Ohio — State Law (Social Media Parental Notification Act, Data Protection Act safe harbour, School AI Policy Mandate, OCSPA) + Federal AI Compliance Profile: AI Compliance Requirements

Ohio's Parental Notification by Social Media Operators Act (H.B. 33, 135th Gen. Assemb. (2023), codified at ORC § 1349.09) obliges an "operator" — any business running an online platform reaching Ohio users that permits social interaction, profile creation, connection lists and user-generated content — to do five things before a child under 16 may create an account: (1) obtain VERIFIABLE parental consent by one of the enumerated methods (signed form returned by mail, fax or scanned e-mail; a payment-card transaction; a toll-free verification call; videoconference identity verification; or a government-ID database check); (2) disclose the content-moderation features the platform offers; (3) provide a durable, accessible link at which a parent can review those moderation features later; (4) send the parent written confirmation of consent by e-mail, mail or fax, or by telephone where no such contact detail is available; and (5) DENY access where the parent refuses. THE LITIGATION POSTURE IS THE WHOLE ANSWER AND IS STATED PRECISELY: the Southern District of Ohio entered final judgment for NetChoice and permanently enjoined the Act on 2025-04-16 (No. 2:24-cv-00047, Marbley, J.); on 2026-06-18 the Sixth Circuit, in NetChoice, LLC v. Yost, No. 25-3371, held that "NetChoice has failed to establish that the Act is facially unconstitutional", REVERSED the district court's judgment and REMANDED "with instructions to enter judgment in favor of Yost" (Clay, J., lead opinion; Batchelder, J., concurring in the judgment; Ritz, J., dissenting; argued 2026-02-04); NetChoice petitioned for rehearing en banc on 2026-07-16 and the petition was declined; and on 2026-08-17 the Sixth Circuit STAYED ITS MANDATE, which leaves the district court's permanent injunction operative while NetChoice seeks Supreme Court review. NET EFFECT FOR A Ohio-facing operator as of 2026-08-25: the Act is NOT currently enforceable, but the controlling appellate holding is now AGAINST the platforms, so the consent, disclosure and confirmation workflow should be built and held ready rather than deferred — if certiorari is denied the mandate issues and the escalating per-day penalties begin running with no grace period written into the statute.

FTC Act § 5 applies to all Ohio businesses using AI. Ohio Consumer Sales Practices Act (OCSPA, ORC § 1345.02) independently prohibits unfair or deceptive acts in consumer transactions — Ohio courts have applied OCSPA to algorithmic deception. The Ohio AG (Andy Wilson since June 7, 2026; Dave Yost previously) has been active in AI consumer protection enforcement. Ensure AI chatbots disclose their nature, AI claims are truthful, and AI pricing does not exploit consumers.

Ohio's large manufacturing sector (Honda, GM, Ford, P&G) and logistics companies use AI for hiring, scheduling, and worker monitoring. EEOC May 2023 guidance requires employers to test AI employment tools for disparate impact. The Ohio Civil Rights Act independently prohibits AI that discriminates in employment, and — unlike Illinois, Maryland, New York City or Colorado — Ohio has enacted NO AI-specific hiring statute, NO automated-employment-decision audit duty, and NO biometric-privacy statute, so the ONLY Ohio-law route to an AI hiring claim is ordinary ORC Chapter 4112 discrimination doctrine. Since H.B. 352 of the 133rd GA (eff. 2021-04-15) an aggrieved employee must first file a charge with the Ohio Civil Rights Commission and has TWO YEARS from the alleged unlawful discriminatory practice to do so (ORC §§ 4112.051, 4112.052) — the practical retention horizon for AI screening logs, model versions, scoring outputs and disparate-impact test results.

Ohio's large financial services sector (Nationwide, Progressive, Huntington, KeyBank) uses extensive AI. AI credit decisions must comply with FCRA adverse action notice requirements. IMPORTANT NEGATIVE for insurers: Ohio is one of the states that has NOT adopted the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers and has issued no equivalent AI-specific insurance guidance — so an Ohio-domiciled insurer has NO state AI-governance-programme filing or documentation mandate, and the applicable duties are the generic ones (unfair trade practices, rate filing, market-conduct examination) plus federal law. Insurers operating in Ohio AND in adopting states (Pennsylvania, Illinois, Kentucky, Michigan, West Virginia and 20 other jurisdictions) will still be held to the NAIC bulletin by those regulators, so the practical answer is to run one AI governance programme to the NAIC standard rather than an Ohio-specific carve-out.

The Ohio Data Protection Act (eff. 2018-11-02) is voluntary but is the single most valuable Ohio-law instrument available to a business deploying AI over personal data, because it converts a written security programme into a pleadable defence. Under ORC § 1354.02(A) a covered entity — defined at § 1354.01(B) as "a business that accesses, maintains, communicates, or processes personal information or restricted information" — must create, maintain and comply with a WRITTEN cybersecurity programme containing administrative, technical and physical safeguards that reasonably conforms to a framework named in § 1354.03, covering either personal information alone (§ 1354.02(A)(1)) or personal information AND restricted information (§ 1354.02(A)(2)). Section 1354.02(B) requires the programme to be designed to (1) protect the security and confidentiality of the information, (2) protect against anticipated threats or hazards to its security or integrity, and (3) protect against unauthorised access and acquisition likely to result in a material risk of identity theft or other fraud. Section 1354.02(C) makes scale and scope adequate if calibrated to five factors: the entity's size and complexity, the nature and scope of its activities, the sensitivity of the information, the cost and availability of security tools, and the resources available to it. Section 1354.02(D) then grants the payoff — an affirmative defence to any tort cause of action brought under Ohio law or in Ohio courts alleging that a failure to implement reasonable information security controls resulted in a data breach; the § 1354.02(A)(2) route extends that defence to breaches of restricted information (defined at § 1354.01(E) as unencrypted, unredacted information other than personal information that alone or in combination can distinguish or trace an individual's identity). Qualifying frameworks under § 1354.03(A)(1) are the NIST "Framework for improving critical infrastructure cybersecurity", NIST SP 800-171, NIST SP 800-53 and 800-53a, the FedRAMP security assessment framework, the CIS Critical Security Controls, and the ISO/IEC 27000 family; § 1354.03(B)(1) lets a regulated entity instead conform to the HIPAA Security Rule (45 CFR Part 164 Subpart C), GLBA Title V, FISMA 2014, or HITECH (45 CFR Part 162); and § 1354.03(C) requires an entity subject to PCI DSS to comply with the current PCI DSS PLUS one framework from division (A). TWO TRAPS FOR AI DEPLOYERS. First, the § 1354.03 list is CLOSED and does NOT include the NIST AI Risk Management Framework, ISO/IEC 42001, or any AI-specific standard — running an AI governance programme, however good, earns no Ohio safe harbour on its own; the AI data pipeline must sit inside a conforming SECURITY programme. Second, the defence is an affirmative one, so it must be pleaded and proved, which means the written programme, its framework mapping, and evidence of actual compliance must exist BEFORE the breach and be producible afterwards.

Any person that owns or licenses computerised data including personal information about an Ohio resident must disclose a breach of the security of the system "in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach" (ORC § 1349.19). A processor or custodian that merely stores data on another entity's behalf must instead notify that entity. "Personal information" is an individual's name in combination with a Social Security number, a driver's licence or state ID number, or an account/credit-card number together with the security code — and only where the data is unencrypted, unredacted and otherwise readable. Substitute notice is available where notification cost exceeds $250,000 or more than 500,000 residents are affected (e-mail plus website posting plus major statewide media reaching 75% of the population); an entity with TEN OR FEWER employees may use substitute notice at a $10,000 cost threshold, via a quarter-page-minimum newspaper advertisement run three consecutive weeks, website posting and local media. WHY THIS IS AN AI REQUIREMENT AND NOT MERELY A SECURITY ONE: an AI deployment materially widens the breach surface — training corpora and embedding stores that replicate identifiers outside the system of record, prompt and completion logs that capture identifiers pasted by staff, vector databases that are rarely inside the encryption perimeter, and third-party model APIs that create a custodian relationship triggering the notify-the-controller duty. The 45-day clock runs from DISCOVERY, so an AI data map that cannot answer "which stores hold identifiers" within days effectively consumes the notification window.

Ohio has world-class healthcare AI deployers (Cleveland Clinic, OhioHealth, University Hospitals). AI systems processing Protected Health Information must comply with HIPAA Security and Privacy Rules. Cleveland Clinic's AI diagnostic programs are under FDA scrutiny — Ohio healthcare AI companies should implement equivalent governance standards including BAAs with AI vendors.

Enacted by Am. Sub. H.B. 96 of the 136th General Assembly (the FY2026-27 operating budget, effective 2025-09-30), ORC § 3301.24 makes Ohio the first state to convert AI guidance for schools from a recommendation into a STATUTORY DUTY. Every Ohio school district, community (charter) school and STEM school board had to ADOPT a policy governing the use of artificial intelligence by students and staff for educational purposes by 2026-07-01 — a date now past. The Ohio Department of Education and Workforce was separately required to publish a model AI policy by 2025-12-31 and released it in early January 2026. The statute mandates that a policy EXIST; it does not prescribe the policy's contents, does not require AI to be taught, and does not require AI tools to be used in classrooms, so a board may adopt the ODEW model verbatim and be compliant. COMMERCIAL RELEVANCE, which is why this sits in a business-compliance registry rather than only an education one: community schools and STEM schools are governed by independent, frequently privately-managed boards and operators, so this is a duty falling on non-governmental entities; and any vendor selling AI tutoring, proctoring, grading, attendance-analytics or chat products into Ohio K-12 will now be asked to map its product against an adopted local policy as a condition of procurement. A vendor with no answer to "how does your product fit our § 3301.24 policy" is at a live disadvantage in every Ohio K-12 deal.

Ohio has produced binding-adjacent AI expectations for one regulated profession ahead of any general AI statute. The Ohio Board of Professional Conduct issued Informal Advisory Opinion 2024-01 in June 2024, reading generative AI through the existing Ohio Rules of Professional Conduct and confirming that a lawyer using AI must maintain competence under Rule 1.1, which includes understanding the capabilities AND the limitations of the tools used. On 2026-06-02 the Supreme Court of Ohio, through the Board, issued the "Ohio Ethics Guide on Artificial Intelligence for Lawyers and Judicial Officers" — non-binding guidance grounded in the Ohio Rules of Professional Conduct and the Ohio Code of Judicial Conduct. It addresses generative-AI hallucinations (noting lawyers in other jurisdictions have been sanctioned or disciplined for fictitious citations in filings), the risk that disclosing client material to unsecured or public AI platforms breaches confidentiality or waives privilege, and the duty of candour where Ohio courts require disclosure of AI use in filings. This is not theoretical in Ohio: the Office of Disciplinary Counsel has filed a complaint with the Board against a Cleveland-area attorney over AI tools that generated false statements. Practical controls for an Ohio firm: an enterprise AI tool with contractual no-training and confidentiality terms, a mandatory citation-verification step before any filing, per-matter client disclosure where required, and a record of which tool touched which matter.

Two Ohio AI bills are live and BOTH sit in the House Technology and Innovation Committee; neither is law, and nothing in this entry treats either as law. (1) SB 163 (136th GA) — a three-part bill criminalising AI-generated child sexual abuse material, requiring AI systems to embed a distinctive watermark in AI-generated content, and extending identity-fraud law to the unauthorised use of a "replica of a person" (AI voice or likeness) with civil remedies; reporting indicates the Attorney General could seek a civil penalty of up to $10,000 where a violator removes an AI watermark. It passed the Senate unanimously on 2026-05-20 and was referred to House Technology and Innovation on 2026-05-27; no House committee hearing, House floor vote or gubernatorial signature has been reported in the three months since, and the absence of any hearing is itself the signal to watch. NOTE ON AN UNRESOLVED CONFLICT, carried forward deliberately: secondary sources disagree on the felony grading of the CSAM provision (second degree versus third degree). The Legislative Service Commission's as-passed-by-the-Senate text was not retrievable this session, so the grading is left UNSTATED rather than resolved by picking the more common secondary account — the bill is not law either way. (2) HB 469 (136th GA, Rep. Thaddeus Claggett) — would declare AI systems nonsentient, bar them from obtaining legal personhood, marrying, owning property or serving as an officer, director or manager of a legal entity, and would assign liability for AI-caused harm to the human owner, user, developer or manufacturer. Introduced 2025-09-23, referred to House Technology and Innovation 2025-10-01, still in committee. The prior versions of this requirement asserted that "Ohio is one of the most likely states to enact comprehensive AI regulation" and that the "Ohio AG has expressed clear intent to pursue AI enforcement actions" — both were unsourced forecasts and are removed; the contemporaneous reporting actually available points the other way, with the Ohio Capital Journal running the headline "Why Ohio doesn't have any artificial intelligence regulations" on 2026-05-18 and Ohio legislators quoted saying they are unsure what they would be able to enforce. Monitor legislature.ohio.gov and ohiohouse.gov; both refused TCP connections during parts of this session, so allow for fallback to Legislative Service Commission daily reports and LegiScan.