Puerto Rico

Ley 105-2026 amends Puerto Rico's Political Campaign Oversight Act (Ley 222-2011) and Electoral Code (Ley 58-2020) to define "Inteligencia Artificial", including generative AI capable of producing text, image, audio, or video, and to require that any political advertisement or electoral communication created or modified, in whole or in part, using AI carry a clear, visible disclosure that it was produced or altered with AI; a radio or other audiovisual communication must also make the disclosure as a spoken statement.

It further makes it a misdemeanor, on a second or later occasion, for any person to maliciously submit AI-generated or AI-altered false data, documents, or images to an electronic system operated by the Comisión Estatal de Elecciones without a clear, legible notice. Approved on June 10, 2026 and effective immediately on approval, with no separate vacatio legis period.

Every entity, government or private, that owns or has custody of an information bank containing Puerto Rico residents' personal information must notify affected citizens of a security breach as expeditiously as possible, and must report the breach to the Department of Consumer Affairs within a non-extendable ten days, after which the Department publicly announces the breach within twenty-four hours.

A breach at a government agency or public corporation is instead routed to a specialized Ombudsman within the Office of the Procurador del Ciudadano. Direct written or authenticated electronic notice is required unless the cost would exceed $100,000 or the affected population 100,000 people, in which case substitute notice (prominent posting plus media notice) is permitted.

The Secretary of Consumer Affairs may impose a civil fine of $500 to $5,000 per violation; this does not affect a consumer's separate right to sue for damages. Article 11 states the Act takes effect one hundred and twenty days after its September 7, 2005 approval, other than Article 6, which took effect immediately; the source states this day-count rule rather than a calendar commencement date.

Under the Penal Code's section on crimes against the right to privacy, Article 172 makes it a felony, punishable by three years' imprisonment, to appropriate, use, modify, or alter without authorization another person's or family's reserved personal data held in a computerized or other file or registry; a convicted legal person is instead fined up to $10,000.

Article 173 applies the same penalty to disseminating, publishing, revealing, or transferring such data to a third party, or to distributing or accessing data known to have been obtained through such a violation. Article 174 extends Articles 171 through 173 to protect a legal person's (a company's) reserved data on the same terms.

Article 175 raises the penalty to eight years' imprisonment, and a convicted legal person's fine to $30,000, where the violation is committed for profit by the person responsible for the records, or by a public official or employee acting in the course of their duties.

Every social-media website or app that permits registration of a user eighteen or younger and resident in Puerto Rico must not publish or disclose that user's personal information (beyond name and city) without the parent's or guardian's consent, must not store, sell, share, or retain a known minor's personal information beyond what is reasonably necessary to the service, and must not profile a known minor absent a compelling, minor-protective purpose.

Precise geolocation of a known minor may not be stored, sold, or shared beyond what the service reasonably requires. The platform must give every minor user a simple privacy-settings process at registration and must honor an account-deletion or data-removal request within forty-five days. The law is designed not to conflict with the federal Children's Online Privacy Protection Act for users under thirteen.

The Negociado de Telecomunicaciones de Puerto Rico (NET) has exclusive enforcement authority and may impose a civil penalty of up to $25,000 per violation.

Ley 55-2012 recognizes an author's moral rights of attribution (paternity) and integrity in a literary or artistic work, non-transferable and, for the integrity right, waivable only by signed writing.

Article 10 exempts a legitimate use made for purposes of criticism, parody, commentary, news, education, or investigation from a moral-rights claim, to be judged under the totality of the circumstances including the purpose of the use, the nature of the work, and the size and substance of the portion used relative to the work as a whole.

Article 11 arms the author or successor with injunctive relief, actual damages, and, for a registered work whose violation targets a commercial or economic benefit, elective statutory damages of $750 to $20,000 per violation per registered work, at the court's discretion, plus costs and fees if the author prevails. The statute repealed the 1988 moral-rights act it replaced and took effect on approval.