HB1753 HD2

SECTION 1. This Act shall be known and may be cited as the Hawaii Social Media Data Deletion Act.

SECTION 2. The legislature finds that social media platforms collect, store, and process large amounts of users' personal information, including data that can persist indefinitely even after a user deletes an account. Users should have meaningful control over their digital identities and personal information, including clear rights to delete such information when they choose to discontinue using a platform. Effective deletion of personal data upon account termination promotes digital privacy, reduces the risk of unauthorized data retention and third-party sharing, and aligns with emerging state privacy standards.

The purpose of this Act is to require certain social media platforms to:

(1) Provide an accessible mechanism for users to delete their accounts;

(2) Permanently delete all personal information and sensitive personal information associated with deleted accounts; and

(3) Prohibit deceptive practices that obstruct deletion.

SECTION 3. The Hawaii Revised Statutes is amended by adding a new chapter to be appropriately designated and to read as follows:

"Chapter

social media protections

part i. General provisions

§ -1 Definitions. As used in this chapter:

"Covered platform" means a social media platform that:

(1) Has one million or more monthly active users nationwide; or

(2) Generates $25,000,000 or more in annual gross revenues.

"Delete" or "deletion" means, to the extent technically feasible, the removal of personal information and sensitive personal information from a covered platform's systems and databases resulting in the covered platform no longer retaining or using the personal information and sensitive personal information, except as otherwise permitted under applicable federal or state law.

"Education information" means information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act of 1974 (20 U.S.C. 1232g; 34 C.F.R. part 99).

"Neural data" means information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information.

"Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. "Personal information" includes but is not limited to the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:

(1) Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, electronic mail address, account name, social security number, driver's license number, passport number, or other similar identifiers;

(2) Any personal information described in section 487N-1;

(3) Characteristics of protected classifications under federal or state law;

(4) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;

(5) Biometric information;

(6) Internet or other electronic network activity information, including but not limited to browsing history, search history, and information regarding a consumer's interaction with an internet website application, or advertisement;

(7) Geolocation data;

(8) Audio, electronic, visual, thermal, olfactory, or similar information;

(9) Professional or employment-related information;

(10) Education information;

(11) Inferences drawn from any of the information identified in this definition to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes; and

(12) Sensitive personal information.

"Personal information" does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.

"Publicly available" means any of the following:

(1) Information that is lawfully made available from federal, state, or local government records;

(2) Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; and

(3) Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

"Publicly available" does not include biometric information collected by a business about a consumer without the consumer's knowledge.

"Sensitive personal information" means:

(1) Personal information that reveals:

(A) A consumer's social security, driver's license, state identification card, or passport number;

(B) A consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;

(D) A consumer's racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership;

(E) The contents of a consumer's mail, electronic mail, and text messages, unless the business is the intended recipient of the communication;

(F) A consumer's genetic data; or

(G) A consumer's neural data;

(2) The processing of biometric information for the purpose of uniquely identifying a consumer;

(3) Personal information collected and analyzed concerning a consumer's health; and

(4) Personal information collected and analyzed concerning a consumer's sex life or sexual orientation.

"Social media platform" means an electronic service or system that enables users to create profiles and interact with others, including posting content, messaging, or engaging in social networking online.

"User" means a natural person who is a resident of the State acting in an individual or household context.

PART II. COVERED PLATFORMS' OBLIGATIONS

§ -11 Account deletion; user rights. (a) A covered platform shall provide every user of the covered platform with a clear, conspicuous, and easily accessible method to request deletion of the user's account at any time.

(b) Upon confirmation of a user's request for account deletion, the covered platform shall:

(1) Archive and delete all personal information and sensitive personal information associated with the user's account and collected directly through the user's activity on the covered platform in accordance with section -12; and

(2) Notify the user that deletion of the user's account, personal information, and sensitive personal information has been completed.

(1) Obscure, delay, or make the request for deletion of a user's account, personal information, and sensitive personal information more difficult; or

(2) Require disclosure of additional personal information or sensitive personal information beyond what is necessary to verify the user's account deletion request.

§ -12 Account deletion; verification; timely deletion. (a) Except as provided in subsection (b), a covered platform shall:

(1) Archive and not make publicly accessible the user's personal information and sensitive personal information for a period of no less than forty-five days; and

(2) Delete the user's personal information and sensitive personal information no later than ninety days,

after receiving a user's confirmed request to delete the account, unless otherwise required by federal or state law.

(b) A law enforcement agency may direct a covered platform, pursuant to an approved criminal investigation with an active case number not to delete a user's personal information or sensitive personal information and. Upon receiving such direction, the covered platform shall retain the personal information or sensitive personal information solely to allow the law enforcement agency to obtain a court-issued subpoena, order, or warrant to obtain the user's personal information or sensitive personal information. A covered platform that has received direction from a law enforcement agency not to delete the user's personal information or sensitive personal information shall not use the user's personal information or sensitive personal information for any purpose other than retaining it to produce to the law enforcement agency in response to a court-issued subpoena, order, or warrant.

(c) A covered platform may implement reasonable procedures to verify that the individual initiating a request for account deletion is the account holder.

§ -13 Recordkeeping. A covered platform shall maintain deletion request records and any related compliance documentation for four years for enforcement and evidentiary purposes.

PART III. ADMINISTRATION AND ENFORCEMENT

§ -21 Enforcement. The attorney general may enforce this chapter through civil actions and seek injunctive relief and civil penalties for violations of this chapter. Civil penalties may include fines up to $ per violation per day.

§ -22 Rules. The department of the attorney general may adopt rules pursuant to chapter 91 necessary to implement and enforce this chapter."

SECTION 4. This Act does not affect rights and duties that matured, penalties that were incurred, and proceedings that were begun before its effective date.

SECTION 5. If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the invalidity does not affect other provisions or applications of the Act that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable.

SECTION 6. This Act shall take effect on July 1, 3000.

HOUSE OF REPRESENTATIVES	H.B. NO.	1753
THIRTY-THIRD LEGISLATURE, 2026		H.D. 2
STATE OF HAWAII