Idaho

HB 498 (2024), age verification for material harmful to minors

Requires a publisher of a website where more than one third of content is harmful to minors to perform reasonable age verification, via a digitized identification card or a commercial age verification system using government issued identification or transactional data, and prevent minors from accessing the material. Creates a private right of action with statutory damages of at least $10,000 per violation. Enacted as 2024 Idaho Session Laws chapter 113.

Identity Theft Act, breach of security disclosure duty

An agency, individual, or commercial entity that owns or licenses computerized data including personal information must give notice as soon as possible, and in the most expedient time possible without unreasonable delay, to each affected Idaho resident following a breach of system security. A government agency must additionally notify the Idaho Attorney General within 24 hours of discovery; this duty does not extend to a private commercial entity.

Any governmental employee who intentionally discloses personal information not subject to disclosure otherwise allowed by law is guilty of a misdemeanor, punishable by up to a $2,000 fine, up to one year in county jail, or both.

Personal information is a resident's name combined with a Social Security number, a driver's license or Idaho identification card number, or a financial account or card number with an access code, and does not include publicly available information lawfully made available to the general public from government records or widely distributed media; it carries no biometric, genetic, or health element, so a breach exposing only biometric data does not trigger this duty.

The statute, added in 2006 and amended in 2014, sets no fixed numeric notice deadline and no consumer reporting agency threshold.

Genetic Testing Privacy Act, enforcement

The Idaho Attorney General has exclusive enforcement authority over the Genetic Testing Privacy Act.

Whenever the Attorney General has reason to believe an employer is violating, has violated, or is about to violate the chapter, the Attorney General may bring an action in the state's name for a declaratory judgment, an injunction, recovery of actual damages or restitution on behalf of the state and its agencies, and a civil penalty of up to $25,000 per violation, deposited to the state general fund. These remedies are in addition to any other available remedy at law or equity.

The chapter creates no private right of action for a genetic-information violation, unlike SDATAA's express injured-party route for student data.

Identity Theft Act, breach notification enforcement and penalties

An affected entity's own primary regulator, not a private plaintiff, enforces the notice duty: the primary regulator may bring a civil action to compel compliance and enjoin further violations, and an agency, individual, or commercial entity that intentionally fails to give notice is subject to a fine of up to $25,000 per breach. The chapter creates no private right of action.

Student Data Accessibility, Transparency and Accountability Act (SDATAA)

SDATAA binds the State Board of Education, school districts, public charter schools, and their private vendors on the collection, use, and disclosure of K-12 student data.

A student's permanent educational record may not include, among other exclusions, the student's biometric information, Social Security number, or data collected through statewide-assessment affective computing such as facial-expression, EEG, or eye-tracking analysis (with a carve-out for special needs and exceptional students).

Unlike Idaho's general breach and genetic-privacy statutes, SDATAA arms an injured party directly: a person found, in a court action initiated by an injured party or in a civil enforcement action by the State Board or the Department of Education, to have violated the Act is liable for a civil penalty of up to $50,000 per violation; a district or charter school that fails to adopt, implement, and post its student-data policy faces a separate $50,000 civil penalty enforced by the State Board with Attorney General assistance.

Unless otherwise prohibited by law or court order, a school district must provide a parent or guardian with copies of all of their child's educational records upon request, so long as the child has not yet turned eighteen.

Genetic Testing Privacy Act, restrictions on employers

Idaho's Genetic Testing Privacy Act (Idaho Code Title 39, Chapter 83) is an employment-context genetic-privacy statute rather than a general-audience personal-data regime.

Section 39-8303 bars an "employer", defined at sec. 39-8302(4) to include any entity employing five or more persons and expressly including government, from accessing or considering an individual's private genetic information, requesting or requiring consent to release it, requesting or requiring a genetic test of an individual or blood relative, or inquiring whether either has taken or refused one, in connection with a hiring, promotion, retention, or other related employment decision.

Narrow exceptions allow a court-ordered compelled disclosure in limited circumstances and forensic or human-remains DNA analysis by an employer that conducts it. The Act creates no controller or processor duties and no consumer-facing right against a business generally.

HB 542 (2026), Stop Harms from Addictive Social Media Act

Requires large social media platforms, those with at least $1 billion in worldwide advertising revenue, to use reasonable age estimation for Idaho account holders and obtain verifiable parental consent before a child, defined as an Idaho resident 16 years of age or younger, may hold an account, and bars addictive interface features and certain advertising directed at children. A platform may treat an account holder as an adult only with at least 80 percent confidence the user is older than 16. Creates a private right of action. Signed April 2, 2026, as 2026 Idaho Session Laws chapter 268.