Law / Wyoming

Wyoming

age

Wyoming has required age verification for covered internet platforms hosting material harmful to minors since July 1, 2025, under HB 43 (Chapter 139, Session Laws of Wyoming 2025). A recurring bill to require parental consent for minors' social media accounts (most recently HB 19) has failed to receive the two thirds vote needed for introduction in multiple sessions, including 2024 and 2025. Wyoming has not enacted an app store accountability act or an age appropriate design code.

privacy

Wyoming has never had a comprehensive controller or processor personal-data bill reach a floor vote in either chamber, and none is pending. Wyoming's only enacted personal-data statute of general application is its breach-notification statute, Wyo. Stat. Ann. secs. 40-12-501 to 40-12-511, which reaches biometric, medical, and health-insurance data only by cross-reference to the criminal identity-theft statute's definition of personal identifying information, Wyo. Stat. Ann. sec. 6-3-901(b).

Biometric data reaches the notification duty only when used for authentication purposes, with no exclusion anywhere for an identifier derived from a photograph, video, or audio recording.

Wyoming is the one state in this batch where an indirect private right of action was never opened at all, rather than opened and then foreclosed: the breach statute contains no deeming clause characterizing a notice violation as a violation of Wyoming's general Consumer Protection Act, so that Act's own real private right of action, Wyo. Stat. Ann. sec. 40-12-108, which arms a person injured by an uncured unlawful deceptive trade practice, is simply never incorporated into the breach statute in the first place.

This is a different finding from the express or exclusivity-based foreclosures found elsewhere in this wave, and is recorded as such.

7 instruments named 3 researched in detail As of 2026-08-28

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Adult content age verification (AV)

HB 43 (2025), age verification for websites with material harmful to minors

cite Wyo. Stat. Ann. ยงยง 14-3-501 to 14-3-504 (2025 Wyo. Sess. Laws ch. 139) stage IN FORCE in force since 2025-07-01 source official enrolled act text (House Enrolled Act No. 70), Wyoming Legislature

Requires covered internet platforms that create, host, or make available material harmful to minors (obscene material or child pornography) to perform reasonable age verification of users, using a driver's license, identification card, passport, an age restricted credit or debit card, or another reliable method.

Exempts general internet service providers, search engines, and cloud service providers, and applies only to minors who are Wyoming residents or present in the state for at least 31 consecutive days.

Note and primary source

Breach notification

Breach of the security of a computerized data system, notification duty

cite Wyo. Stat. Ann. secs. 40-12-501 to 40-12-511 stage IMMINENT commencement not set source official Wyoming statute text, Wyo. Stat. Ann. secs. 40-12-501 to 40-12-511, Wyoming Legislature website (compressed statutes, Title 40)

An individual or commercial entity that conducts business in Wyoming and owns or licenses computerized data including personal identifying information about a Wyoming resident must, on becoming aware of a breach of the security of the system, conduct a reasonable and prompt investigation, and if misuse has occurred or is reasonably likely, give notice as soon as possible to each affected resident; timing is a risk-of-harm-triggered standard, not a fixed day count.

Personal identifying information means a name combined with one or more data elements defined by cross-reference to Wyoming's criminal identity-theft statute, Wyo. Stat. Ann. sec. 6-3-901(b), which includes unique biometric data generated from measurements or analysis of human body characteristics for authentication purposes, medical information, and health insurance information, alongside the standard Social Security, driver's license, and financial account elements; none of these carries an exclusion for data derived from a photograph, video, or audio recording.

Personal identifying information excludes information contained in government records or widely distributed media lawfully made available to the general public, regardless of its source. Substitute notice is available when the cost of direct notice would exceed $10,000 for a Wyoming-based entity or $250,000 for an out-of-state entity, or when the affected class exceeds 10,000 Wyoming-based persons or 500,000 out-of-state persons.

This document did not independently trace the original enacting session law's date, and the codified page prints no separate commencement subsection within this article, so no effective_date is recorded here.

What it asks of an app

Enforcement supervision

Breach of the security of a computerized data system, enforcement

cite Wyo. Stat. Ann. sec. 40-12-502(f) stage IMMINENT commencement not set source official Wyoming statute text, Wyo. Stat. Ann. sec. 40-12-502(f), Wyoming Legislature website (compressed statutes, Title 40)

The Attorney General may bring an action in law or equity to address a violation of Wyoming's breach-notification statute and to recover damages; the provision is not exclusive and does not relieve a covered person from any other applicable law.

Unlike Pennsylvania's, South Dakota's, or West Virginia's equivalents, this statute contains no deeming clause characterizing a notice violation as a violation of Wyoming's general Consumer Protection Act, Wyo. Stat. Ann. secs. 40-12-101 to 40-12-116, so the indirect private-action route this wave checks for is not opened at all here, rather than opened and then foreclosed.

The Consumer Protection Act does carry its own real private right of action, Wyo. Stat. Ann. sec. 40-12-108, arming a person relying on an uncured unlawful deceptive trade practice with an action for actual damages, but that right runs only to a violation under the Consumer Protection Act itself, and nothing in the breach statute invokes it.

This document records private_right_of_action as false for this instrument on that basis: absence of an incorporating clause, not an explicit foreclosure clause.

What it asks of an app

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.