Law / Hawaii

Hawaii

age

Hawaii has not enacted an age verification or age gating law in any of the four tracked families as of this date. A bill to require age verification on pornography websites (HB 1212) was carried over from 2025 into the 2026 session without passing either chamber, and a 2026 bill to restrict minors' social media access (SB 2761) was deferred indefinitely by the House Judiciary and Hawaiian Affairs Committee over First Amendment concerns. No app store or design code bill has advanced in the legislature.

privacy

Hawaii has no comprehensive consumer-privacy statute. Article I, Section 6 of the Hawaii Constitution recognizes an explicit right of privacy subject to a compelling state interest standard, the strictest tier of judicial scrutiny, but it binds government action rather than private conduct, so a private business is not directly bound by it.

The Security Breach of Personal Information Act, HRS ch. 487N, is Hawaii's operative private-sector privacy statute, a breach notification duty whose personal information definition covers only a name combined with a Social Security number, driver's license or state ID number, or a financial account number with an access code, excludes information lawfully made public through government records, and has no biometric, genetic, or health category.

A violation is a strong basis for private recovery: HRS Sec. 487N-3 makes a violating business liable to the injured party for actual damages plus attorneys' fees, on top of a state civil penalty, and Hawaii's general Uniform Deceptive Trade Practices Act separately gives any person likely to be damaged by a deceptive trade practice a right to an injunction without needing to prove monetary damage.

A comprehensive Hawaii Consumer Privacy Protection Act, HB 2463 (2026), has been introduced but has not advanced past introduction.

7 instruments named 3 researched in detail As of 2026-08-27

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Breach notification

Hawaii Security Breach of Personal Information Act, notice of security breach

cite Haw. Rev. Stat. Secs. 487N-1, 487N-2 stage IMMINENT commencement not set source official Hawaii Revised Statutes text, Hawaii State Legislature

A business that owns or licenses personal information of Hawaii residents, a business conducting business in Hawaii that owns or licenses such information, and a government agency that collects personal information for government purposes must each provide notice, without unreasonable delay, to a person affected by a security breach.

Notice must be clear and conspicuous, describe the incident and the type of personal information exposed, describe remedial steps taken, give a contact number, and advise the recipient to monitor credit reports; substitute notice is available above a $100,000 cost or 200,000-person threshold. Above a 1,000-person notice threshold, the business must also notify the State of Hawaii's Office of Consumer Protection and nationwide consumer reporting agencies.

Hawaii's personal information definition covers only a name combined with a Social Security number, driver's license or state ID number, or a financial account number with an access code or password, excludes information lawfully made public through federal, state, or local government records, and has no biometric, genetic, or health category, so a breach of biometric data alone triggers no notice duty.

What it asks of an app →

Enforcement supervision

Hawaii Security Breach of Personal Information Act, penalties and civil action

cite Haw. Rev. Stat. Sec. 487N-3 stage IMMINENT commencement not set source official Hawaii Revised Statutes text, Hawaii State Legislature

A business that violates any provision of the Security Breach of Personal Information Act is subject to a penalty of not more than $2,500 per violation, brought by the Attorney General or the executive director of the Office of Consumer Protection. Separately and additionally, a violating business is liable to the injured party for actual damages sustained as a result of the violation, and the court may award reasonable attorneys' fees to the prevailing party.

No action under either route may be brought against a government agency, so the private right of action and the state enforcement action both reach only private businesses despite the notice duty itself extending to government agencies.

What it asks of an app →

Hawaii Uniform Deceptive Trade Practices Act, private injunctive relief

cite Haw. Rev. Stat. Sec. 481A-4 stage IMMINENT commencement not set source official Hawaii Revised Statutes text, Hawaii State Legislature

A person likely to be damaged by a deceptive trade practice of another may bring an action for an injunction, without needing to prove monetary damage, loss of profits, or intent to deceive.

This is a second, independent private-action route into Hawaii's data-privacy landscape, broader than the Security Breach of Personal Information Act's own private right of action in the conduct it reaches (any deceptive trade practice, not only a chapter 487N breach) but narrower in remedy, since it reaches only injunctive relief rather than damages, and it carries discretionary fee-shifting against a groundless or knowingly deceptive claim.

What it asks of an app →

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.