As Reported by the House Technology and Innovation Committee

136th General Assembly

Regular Session Sub. H. B. No. 84

2025-2026

Representatives Demetriou, Williams

Cosponsors: Representatives Bird, Brennan, Claggett, Click, Dean, Fowler Arthur, Gross, Hiner, Holmes, Hoops, John, Johnson, King, Klopfenstein, McClain, Miller, K., Newman, Peterson, Richardson, Robb Blasdel, Salvo, Schmidt, Sigrist, Stewart, Thomas, C., Willis, Workman, Young, Hall, T., Mathews, T., Miller, M.

To amend sections 1349.10 and 1349.101 and to enact section 109.1111 of the Revised Code to establish the Innocence Act Enforcement Fund, designate specified provisions of law as the Innocence Act, and clarify the Attorney General's enforcement authority.

BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF OHIO:

Section 1. That sections 1349.10 and 1349.101 be amended and section 109.1111 of the Revised Code be enacted to read as follows:

Sec. 109.1111. There is hereby created in the state treasury the innocence act enforcement fund that shall be used for the payment of expenses incurred by the office of the attorney general. Up to twenty-five per cent of all amounts collected by the attorney general from civil penalties as described in section 1349.101 of the Revised Code shall be paid into the state treasury to the credit of the innocence act enforcement fund.

Sec. 1349.10. (A)(1) "Cable service provider" has the same meaning as in section 1332.01 of the Revised Code.

(2) "Cloud service provider" means a third-party company offering a cloud-based platform, infrastructure, application, or storage services.

(3) "Direct-to-home satellite service" has the same meaning as in 47 U.S.C. 303, as amended.

(4) "Identifying information" means photo identification or public or private transactional data.

(5) "Interactive computer service" has the same meaning as in the "Telecommunications Act of 1996," 47 U.S.C. 230, as amended.

(6) "Internet provider" means a provider of internet service, including all of the following:

(a) Broadband service, however defined or classified by the federal communications commission;

(b) Information service or telecommunications service, both as defined in the "Telecommunications Act of 1996," 47 U.S.C. 153, as amended;

(c) Internet protocol-enabled services, as defined in section 4927.01 of the Revised Code.

(7) "Mobile service" and "telecommunications carrier" have the same meanings as in the "Telecommunications Act of 1996," 47 U.S.C. 153, as amended.

(8) "Organization" means both either of the following:

(a) A commercial establishment that, for any form of consideration, has as a significant or substantial portion of its stock-in-trade in, derives a significant or substantial portion of its revenues from, devotes a significant or substantial portion of its content or advertising to, or maintains a substantial section of its sales or online content display space for the sale, rental, or viewing of materials that are obscene or harmful to juveniles;

(b) A commercial establishment as defined in section 2907.38 of the Revised Code. An establishment may have other principal business purposes that do not involve selling, delivering, furnishing, disseminating, providing, exhibiting, or presenting any material or performance that is obscene or harmful to juveniles on the internet and still be categorized as an organization subject to this section. The existence of other principal business purposes does not exempt an establishment from being categorized as an organization subject to this section, so long as one of its principal business purposes involves selling, delivering, furnishing, disseminating, providing, exhibiting, or presenting any material or performance that is obscene or harmful to juveniles on the internet.

(9) "Photo identification" has the same meaning as in section 3501.01 of the Revised Code and includes any government-issued identification issued by another state, district, country, or sovereignty.

(10) "Reasonable age verification methods" means the following:

(a) Verifying that the person attempting to access the material or performance that is obscene or harmful to juveniles is eighteen years of age or older through the use of a commercial age verification system that uses photo identification, visual age verification software, or public or private transactional data to verify the person's age;

(b) Using any available third-party and or any available governmental databases that use a commercial age verification system that uses photo identification or public or private transactional data to verify the person's age.

(11) "Transactional data" means a sequence of information that documents an exchange, agreement, or transfer between a person, organization, or third party for the purpose of satisfying a request or event. "Transactional data" includes mortgage, educational, and employment records.

(12) "Video service provider" has the same meaning as in section 1332.21 of the Revised Code.

(13) "Harmful to juveniles" and "obscene" have the same meanings as in section 2907.01 of the Revised Code.

(14) "Significant or substantial" means at least thirty-three and one-third per cent.

(B) An organization that sells, delivers, furnishes, disseminates, provides, exhibits, or presents any material or performance that is obscene or harmful to juveniles on the internet shall do all of the following:

(1) Verify that any person attempting to access the material or performance that is obscene or harmful to juveniles is eighteen years of age or older through reasonable age verification methods;

(2) Verify that any person creating an account or subscription to access any material or performance that is obscene or harmful to juveniles is eighteen years of age or older through reasonable age verification methods. The organization shall reverify the age of the person every two years thereafter.

(3)(a) Utilize a geofence system maintained and monitored by a licensed location-based technology provider to dynamically monitor the geolocation of persons attempting to access or creating an account or subscription to access the material or performance that is obscene or harmful to juveniles;

(b) The location-based technology provider shall perform a geolocation check to dynamically monitor the person attempting to access or creating an account or subscription to access the material or performance that is obscene or harmful to juveniles and the person's location. The organization shall ensure that the location-based technology provider performs the geolocation check.

(c) If the location-based technology provider determines that a person is located in this state, as determined by the geolocation check under division (B)(3)(b) of this section, the organization that sells, delivers, furnishes, disseminates, provides, exhibits, or presents any material or performance that is obscene or harmful to juveniles on the internet shall block that person until the person's age has been verified using reasonable age verification methods.

(4) Implement a notification mechanism to alert persons attempting to access or creating an account or subscription to access the material or performance that is obscene or harmful to juveniles, of a geolocation check failure.

(C)(1)(a) Except as otherwise provided in division (C)(1)(b) of this section, an organization that sells, delivers, furnishes, disseminates, provides, exhibits, or presents any material or performance that is obscene or harmful to juveniles on the internet and verifies the age of the person creating an account or subscription to access the material or performance that is obscene or harmful to juveniles on the internet shall do the following:

(i) Immediately delete all information gathered for the purpose of age verification after the age verification is completed, except the information maintained for account and subscription access and for billing purposes;

(ii) Upon the request of the account holder or subscriber, immediately delete the data maintained for user access to the account or subscription and for billing purposes;

(iii) Develop and maintain a data privacy policy compliant with federal and state law and maintain data in a manner that is reasonably secure.

(b) On the expiration of two years after the creation of the account or subscription, the organization shall immediately delete all information relative to the creation of the user's account or subscription and any information maintained for billing purposes, unless the account holder or subscriber renews the account or subscription.

(2) An organization that sells, delivers, furnishes, disseminates, provides, exhibits, or presents any material or performance that is obscene or harmful to juveniles on the internet and verifies the age of the person attempting to access the material or performance that is obscene or harmful to juveniles on the internet shall do both of the following:

(a) Immediately delete all information gathered for the purpose of age verification after age verification is completed;

(b) Develop and maintain a data privacy policy compliant with federal and state law and maintain data in a manner that is reasonably secure.

(3) An organization described in division (C)(1) or (2) of this section shall immediately delete any identifying information, except the information required for the purpose of granting a person access to the account or subscription and for billing the account or subscription, that is used for age verification of the person attempting to access or creating an account or subscription to access any material or performance on the internet that is obscene or harmful to juveniles after age verification is completed. In response to any subpoena or notice of a violation received pursuant to section 1349.101 of the Revised Code, the organization shall submit an affidavit to the attorney general stating that the organization has complied with this requirement. The attorney general shall adopt rules under Chapter 119. of the Revised Code specifying the information that the organization shall include in the affidavit.

(4) An organization as described in division (C)(1) or (2) of this section shall not transfer any information collected, except for the purpose of age verification. Any and shall ensure that any party third-party who receives transferred information for age verification purposes shall not transfer any information collected to any other party except for the purpose of age verification and shall immediately delete all information gathered for the purpose of age verification after age verification is completed.

(D) This section does not apply to any of the following:

(1) A person who, while employed or contracted by a newspaper, magazine, press association, news agency, news wire service, radio or television station, or similar media, is gathering, processing, transmitting, compiling, editing, or disseminating information for the general public;

(2) A provider of an interactive computer service that is not an organization;

(3) A mobile service;

(4) An internet provider;

(5) A cable service provider;

(6) A direct-to-home satellite service;

(7) A video service provider;

(8) A cloud service provider.

Sec. 1349.101. (A)(A)(1) The attorney general may investigate reasonable allegations that an organization has violated section 1349.10 of the Revised Code and, upon finding a violation, provide written notice to the organization believed to have committed the violation, as described in division (B) of this section.

(2) The attorney general may administer oaths, subpoena witnesses, adduce evidence, and require the production of relevant matter for the purposes of an investigation under this section.

(3) An organization subpoenaed by the attorney general under this section may, within twenty days after the subpoena is served, file a motion in a court of common pleas of any county to extend the return day, or to modify or quash the subpoena. The organization shall include in the motion a statement describing good cause for the requested extension, modification, or quashing of the subpoena.

(4) If an organization fails, without lawful excuse, to obey a subpoena served, or to produce relevant matter requested under this section, the attorney general may apply to the court of common pleas of any county in this state for an order compelling compliance.

(5) Neither of the following are public records under section 149.43 of the Revised Code when obtained by the attorney general as part of an investigation under this section:

(a) Any subpoena issued and any records obtained pursuant to a subpoena issued by the attorney general under division (A)(2) of this section;

(b) An affidavit as described in division (C)(3) of section 1349.10 of the Revised Code.

(6) The attorney general has the exclusive authority to enforce section 1349.10 of the Revised Code. The remedies set forth in this section are the exclusive remedies for any violation of that section.

(B)(1) The attorney general may bring a civil enforcement action against an organization that sells, delivers, furnishes, disseminates, provides, exhibits, or presents any material or performance that is obscene or harmful to juveniles on the internet that fails to comply with the requirements under divisions division (B)(1) or , (2), (3)(a), (b), or (c), or (4) or (C)(1) or , (2), (3), or (4) of section 1349.10 of the Revised Code and as a result of that failure a minor gains access to the material or performance.

(2) Before initiating such an enforcement action, the attorney general shall provide written notice to the organization identifying and explaining the basis for each instance of alleged violation.

(B)(C) Except as otherwise provided in division (D) of this section and until the date that is two years after the effective date of this amendment, the attorney general shall not commence an enforcement action if the organization, within forty-five days after notice of the alleged violation is sent, does both of the following:

(1) Cures all violations described in the notice:;

(2) Provides the attorney general with a written statement indicating that the violations are cured and agreeing to refrain from further noncompliance of the requirements under divisions division (B)(1) or , (2), (3)(a), (b), or (c), or (4) or (C)(1) or , (2), (3), or (4) of section 1349.10 of the Revised Code.

(C)(D)(1) If the organization does not any of the following, the attorney general may immediately and without additional notice, file the enforcement action in the court of common pleas of the county in which the alleged violation occurred, if known, or in the Franklin county court of common pleas if the location of the violation is unknown, against that organization to seek injunctive relief and the imposition of a civil penalty pursuant to division (D)(3) of this section:

(a) Fails to timely respond or continues to fail to comply with the requirements under divisions division (B)(1) or , (2), (3)(a), (b), or (c), or (4) or (C)(1) or , (2), or (3), or (4) of section 1349.10 of the Revised Code after receiving the notice, the attorney general may initiate the enforcement action and seek injunctive relief.

(b) Fails to cure all violations within the forty-five-day period described in division (C) of this section.

(c) Commits one or more subsequent violations of division (B)(1), (2), (3)(a), (b), or (c), or (4) or (C)(1), (2), (3), or (4) of section 1349.10 of the Revised Code after reporting that the initial violation was cured.

(2) Two years after the effective date of this amendment, the attorney general may immediately and without notice initiate an enforcement action against an organization that commits a violation of this section.

(3) If an organization violates section 1349.10 of the Revised Code, the attorney general may request, and the court may impose, a civil penalty of up to one hundred thousand dollars for each day of violation. Seventy-five per cent of the penalty shall go to the consumer protection enforcement fund as described in section 1345.51 of the Revised Code and twenty-five per cent of the penalty shall go to the innocence act enforcement fund as described in section 109.1111 of the Revised Code.

(D) Division (B) of this section does not apply if the organization fails to timely comply with all of the requirements described in the notice or commits subsequent violations of the same type after curing the initial violation under that division. Notwithstanding division (C) of this section, if an organization commits a subsequent violation of the same type after reporting that the initial violation is cured, the attorney general may bring a civil action at any time after sending notice of the violation under division (A) of this section.

(E) Nothing in this section shall be construed to provide a private right of action. The attorney general has the exclusive authority to enforce this section.

Section 2. That existing sections 1349.10 and 1349.101 of the Revised Code are hereby repealed.

Section 3. Sections 1349.10 and 1349.101 of the Revised Code shall be known as the Innocence Act.

Section 4. The provisions of law contained in this act, and their applications, are severable. If any provision of law contained in this act, or if any application of any provision of law contained in this act, is held invalid, the invalidity does not affect other provisions of law contained in this act and their applications that can be given effect without the invalid provision or application.