On July 14, 2026, Hawaii Governor Josh Green signed two bills into law that establish some of the most aggressive state-level AI regulations in the United States. Act 247 (HB 2137) targets deepfakes with a private right of action allowing victims to claim up to $25,000 per unauthorized image. Act 248 (SB 3001) requires AI chatbot services to implement persistent non-sentience reminders for minors, mandatory suicide and self-harm crisis response protocols, and a ban on addictive UX patterns targeting young users. The laws take effect immediately, giving AI companies zero transition time to adjust their products.
Hawaii joins a growing list of states including Colorado, Illinois, and New York that passed AI-specific regulations in 2026. With federal AI legislation stalled in Congress, the state-level patchwork is accelerating faster than many industry watchers expected. For any company deploying AI chatbots or generative media tools accessible to Hawaii residents, the compliance clock started ticking the moment the governor's pen left the paper.
Act 247: The $25,000 Deepfake Deterrent
Act 247 creates a private right of action for individuals harmed by unauthorized deepfakes. Victims can sue for up to $25,000 per image if the deepfake causes reputational injury, financial harm, or is used for fraud, harassment, or other criminal acts. The law also bans deepfakes in advertisements without the subject's consent and requires clear and conspicuous disclosure on publicly distributed AI-generated imitations of real people.
The law applies broadly to voice, face, likeness, and performance. It covers AI image and video generators such as Runway, Sora, and Veo, AI voice cloning services like ElevenLabs and PlayHT, advertisers using AI-generated likenesses, and platforms that host user-generated deepfakes. Notably, Hawaii's own Department of the Attorney General flagged constitutional risk in its own analysis of the bill, and legal observers expect First Amendment challenges within six to twelve months, likely brought by advertising industry groups or free-speech organizations.
For founders building generative media products, the immediate takeaway is that deepfake consent is no longer just an ethical best practice in Hawaii. It is a legal requirement with a clear price tag attached to each violation. Companies that operate nationally will need to decide whether to geofence Hawaii users, implement consent verification workflows, or accept the litigation risk.
Act 248: Mandatory Safety Protocols for AI Chatbots
Act 248, the AI chatbot regulation, is arguably the more impactful of the two laws for AI companies. It imposes four major requirements on any chatbot service accessible to Hawaii users. First, providers must periodically remind users that the chatbot is not human and not sentient, and these reminders must be persistently visible if the system believes the user is a minor. Second, chatbots must implement comprehensive crisis response protocols for prompts related to suicidal ideation or self-harm, directing users to crisis intervention services like 988 and clarifying that the chatbot does not provide professional mental health care. Third, the law bans addictive UX patterns targeting minors including streak mechanics, aggressive push notifications, and engagement loops designed to maximize time on platform. Fourth, providers must submit annual reports to the Hawaii Department of Health's Behavioral Health Administration documenting their compliance.
The law explicitly cites concerns about what researchers have termed AI psychosis, where chatbots allegedly validated or encouraged delusional beliefs and, in some cases, suicidal ideation among minors and vulnerable adults. These concerns have been driven by well-publicized incidents involving Character.AI, Replika, and general-purpose chatbots being used as emotional support tools without adequate safety guardrails. State Senator Jarrett Keohokalole, who chairs the Senate Committee on Commerce and Consumer Protection, framed the urgency plainly at the bill signing: We anticipate that there will be some sort of federal action so that you have uniform laws that address AI across the country, but we did not want to wait when it came to kids, when it came to instances of self-harm and suicidal ideation.
Act 248 makes Hawaii arguably the most prescriptive US state on chatbot safety as of July 2026. The EU AI Act requires disclosure that users are talking to AI but does not specify persistent reminders for minors or mandate crisis response protocols at the same level of detail. California's SB 243 and New York's proposed chatbot safety bill are still in legislative process, putting Hawaii ahead of even the largest states on this specific issue.
What Founders Need to Do Right Now
If your AI product is accessible to Hawaii residents, these four actions should move to the top of your compliance queue. First, implement age-signal detection so that your system can determine when a user is believed to be a minor and trigger persistent non-sentience notices. Second, deploy keyword and semantic detection for suicide and self-harm related prompts, with hardcoded responses that include crisis line numbers like 988 and referral to professional help resources. Third, audit your user experience for dark patterns targeting minors, including streak mechanics, notification loops, and engagement incentives that could be classified as addictive. Fourth, prepare your annual reporting framework for the Hawaii Department of Health's Behavioral Health Administration, since the documentation requirement takes effect immediately even though the reporting cadence is annual.
For deepfake services within scope of Act 247, implement consent verification workflows and clear disclosure labeling on AI-generated content before July ends. The $25,000 per image penalty makes this a high priority item, especially for platforms that host user-generated content or provide API-based generation services.
Hawaii's approach signals where state-level AI regulation is heading. The specific requirements around chatbot safety protocols, deepfake liability, and protection of minors are likely to be replicated by other states in 2026 and 2027. Founders who treat Act 247 and Act 248 as a compliance checklist rather than a preview of broader trends risk playing catch-up as more states follow Hawaii's lead.
