breach-notification receipt and credit-freeze rights are state-conferred.",
   "claims": [
    {
     "statement": "Alaska's Personal Information Protection Act requires businesses to notify the Attorney General, affected subscribers, and, where applicable, a credit reporting agency in the event of a breach of security concerning personal information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Concrete, enforceable security and breach-notification/disposal duties exist for general businesses (APIPA) and insurance licensees (SB134), but accountability-style obligations (DPIA, DPO, ROPA, joint-controller) are entirely absent.",
   "claims": [
    {
     "statement": "Alaska's Insurance Data Security Act (SB134) sets data security standards for insurance licensees, mandating implementation of an information security program.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/alaska-insurance-data-security-bill-passed-legislature",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alaska Personal Information Protection Act requires notification to the Alaska Attorney General, subscribers, and (if applicable) a credit reporting agency in the event of a breach of security concerning personal information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Alaska's Personal Information Protection Act mandates the disposal of records containing personal information and truncation of credit card information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No state cross-border transfer regime exists; this module is structurally inapplicable to a US sectoral-only state absent an omnibus statute.",
   "claims": []
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "A concrete, enacted insurance-sector data-security law exists and is material, but most other sectors rely entirely on federal sectoral law with no Alaska-specific overlay.",
   "claims": [
    {
     "statement": "Financial institutions operating in Alaska are subject to the federal Gramm-Leach-Bliley Act's Safeguards Rule for protection of nonpublic personal financial information, in the absence of an Alaska-specific banking privacy statute.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Health information held by covered entities operating in Alaska is subject to the federal HIPAA Privacy and Security Rules in the absence of an Alaska-specific comprehensive health-privacy statute.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "HHS OCR",
     "source_url": "https://www.hhs.gov/hipaa/index.html",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Alaska's Personal Information Protection Act provides consumers the ability to place a security freeze on a consumer credit report, supplementing federal FCRA protections.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Alaska's Senate Bill 134 sets data security standards for insurance licensees and became law without the Governor's approval.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/alaska-insurance-data-security-becomes-law-without",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "This entire module is unregulated at the state level in Alaska; only generic federal FTC Act unfairness/deception authority and federal telemarketing/email statutes apply.",
   "claims": []
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "red",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "No AI, ADM, biometric, or genetic-data statute exists in Alaska; the only relevant state-law hook is the general constitutional privacy clause, which does not provide AI/biometric-specific governance.",
   "claims": [
    {
     "statement": "The Constitution of the State of Alaska, Article I, Section 22, contains an explicit textual right to privacy, distinguishing Alaska from the majority of US states that lack such an express constitutional privacy clause.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "State of Alaska",
     "source_url": "https://ltgov.alaska.gov/information/alaskas-constitution/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "red",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "No Alaska-specific children's or vulnerable-groups data statute exists beyond the state's participation as a commenting/enforcing party in federal COPPA rulemaking.",
   "claims": [
    {
     "statement": "The Alaska Attorney General was among the state attorneys general who submitted comments to the FTC's 2024 COPPA Rule review, reflecting Alaska's participation in federal children's-privacy rulemaking rather than a separate state age-verification regime.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/system/files/ftc_gov/pdf/coppa_sbp_1.16_0.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alaska/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "AG enforcement capacity and multistate settlement participation are confirmed, but private-right-of-action, regulator funding/capacity, and 180-day developments are unconfirmed or negative findings.",
   "claims": [
    {
     "statement": "Alaska's Personal Information Protection Act sets out penalties for violations of the business obligations it imposes, enforceable by the Alaska Attorney General.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "27 state attorneys general, including Alaska, announced a $5 million settlement with Community Health Systems following a data breach affecting 6.1 million patients.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Anthem settled for $39.5 million with 43 state attorneys general, including Alaska, over a 2014 data breach affecting 78.8 million customers.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alaska",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  }
 ]
}