AI agents · OpenClaw · self-hosting · automation

Quick Answer

What is Hawaii's AI Chatbot Law (Act 247 & 248, July 2026)?

Published:

What is Hawaii’s AI Chatbot Law (Act 247 & 248, July 2026)?

On July 14-15, 2026, Governor Josh Green signed two of the most aggressive state-level AI laws in the United States into law. Act 247 targets deepfakes with a $25,000-per-image private right of action. Act 248 mandates safety protocols for AI chatbots — including persistent non-sentience reminders for minors and required suicide-crisis response flows.

For any company deploying AI chatbots to Hawaii users (which is effectively every major AI provider), these laws change compliance requirements immediately.

Here is what they actually require, who they affect, and how they fit into the wider US and EU regulatory landscape.

Last verified: July 16, 2026

Act 247 (HB 2137) — Deepfake Regulation

Full title: A bill relating to unauthorized realistic digital imitations.

What it does:

  • Creates a private right of action — individuals can sue for up to $25,000 per image if a deepfake causes reputational injury, financial harm, or is used for fraud, harassment, or other criminal acts
  • Bans deepfakes in advertisements without subject’s consent
  • Mandates clear and conspicuous disclosure on publicly distributed realistic digital imitations generated or altered by AI (with limited exemptions)
  • Applies to voice, face, likeness, and performance

Who it affects:

  • Anyone publishing AI-generated imitations of real people in Hawaii
  • Advertisers using AI-generated likenesses (celebrities, athletes, everyday people)
  • Platforms that host user-generated deepfakes (subject to Section 230 preemption arguments)
  • AI voice cloning services (ElevenLabs, PlayHT, Descript)
  • AI image/video generators (Runway, Sora, Veo, Muse Video)

First Amendment risk: Hawaii’s own Department of the Attorney General flagged constitutional risk in its analysis. Expect Act 247 to be tested in court within 6-12 months, likely by advertising trade groups or free-speech NGOs.

Act 248 (SB 3001) — AI Chatbot Regulation

Full title: A bill relating to artificial intelligence chatbot services.

What it does:

  • Periodic non-sentience reminders — chatbot providers must periodically remind users the chatbot is not human/not sentient. Reminders must be persistently visible if the user is believed to be a minor.
  • Suicide / self-harm crisis protocols — chatbots must implement comprehensive response protocols for prompts related to suicidal ideation or self-harm, directing users to crisis intervention services and clarifying the chatbot does not provide professional mental health care
  • Bans addictive UX patterns targeting minors — dark patterns, streak mechanics, and engagement loops designed to hook minors
  • Bans misrepresentation of chatbots as human-like where that misrepresentation could cause psychological harm
  • Annual reports required to the Hawaii Department of Health’s Behavioral Health Administration

Who it affects (in effect, all major AI chatbot providers):

  • OpenAI (ChatGPT, ChatGPT Work)
  • Anthropic (Claude)
  • Google (Gemini)
  • Meta AI
  • xAI (Grok)
  • Character.AI, Replika, Nomi, and companion-chatbot startups
  • Any enterprise deploying user-facing chatbots via Bedrock, Vertex AI, Azure OpenAI Service, or first-party APIs

The Context: “AI Psychosis”

Act 248 explicitly cites cases where AI chatbots allegedly validated or encouraged delusional beliefs and, in some cases, suicidal ideation. This is a policy response to well-publicized incidents involving Character.AI, Replika, and general-purpose chatbots being used by minors and vulnerable adults for emotional support without safety guardrails.

Hawaii is not alone. Similar concerns are driving legislation in California (SB 243, Roberts), New York (proposed 2026 chatbot safety bill), and being weighed by federal FTC guidance. Act 248 is currently the most detailed and prescriptive.

How It Compares to Other AI Laws

Hawaii Act 247 + 248EU AI Act (Article 50)California SB 243Federal (US)
Deepfake disclosure requiredYes (Act 247, mandatory clear notice)Yes (Article 50 for AI-generated content)Yes (limited)None federal
Private right of action for deepfakesYes — up to $25K/imageNo (regulatory only)LimitedNo
Chatbot non-sentience disclosureYes, periodic + persistent for minorsYes (Article 50 — must disclose you’re talking to AI)Yes (limited to companion chatbots)No
Suicide crisis protocols requiredYes (Act 248 mandatory)Not specified in AI ActYes (limited)FTC guidance only
Ban on addictive UX for minorsYes (Act 248)Not in AI Act (in DSA + other)Under debateNone federal
Annual reporting requirementYes (Behavioral Health)Yes (GPAI Article 55)NoNone federal
In forceJuly 2026Partially (GPAI Aug 2025, full 2027)2025N/A

Hawaii’s Act 248 is arguably the most prescriptive US state chatbot law on the books in July 2026.

What Providers Must Do (Practically)

For AI chatbot deployment to Hawaii users, providers should:

  1. Implement age-signal detection — some heuristic for “believed to be a minor” so persistent notices can be triggered
  2. Add periodic non-sentience reminders — session-level and time-based prompts confirming the chatbot is not human
  3. Deploy crisis protocol — keyword and semantic detection for suicide/self-harm ideation with hardcoded response including crisis line numbers (988 in US) and referral to professional help
  4. Audit UX for dark patterns — remove streak mechanics, aggressive push notifications, and engagement loops targeting minors
  5. Prepare annual reports — Behavioral Health Administration format and cadence
  6. Update ToS and disclosures — clear language on non-sentience and limitations

For deepfake services in scope of Act 247:

  1. Watermarking and disclosure — every generated realistic likeness must carry AI-generation metadata and displayed notice
  2. Consent workflows — no publication of realistic imitations without documented consent
  3. Advertising rules — no realistic likenesses in ads without consent
  4. Insurance and legal reserves — the $25K/image private action is a meaningful financial exposure

The Wider Regulatory Trajectory

Hawaii’s laws are part of a rapidly-thickening AI regulatory landscape:

  • EU AI Act GPAI obligations are live for foundation-model providers
  • Colorado AI Act — algorithmic discrimination rules
  • Texas TRAIGA — state AI law under debate
  • Federal AISI — US AI Safety Institute conducting evaluations of frontier models
  • UK AISI — parallel UK effort
  • White House GOLD EAGLE (July 14, 2026) — cybersecurity clearinghouse for AI systems

For AI providers, US compliance is now a mosaic — federal guidance, plus a growing patchwork of state laws with Hawaii, California, Colorado, and Texas leading. Expect similar chatbot safety laws in 5-10 additional states by year-end 2026.

What It Means for Builders

If you build with LLM APIs:

  • Do not assume the model provider handles compliance for you. OpenAI, Anthropic, and Google publish safety guidance but liability under Act 248 attaches to the deploying service.
  • If your product touches minors, redesign now. Persistent notices, disabled dark patterns, and hardcoded crisis flows are non-negotiable.
  • Log everything for the annual report. Prompts flagged by crisis-response protocols, non-sentience-notice deliveries, age-signal decisions.
  • Watch Section 230 arguments. Platforms hosting user-generated deepfakes will argue federal preemption; the case law is unsettled.

The Frame

Hawaii is a small state passing large laws. Act 247 will get sued and may lose some ground. Act 248 will likely survive and will be copied by other states — the political consensus that AI chatbots need safety guardrails for minors is stable and growing.

For any provider serving US users, the compliance floor just moved up. The question is not whether to add non-sentience reminders and crisis protocols — it is how fast, and whether you build for the Hawaii-specific triggers or the more general emerging norm.

Sources