Does Hawaii have a comprehensive privacy law? No. SB 1037, a Consumer Data Protection Act bill introduced in 2025, did not pass before the Legislature adjourned its 2026 session sine die on May 8, 2026.
- Status: Did Not Pass
- Law: No comprehensive law. Main bill: SB 1037 (2025-2026), Consumer Data Protection Act; never amended past its introduced version; did not pass before the Legislature adjourned sine die on May 8, 2026
- Signed: Not applicable (no comprehensive law) · Effective: Not applicable (no comprehensive law)
- Applies to: Not applicable (no comprehensive law)
- Cure period: Not applicable (no comprehensive law)
- Enforcement: Not applicable (no comprehensive law)
- Last verified: November 4, 2026 · Official source: SB 1037 text (Hawaii State Legislature)
- Related: History of Hawaii’s consumer privacy bills
Hawaii does not have a comprehensive consumer privacy law in effect. SB 1037, introduced in the 2025 session, would have created a Consumer Data Protection Act for persons that do business in Hawaii or target Hawaii residents and that control or process the personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 25% of gross revenue from the sale of personal data. It would have given consumers rights over their personal data, placed duties on controllers and processors, and given the Department of the Attorney General exclusive enforcement authority with a 30-day notice-and-cure period. It did not pass before the 2026 session ended on May 8, 2026.
Earlier comprehensive privacy bills, going back to 2020, also did not become law. For the history of those bills and Hawaii’s other privacy protections, see our introduction to Hawaii’s consumer privacy bills.