🔒 Data Protection Regulatory Intelligence
GDPRI · dataprotection.gi
US-HI · run data-protection-2026-08-05 v13-gdpri-1.0.0
content: ai_generated 16 sources retrieved model claude-sonnet-5 ·

United States – Hawaii

US-HI schema gdpri-v2 trajectory: not recordedregulated (sectoral)overlaps: FIM, WPM, AIC

Last updated · 10 categories · 22 claims · 16 sources in the cumulative register

10Categoriesbaseline.[]
57Sub-modulesbaseline..sub_modules{}
22Claimsbaseline..claims[]
0Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix (sums to 10 rendered categories; click to filter)

Jurisdiction brief

No content recorded at this JID path.

10 of 10 categories
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

A regulator and a breach-notification instrument exist and are actively enforced/amended, but there is no omnibus material-scope, territorial-scope, or registration regime.

Primary frameworkFederal FTC Act Section 5 + Hawaii Revised Statutes ch. 487N (breach notification) + HRS chs. 480/481A (UDAP)
Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — AmberA regulator and a breach-notification instrument exist and are actively enforced/amended, but there is no omnibus material-scope, territorial-scope, or registration regime.

Sub-modules (5)

Regulator And AuthorityAmber

The Hawaii AG's Office of Consumer Protection enforces UDAP statutes (HRS chs. 480, 481A) and the breach law (HRS ch. 487N); there is no dedicated Hawaii DPA.

Claims (1):

  • The Hawaii Attorney General, through its Office of Consumer Protection, enforces privacy and data-security matters under the state's unfair-or-deceptive-acts-and-practices statutes, HRS chs. 480 and 481A.

Act And InstrumentsRed

No general/omnibus privacy law is in effect in Hawaii.

Claims (1):

  • Hawaii does not currently have a general/omnibus consumer-privacy law in effect.

Material ScopeAmber

Material scope is confined to the breach law's narrow 'personal information' definition (SSN, driver's license/HI ID, or financial account credentials).

Claims (1):

  • Hawaii's breach-notification statute (HRS ch. 487N) defines 'personal information' narrowly as a first name/initial and last name combined with SSN, driver's license/Hawaii ID number, or financial account access credentials, and uniquely extends to paper records.

Territorial ScopeAmber

No Hawaii-specific territorial-scope test exists; the operative extraterritorial baseline is federal FTC Act Section 5, which reaches conduct affecting Hawaii consumers regardless of controller location.

Claims (1):

  • No Hawaii-specific extraterritorial/controller-scope test exists; the applicable extraterritorial baseline for Hawaii residents is federal FTC Act Section 5.

Regulator Registration And FilingRed

No general controller registration/filing regime exists today; a pending bill (HB 2463, the 'Drop and Delete Act') would introduce annual data-broker registration, but it is not yet law.

Claims (1):

  • House Bill 2463 (the Hawaii 'Drop and Delete Act') would require data brokers to register annually and establish a consumer deletion mechanism, but has not been enacted.
Category narrative60 words

Hawaii has no comprehensive state consumer-privacy statute or dedicated data-protection authority. The Hawaii Attorney General's Office of Consumer Protection is the principal state-level enforcer, acting under the state's general unfair-or-deceptive-acts-and-practices (UDAP) statutes (HRS chs. 480 and 481A), alongside the state's narrow breach-notification statute (HRS ch. 487N). Federal FTC Act Section 5 authority applies concurrently and nationally, including to Hawaii-based conduct.

Sources and claims (5)
  1. ProbableNAAG — The Hawaii Attorney General, through its Office of Consumer Protection, enforces privacy and data-security matters under the state's unfair-or-deceptive-acts-and-practices statutes, HRS chs. 480 and 481A.observed
  2. ConfirmedDataGuidance — Hawaii does not currently have a general/omnibus consumer-privacy law in effect.observed
  3. ConfirmedIAPP — Hawaii's breach-notification statute (HRS ch. 487N) defines 'personal information' narrowly as a first name/initial and last name combined with SSN, driver's license/Hawaii ID number, or financial account access credentials, and uniquely extends to paper records.observed
  4. ProbableFederal Trade Commission — No Hawaii-specific extraterritorial/controller-scope test exists; the applicable extraterritorial baseline for Hawaii residents is federal FTC Act Section 5.observed
  5. UncertainDataGuidance — House Bill 2463 (the Hawaii 'Drop and Delete Act') would require data brokers to register annually and establish a consumer deletion mechanism, but has not been enacted.observed

#

No general lawful-basis, consent, or special-category regime is in force; only narrow sectoral carve-outs and pending bills exist.

Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — RedNo general lawful-basis, consent, or special-category regime is in force; only narrow sectoral carve-outs and pending bills exist.

Sub-modules (4)

Lawful BasesRed

No enumerated lawful-bases framework exists at Hawaii state level.

Absence provenance: not recorded. Searched: not recorded.

Special CategoriesAmber

Special-category-style protection is limited to health records (HRS §622-57) and insurance-sector personal data under the Hawaii Insurance Code; there is no cross-sectoral sensitive-data regime.

Claims (1):

  • Hawaii Revised Statutes §622-57 (Chapter 622, Title 33) protects medical records and privacy rights, and the Hawaii Insurance Code imposes privacy-practice requirements on licensed insurers, producers, and other licensees.

Pseudonymisation And AnonymisationRed

No Hawaii statutory definitions or safe harbours for pseudonymisation/anonymisation were identified.

Absence provenance: not recorded. Searched: not recorded.

Category narrative53 words

Hawaii has no GDPR/CCPA-style enumerated lawful-bases regime, no general consent standard for processing, and no cross-sectoral 'special category' data framework. Sector-specific consent/protection rules exist only for medical records (HRS §622-57) and insurance-held information (Hawaii Insurance Code); a pending bill (SB 1163) would add opt-in consent for sale of geolocation, microphone-derived, and browser data.

Sources and claims (2)
  1. ProbableDataGuidance — Hawaii Senate Bill 1163 would prohibit the sale of geolocation, microphone-derived, and internet browser information without explicit opt-in consent, but is not yet enacted.observed
  2. ConfirmedDataGuidance — Hawaii Revised Statutes §622-57 (Chapter 622, Title 33) protects medical records and privacy rights, and the Hawaii Insurance Code imposes privacy-practice requirements on licensed insurers, producers, and other licensees.observed

#

No comprehensive statutory data-subject-rights framework is in force in Hawaii; the closest analogue (SB 1037) remains a pending bill.

Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — RedNo comprehensive statutory data-subject-rights framework is in force in Hawaii; the closest analogue (SB 1037) remains a pending bill.

Sub-modules (5)

Access RightRed

No general state-law access right; SB 1037 (pending) would create one with AG enforcement.

Claims (1):

  • Hawaii Senate Bill 1037 proposes a consumer data-protection framework, including data-subject rights, with enforcement by the Attorney General, but has not been enacted into law.

Rectification And ErasureRed

No general state-law rectification/erasure right exists in force.

Absence provenance: not recorded. Searched: not recorded.

Restriction And ObjectionRed

No general restriction/objection right exists in force.

Absence provenance: not recorded. Searched: not recorded.

Data PortabilityRed

No general portability right exists in force.

Absence provenance: not recorded. Searched: not recorded.

Deadlines And Response WindowsRed

No statutory controller response-window regime exists for consumer rights requests at Hawaii state level (breach notification timing is addressed separately under controller_processor_duties).

Absence provenance: not recorded. Searched: not recorded.

Category narrative53 words

Hawaii confers no general statutory rights of access, rectification, erasure, restriction, objection, or portability over personal data. Such rights exist only indirectly through federal sectoral law (e.g., HIPAA access rights for medical records) or would be created by pending Senate Bill 1037, a comprehensive consumer-data-protection framework proposed with AG enforcement, not yet enacted.

Sources and claims (1)
  1. ProbableDataGuidance — Hawaii Senate Bill 1037 proposes a consumer data-protection framework, including data-subject rights, with enforcement by the Attorney General, but has not been enacted into law.observed

#

A binding breach-notification duty exists and is under active legislative amendment, but accountability/DPIA/DPO/ROPA/retention obligations are absent.

Primary frameworkHawaii Revised Statutes ch. 487N (breach notification)
Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — AmberA binding breach-notification duty exists and is under active legislative amendment, but accountability/DPIA/DPO/ROPA/retention obligations are absent.

Sub-modules (7)

Accountability And DpiaRed

No DPIA/accountability-principle statute exists in force.

Absence provenance: not recorded. Searched: not recorded.

Dpo RequirementsRed

No DPO appointment requirement exists in Hawaii law.

Absence provenance: not recorded. Searched: not recorded.

Ropa RequirementsRed

No records-of-processing obligation exists in Hawaii law.

Absence provenance: not recorded. Searched: not recorded.

Joint Controller ArrangementsRed

No joint-controller regime is defined in Hawaii law.

Absence provenance: not recorded. Searched: not recorded.

Security MeasuresRed

No general technical/organisational security-of-processing mandate distinct from breach notification was identified for Hawaii.

Absence provenance: not recorded. Searched: not recorded.

Breach NotificationAmber

HRS ch. 487N requires notice to affected Hawaii residents following a breach of the statute's narrowly-defined personal information, and is currently subject to a pending 2026 amendment bill (SB 1038).

Claims (2):

  • Hawaii Revised Statutes Chapter 487N requires notification to Hawaii residents following a breach of security involving the statute's defined personal information, and is one of the few state breach laws to also cover paper records.
  • Hawaii Senate Bill 1038 (2026 session) would amend HRS ch. 487N by redefining 'specified data element' and 'personal information'.

Retention And DisposalRed

No general data-retention-limit or secure-disposal statute was identified for Hawaii.

Absence provenance: not recorded. Searched: not recorded.

Category narrative45 words

Hawaii's principal controller obligation is breach notification under HRS ch. 487N (notice to affected residents; narrow personal-information definition; paper-record coverage). No state-law DPIA, DPO, ROPA, joint-controller, general security-of-processing, or retention/disposal regime was identified. SB 1038 (2026 session) proposes amendments to the breach statute's data-element definitions.

Sources and claims (2)
  1. ConfirmedIAPP — Hawaii Revised Statutes Chapter 487N requires notification to Hawaii residents following a breach of security involving the statute's defined personal information, and is one of the few state breach laws to also cover paper records.observed
  2. ProbableDataGuidance — Hawaii Senate Bill 1038 (2026 session) would amend HRS ch. 487N by redefining 'specified data element' and 'personal information'.observed

#

No state-level transfer-mechanism, adequacy, SCC/BCR, TIA, or localisation regime exists or can exist absent federal/state legislative action; this module is a structural gap by design for a US state JID.

Traffic-light rationale — RedNo state-level transfer-mechanism, adequacy, SCC/BCR, TIA, or localisation regime exists or can exist absent federal/state legislative action; this module is a structural gap by design for a US state JID.

Sub-modules (6)

Transfer MechanismsRed

No Hawaii-specific transfer-mechanism regime exists; federal sectoral rules (HIPAA, GLBA) govern where applicable.

Claims (1):

  • Hawaii has no independent state-law cross-border data-transfer mechanism; applicable transfer constraints, where they exist, arise from federal sectoral instruments such as HIPAA and GLBA rather than state statute.

Adequacy ReceivedRed

Not applicable — sub-national US jurisdictions do not receive adequacy decisions.

Absence provenance: not recorded. Searched: not recorded.

Adequacy GrantedRed

Not applicable — Hawaii has no authority to grant adequacy decisions.

Absence provenance: not recorded. Searched: not recorded.

Sccs And BcrsRed

No Hawaii SCC/BCR framework exists.

Absence provenance: not recorded. Searched: not recorded.

Transfer Impact AssessmentRed

No TIA requirement exists in Hawaii law.

Absence provenance: not recorded. Searched: not recorded.

Data LocalisationRed

No Hawaii data-localisation mandate exists.

Absence provenance: not recorded. Searched: not recorded.

Category narrative48 words

As a US sub-national jurisdiction, Hawaii has no independent authority to grant or receive adequacy decisions, mandate SCCs/BCRs, require transfer-impact assessments, or impose data-localisation. Any cross-border-transfer treatment of Hawaii residents' data flows from federal sectoral instruments (e.g., HIPAA's disclosure-accounting rules, GLBA's information-sharing limits) rather than from state law.

Sources and claims (1)
  1. ProbableDataGuidance — Hawaii has no independent state-law cross-border data-transfer mechanism; applicable transfer constraints, where they exist, arise from federal sectoral instruments such as HIPAA and GLBA rather than state statute.observed

#

Meaningful coverage exists in health and insurance/financial sectors via federal-plus-state overlay; other sub-modules show no Hawaii-specific coverage.

Primary frameworkHIPAA (health) + GLBA (financial) + Hawaii Insurance Code + HRS §622-57
Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — AmberMeaningful coverage exists in health and insurance/financial sectors via federal-plus-state overlay; other sub-modules show no Hawaii-specific coverage.

Sub-modules (7)

Financial Sector OverlayAmber

Federal GLBA privacy/safeguards rules apply to financial institutions; the Hawaii Insurance Code imposes additional privacy-practice duties on licensed insurers, producers, and licensees.

Claims (1):

  • The Hawaii Insurance Code imposes privacy-practice requirements on licensed insurers, producers, or other licensees, supplementing federal GLBA obligations for financial institutions.

Health Sector OverlayAmber

Federal HIPAA applies nationally; HRS §622-57 (Title 33, ch. 622) separately protects medical-records confidentiality and privacy under Hawaii law.

Claims (1):

  • Hawaii Revised Statutes §622-57 (Title 33, Chapter 622) protects medical records and the right to privacy, operating alongside federal HIPAA.

Telecoms And EprivacyRed

No Hawaii-specific telecoms/ePrivacy overlay was identified beyond federal TCPA-type protections.

Absence provenance: not recorded. Searched: not recorded.

Employment DataRed

No Hawaii-specific employment-data-privacy overlay was identified.

Absence provenance: not recorded. Searched: not recorded.

Credit And ScoringRed

No Hawaii-specific credit/scoring overlay was identified beyond the federal FCRA baseline.

Absence provenance: not recorded. Searched: not recorded.

EducationRed

No Hawaii-specific student-data-privacy overlay was identified beyond the federal FERPA baseline.

Absence provenance: not recorded. Searched: not recorded.

InsuranceAmber

The Hawaii Insurance Code imposes privacy-practice requirements on licensed insurers, producers, and other licensees.

Claims (1):

  • The Hawaii Insurance Code imposes privacy-practice requirements on licensed insurers, producers, or other licensees, supplementing federal GLBA obligations for financial institutions.
Category narrative42 words

Hawaii's data-protection landscape is defined by sectoral overlays rather than a general regime: federal HIPAA and HRS §622-57 for health data; federal GLBA and the Hawaii Insurance Code for financial/insurance data; and no identified Hawaii-specific overlays for telecoms/ePrivacy, employment, credit-scoring, or education.

Sources and claims (2)
  1. ConfirmedDataGuidance — The Hawaii Insurance Code imposes privacy-practice requirements on licensed insurers, producers, or other licensees, supplementing federal GLBA obligations for financial institutions.observed
  2. ConfirmedDataGuidance — Hawaii Revised Statutes §622-57 (Title 33, Chapter 622) protects medical records and the right to privacy, operating alongside federal HIPAA.observed

#

No adtech/commercial-privacy obligation is currently in force; the only relevant instrument (SB 1163) remains pending.

Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — RedNo adtech/commercial-privacy obligation is currently in force; the only relevant instrument (SB 1163) remains pending.

Sub-modules (6)

Cookies And TrackersRed

No Hawaii cookie/tracker consent law exists in force.

Claims (1):

  • Hawaii Senate Bill 1163 would prohibit the sale of geolocation, microphone-derived, and internet browser information without explicit opt-in consent, but remains pending and is not yet law.

Dark PatternsRed

No dark-pattern prohibition identified in Hawaii law.

Absence provenance: not recorded. Searched: not recorded.

Opt Out SignalsRed

No statutory recognition of GPC or similar opt-out signals exists in Hawaii law.

Absence provenance: not recorded. Searched: not recorded.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room rules exist in Hawaii law.

Absence provenance: not recorded. Searched: not recorded.

Cross Context AdvertisingRed

No CPRA-style 'sale'/'share' definition exists in Hawaii law; SB 1037 (pending) would introduce controller/processor obligations relevant to this area.

Absence provenance: not recorded. Searched: not recorded.

Direct MarketingRed

No Hawaii-specific direct-marketing consent/suppression statute was identified.

Absence provenance: not recorded. Searched: not recorded.

Category narrative40 words

Hawaii has no in-force cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition, clean-room regime, cross-context-advertising ('sale'/'share') definition, or direct-marketing consent statute. Pending Senate Bill 1163 would require opt-in consent before selling geolocation, microphone-derived, or browser data, but has not been enacted.

Sources and claims (1)
  1. ProbableDataGuidance — Hawaii Senate Bill 1163 would prohibit the sale of geolocation, microphone-derived, and internet browser information without explicit opt-in consent, but remains pending and is not yet law.observed

#

Newly enacted chatbot/AI-disclosure and deepfake laws provide real, recent coverage, but broader profiling/ADM-transparency, biometric, and genetic regimes remain unconfirmed or absent.

Primary frameworkHawaii AI companion/chatbot disclosure law + Hawaii Artificial Intelligence Disclosure Act + Hawaii deepfakes law (2026)
Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — AmberNewly enacted chatbot/AI-disclosure and deepfake laws provide real, recent coverage, but broader profiling/ADM-transparency, biometric, and genetic regimes remain unconfirmed or absent.

Sub-modules (6)

Profiling RestrictionsRed

No general Art.22-style profiling restriction exists in Hawaii law; algorithmic-discrimination bills (SB 2524/HB 1607) remain pending.

Claims (1):

  • Hawaii Senate Bill 2524 and its companion House Bill 1607 address algorithmic discrimination, proposing audit and transparency requirements and prohibitions on bias in eligibility determinations, but have not been confirmed as enacted.

Automated Decision Making TransparencyRed

No general ADM-transparency statute is confirmed in force; SB 2524/HB 1607 would require audits and transparency from covered entities if enacted.

Claims (1):

  • Hawaii Senate Bill 2524 and its companion House Bill 1607 address algorithmic discrimination, proposing audit and transparency requirements and prohibitions on bias in eligibility determinations, but have not been confirmed as enacted.

Ai Risk AssessmentsAmber

Hawaii recently enacted an Artificial Intelligence Disclosure Act, signed by the Governor in the weeks preceding this run.

Claims (1):

  • The Hawaii Governor signed an Artificial Intelligence Disclosure Act in the weeks preceding this research run, alongside a related bill on AI-companion-chatbot disclosures and a bill on deepfakes.

Biometric RegimeRed

No Hawaii-specific biometric-data statute (facial recognition, fingerprint, gait) was identified.

Absence provenance: not recorded. Searched: not recorded.

Genetic DataRed

A 2022 Hawaii Senate bill on genetic-information privacy was reported as advancing through the legislature, but its final enactment status could not be confirmed from available sources.

Claims (1):

  • A 2022 Hawaii Senate bill addressing genetic-information privacy was sent forward in the legislative process, but confirmation of its final enactment could not be obtained.

State Surveillance CarveoutsRed

No Hawaii-specific state-surveillance carve-out provision was identified.

Absence provenance: not recorded. Searched: not recorded.

Category narrative79 words

Hawaii has recently signed several targeted AI-governance instruments — a chatbot/AI-companion disclosure law, an Artificial Intelligence Disclosure Act, and a deepfakes law — each within the past several weeks as of this run's dispatch date, joining a wave of similar state chatbot laws. Broader algorithmic-discrimination-audit bills (SB 2524/HB 1607) and an AI-policy working-group bill (HB 2176) have been proposed but their enactment status as comprehensive ADM/profiling law is unconfirmed. No Hawaii-specific biometric-data or genetic-data statute was confirmed in force.

Sources and claims (3)
  1. UncertainDataGuidance — Hawaii Senate Bill 2524 and its companion House Bill 1607 address algorithmic discrimination, proposing audit and transparency requirements and prohibitions on bias in eligibility determinations, but have not been confirmed as enacted.observed
  2. ProbableDataGuidance — The Hawaii Governor signed an Artificial Intelligence Disclosure Act in the weeks preceding this research run, alongside a related bill on AI-companion-chatbot disclosures and a bill on deepfakes.observed
  3. UncertainDataGuidance — A 2022 Hawaii Senate bill addressing genetic-information privacy was sent forward in the legislative process, but confirmation of its final enactment could not be obtained.observed

#

Federal COPPA plus a state minors/addictive-content law and a new AI-companion minor-protection law provide meaningful coverage, but education-settings and dependent-adults sub-modules show no Hawaii-specific coverage.

Primary frameworkFederal COPPA + Hawaii HB 566 (minors/addictive content) + Hawaii AI-companion disclosure law (2026)
Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — AmberFederal COPPA plus a state minors/addictive-content law and a new AI-companion minor-protection law provide meaningful coverage, but education-settings and dependent-adults sub-modules show no Hawaii-specific coverage.

Sub-modules (5)

Age VerificationAmber

No general Hawaii age-verification mandate was identified beyond what may be embedded in HB 566 or the AI-companion law.

Claims (1):

  • Hawaii House Bill 566 seeks to protect minors from addictive content and unauthorized data processing, reported with an effective date of July 1, 2025.

Minor Profiling BansAmber

No general minor-profiling ban exists at Hawaii state level beyond content/engagement restrictions potentially in HB 566 and the AI-companion law.

Claims (1):

  • Hawaii House Bill 566 seeks to protect minors from addictive content and unauthorized data processing, reported with an effective date of July 1, 2025.

Education SettingsRed

No Hawaii-specific education-settings data-privacy statute was identified beyond federal FERPA.

Absence provenance: not recorded. Searched: not recorded.

Dependent AdultsRed

No Hawaii-specific dependent-adults data-privacy statute was identified.

Absence provenance: not recorded. Searched: not recorded.

Category narrative73 words

Federal COPPA governs parental consent for children under 13 nationally, including Hawaii. Hawaii House Bill 566, reported effective July 1, 2025, targets minors' protection from addictive content and unauthorized data processing. Hawaii's newly signed AI-companion-chatbot disclosure law also includes minor-specific protections consistent with the broader 2026 wave of state chatbot laws (which typically add heightened disclosure, content restrictions, and bars on manipulative engagement for minors). No dependent-adults-specific or education-setting-specific state statute was identified.

Sources and claims (2)
  1. ProbableDataGuidance — Hawaii House Bill 566 seeks to protect minors from addictive content and unauthorized data processing, reported with an effective date of July 1, 2025.observed
  2. ConfirmedFTC — Federal COPPA requires operators to obtain verifiable parental consent before collecting personal information from children under 13, and applies to Hawaii-based and Hawaii-directed online services.observed

#

The AG has confirmed UDAP/breach enforcement authority and there is substantial recent (within-180-day) legislative activity, but enforcement-track-record, funding/capacity, and private-right-of-action data are unconfirmed.

Primary frameworkHRS chs. 480, 481A, 487N
Supervisory authorityHawaii Attorney General, Office of Consumer Protection
Traffic-light rationale — AmberThe AG has confirmed UDAP/breach enforcement authority and there is substantial recent (within-180-day) legislative activity, but enforcement-track-record, funding/capacity, and private-right-of-action data are unconfirmed.

Sub-modules (6)

Regulator Powers And PenaltiesAmber

The Hawaii AG enforces UDAP statutes (HRS chs. 480, 481A) and the breach law (HRS ch. 487N); specific penalty caps were not confirmed from available sources.

Claims (1):

  • The Hawaii Attorney General enforces consumer-protection and data-security matters under HRS chs. 480 and 481A (UDAP) and HRS ch. 487N (breach notification).

Enforcement Activity IndexRed

No major Hawaii-specific data-protection enforcement decision or fine was identified in the past 12 months from the sources reviewed.

Absence provenance: not recorded. Searched: not recorded.

Regulator Funding And CapacityRed

No specific funding/headcount data for the Hawaii AG's Office of Consumer Protection was identified.

Absence provenance: not recorded. Searched: not recorded.

Collective Redress And Class ActionsRed

Availability of collective redress/class actions specifically under HRS ch. 487N was not confirmed.

Absence provenance: not recorded. Searched: not recorded.

Private Right Of ActionRed

It is unconfirmed whether HRS ch. 487N grants a private right of action to affected individuals; industry commentary notes only that a subset of state breach statutes generally include one.

Claims (1):

  • A subset of US state breach-notification statutes allow a private right of action for noncompliance, but Hawaii's specific status under HRS ch. 487N was not confirmed in the sources reviewed.

Recent Developments 180DAmber

Within the past 180 days, Hawaii has signed an AI-companion-chatbot disclosure law, an Artificial Intelligence Disclosure Act, and a deepfakes law, and the 2026 legislature is actively considering SB 1163 (geolocation/browser data sale), SB 1038 (breach-law amendment), and HB 2463 (data-broker registration).

Claims (1):

  • In the 180 days preceding this run, Hawaii's governor signed bills on AI-companion-chatbot disclosures, an Artificial Intelligence Disclosure Act, and deepfakes, while the legislature advanced SB 1163, SB 1038, and HB 2463.
Category narrative79 words

The Hawaii Attorney General's Office of Consumer Protection enforces UDAP statutes (HRS chs. 480, 481A) and the breach-notification statute (HRS ch. 487N). The 2026 legislative session shows active data-protection/AI legislative activity within the last 180 days, including recently signed AI-companion-disclosure, AI Disclosure Act, and deepfakes laws, plus pending bills (SB 1163, SB 1038, HB 2463). No major Hawaii-specific privacy-enforcement decision or fine was identified in the sources reviewed, and private-right-of-action/collective-redress availability under HRS ch. 487N could not be confirmed.

Sources and claims (3)
  1. ProbableNAAG — The Hawaii Attorney General enforces consumer-protection and data-security matters under HRS chs. 480 and 481A (UDAP) and HRS ch. 487N (breach notification).observed
  2. UncertainIAPP — A subset of US state breach-notification statutes allow a private right of action for noncompliance, but Hawaii's specific status under HRS ch. 487N was not confirmed in the sources reviewed.observed
  3. ProbableDataGuidance — In the 180 days preceding this run, Hawaii's governor signed bills on AI-companion-chatbot disclosures, an Artificial Intelligence Disclosure Act, and deepfakes, while the legislature advanced SB 1163, SB 1038, and HB 2463.observed
No categories match.

Filters combine as OR inside a group and AND across groups.

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for United States – Hawaii
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewernot recorded
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-08-06. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 22 claim(s), 16 source(s) in the cumulative register.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer mechanisms
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redresscollective redress and class actions
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redressregulator powers and penalties
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redressregulator powers and penalties
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties

Self-audit

regulator_and_framework, controller_processor_duties.breach_notification, and sectoral_watch (health/insurance) rest on T2 (NAAG) plus T3 (DataGuidance/IAPP) secondary sources with reasonable corroboration; algorithmic_biometric_and_surveillance_governance and enforcement_and_redress.recent_developments_180d rely on T3 DataGuidance news-headline-level confirmation of very recent (weeks-old) signings without primary bill-text or governor's-office verification; data_subject_rights, cross_border_and_adequacy, and most of adtech_and_commercial_privacy carry no T1/T2 findings and are explicitly marked as structural/coverage gaps with absent_field_provenance; no direct fetch of primary Hawaii statutory text (capitol.hawaii.gov) or the Hawaii AG's own site was possible within the allowlisted hostnames, so all statutory citations are via secondary (NAAG/DataGuidance/IAPP) reporting.

Unresolved questions (6):

  • What are the exact bill numbers, full titles, and effective dates of the recently signed Hawaii AI-companion-disclosure law, Artificial Intelligence Disclosure Act, and deepfakes law?
  • Has Hawaii House Bill 566 (minors/addictive content) actually been signed into law, and is its reported July 1, 2025 effective date confirmed by primary legislative records?
  • What is the current-session (2026) status of Senate Bill 1037 (comprehensive consumer data protection) — has it advanced beyond committee?
  • Does HRS ch. 487N contain an AG-notification population threshold, and does it provide a private right of action to individuals?
  • What is the enacted/pending status of SB 2524 and HB 1607 (algorithmic-discrimination audits) as of the 2026 session?
  • Does Hawaii have a data-security-safeguards statute analogous to Massachusetts 201 CMR 17.00, distinct from breach notification?

Escalate to primary-source review: yes