I think the instance owner would be responsible, but what if the instance is out of the state?

Unless the instance owner is on a visa, with a criminal record they could get him. But otherwise it’s hard to be enforced.

Maybe they could ask the app stores to ban apps in that states. Something like that.