Idaho Privacy Law Up Close

Lesson 09 put Idaho in the 50-state table. This lesson reads the statutes themselves. Every section number below links to the Idaho Legislature's own page, and every bill outcome comes from the bill's history on legislature.idaho.gov, read in October 2026.

Does Idaho have a broad consumer privacy law?

No. Nineteen states had enacted broad consumer privacy laws on the California or Virginia model through 2025, by the IAPP's count, and four more passed in 2026 (Oklahoma, Alabama, Louisiana and Vermont), so as of October 2026, 23 states have enacted one and 19 are in effect (lesson 08 has the current list). Idaho is not among them. A scan of the legislature's bill lists for the 2023, 2024, 2025 and 2026 sessions, searching titles for privacy, personal data, consumer data and related words, turned up no bill to create general rights to access, delete or opt out of the sale of personal data.

That means an Idaho resident has no state-law right to ask a retailer what data it holds on them, or to delete it, or to stop its sale, unless the business chooses to honor such requests or another state's law reaches the business. Some national companies extend California-style rights to all U.S. users, so a request sometimes works anyway. It is not required by Idaho law.

What Idaho does have is a set of laws aimed at particular data or particular actors. They are listed in the table near the end of this lesson and walked through below.

The breach law, section by section

28-51-104: the definitions

Section 28-51-104 defines six terms for sections 104 through 107.

• Agency means any public agency as defined in the Public Records Act (74-101): state agencies, cities, counties, school districts and other local bodies.
• Breach of the security of the system means "the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information" of one or more people. Good-faith acquisition by an employee or agent for the organization's purposes is not a breach, so long as the information is not used or further disclosed without authorization.
• Commercial entity includes corporations, trusts, partnerships, LLCs, associations, organizations, joint ventures and any other legal entity, "whether for profit or not-for-profit." Nonprofits, churches, campaigns organized as committees and advocacy groups are covered.
• Notice means written notice to the most recent address, telephone notice, electronic notice consistent with the federal E-SIGN Act (15 U.S.C. 7001), or substitute notice if the cost would exceed $25,000, more than 50,000 Idaho residents are involved, or contact information is lacking. Substitute notice means all three of email where available, a conspicuous website posting, and notice to major statewide media.
• Personal information means an Idaho resident's first name or first initial and last name plus one or more of: a Social Security number; a driver's license or Idaho identification card number; or an account, credit or debit card number with any required security code, access code or password that would permit access to the financial account. It counts "when either the name or the data elements are not encrypted." Public information lawfully available from government records or widely distributed media is excluded.
• Primary regulator is the entity's federal regulator if it is federally licensed or chartered, the Idaho Department of Finance for its licensees, the Department of Insurance for its licensees, and the Attorney General for all agencies and everyone else.

Three things the definitions leave out stand out next to other states. No online credentials (username plus password). No medical, health insurance, biometric or passport data. And no paper: the definition reaches computerized data only.

28-51-105: the duty to investigate and notify

Section 28-51-105 applies to a city, county or state agency, an individual, or a commercial entity that conducts business in Idaho and owns or licenses computerized data including an Idaho resident's personal information. When it becomes aware of a breach, it must "conduct in good faith a reasonable and prompt investigation" to determine the likelihood that personal information has been or will be misused. If misuse "has occurred or is reasonably likely to occur," it must notify the affected Idaho resident "in the most expedient time possible and without unreasonable delay," consistent with law enforcement needs and with the work of finding the scope of the breach, identifying the people affected and restoring the system.

Then the agency rules. When an agency becomes aware of a breach, it must notify the office of the Idaho Attorney General "within twenty-four (24) hours of such discovery." A state agency must also report the breach to the office of the chief information officer within the Department of Administration under Idaho Technology Authority policies. And any government employee who intentionally discloses personal information not otherwise allowed by law commits a misdemeanor, punishable by a fine of up to $2,000, up to one year in county jail, or both.

Subsection (2) covers vendors: an entity that maintains data it does not own must notify and cooperate with the owner "immediately following discovery" if misuse occurred or is reasonably likely, including sharing information relevant to the breach. Subsection (3) allows a delay when a law enforcement agency says notice will impede a criminal investigation; notice must then go out in good faith as soon as possible after the agency says it no longer will.

Notice what the statute does not require of a business: notice to the Attorney General, notice to credit bureaus, any particular content in the letter, or free credit monitoring. The Attorney General's security breaches page says it directly: a commercial entity "may notify" the office "but is not required to do so." Many do anyway, often because another state's law requires a regulator filing and they send the same packet to every state.

28-51-106: when other procedures count

Section 28-51-106 deems two groups to be in compliance. An entity with its own notice procedures in an information security policy, consistent with 105's timing, complies if it notifies affected Idaho residents under its policy. And an individual or commercial entity regulated by state or federal law that follows the breach procedures of its primary or functional regulator complies if it follows those procedures when a breach occurs. A bank following federal banking guidance, or a HIPAA-covered clinic following the HIPAA rule, is treated as meeting Idaho's duty.

28-51-107: enforcement

Under 28-51-107, the primary regulator may bring a civil action to enforce compliance and enjoin further violations. Any agency, individual or commercial entity that "intentionally fails to give notice" is subject to a fine of not more than $25,000 per breach of the security of the system. There is no private right of action in the chapter and no per-person penalty. A thousand residents left uninformed by one breach is still one breach for the fine.

28-51-103: card receipts

The same chapter holds an older rule: a merchant may not print more than the last five digits of a card number, or the expiration date, on an electronically printed receipt. Penalties are up to $250 for a first violation and $1,000 for later ones, recovered by the prosecuting attorney, or by the cardholder if the prosecutor does not file within 60 days.

The 2025 attempt to rewrite the breach law

Senate Bill 1066, from the Senate Commerce and Human Resources Committee, would have rebuilt the chapter around "personally identifiable information." The amended version would have:

• added passport numbers and other government ID numbers, a username or email address with a password or security question that opens an online account, individual medical history, treatment, diagnosis or DNA profile, unique biometric data used for authentication, and individual taxpayer identification numbers to the list;
• revised the encryption wording and defined encryption to include tokenization and similar techniques that need a key or token to reverse;
• excluded from "breach" any acquisition of data from sources other than the organization's own systems or its service providers';
• required any agency, individual or business that found misuse occurred or was reasonably likely to offer at least 12 months of free credit monitoring and tell residents how to enroll and how to freeze their credit.

The fiscal note estimated monitoring at about $150 per victim at market rates if an agency had to pay. The Senate passed the amended bill 27 to 6 on March 10, 2025. The House Business Committee sent it out with a do-pass recommendation on March 17, it was moved to the general orders calendar on March 19, and it was retained there through April 4, when it died with the session. The chapter remains as it has stood since its last amendments in 2014 and 2015.

Credit freezes under Idaho law

Idaho's Credit Report Protection Act (28-52-101 and following, enacted 2008) gives residents the right to freeze their credit reports. A bureau must place a freeze within three business days of a request and send a confirmation and a PIN or password within five business days after that (28-52-103). The Idaho text still allows a fee of up to $6 for a second or later freeze in a 12-month period (28-52-106), but the FTC states that there is no cost to place or lift a freeze (lesson 04 covers the federal rule). A bureau that willfully violates the act is liable for actual damages or $100 to $1,000, punitive damages and fees; the Attorney General may seek civil penalties of $100 to $1,000 per consumer and up to $100,000 in the aggregate for related violations (28-52-109).

Identity theft crimes

Idaho Code 18-3126 makes it unlawful to obtain or record another person's personal identifying information without authorization, intending to use it to obtain credit, money, goods or services without consent. Under 18-3128, that is a felony punishable by a fine of up to $50,000, up to five years in prison, or both. Section 18-3125 separately makes it a felony to acquire, possess or use a financial transaction card or card number with intent to defraud. These are criminal laws enforced by prosecutors; report the crime to local police and keep the report number, which also helps with the bureaus and with IdentityTheft.gov.

Wiretaps and recordings

Idaho's Communications Security chapter (18-6701 and following) tracks the federal Wiretap Act. Section 18-6702 makes it a felony, punishable by up to five years in prison or a $5,000 fine or both, to willfully intercept a wire, electronic or oral communication, or to use or disclose the contents knowing they were illegally intercepted. Subsection (2)(d) makes interception lawful "when one (1) of the parties to the communication has given prior consent," so a participant in a call may record it. Interception "for the purpose of committing any criminal act" stays unlawful even with consent, under (2)(e). Section 18-6709 gives anyone whose communication was illegally intercepted, disclosed or used a civil claim for actual damages, but not less than $100 a day or $1,000, whichever is higher, plus punitive damages and attorney's fees. Lesson 06 covers the federal law and the all-party consent states.

Student data: 33-133

Idaho's student data law, Idaho Code 33-133, was added in 2014. It governs the state's longitudinal student data system and the schools and vendors that feed it.

• Inventory. The State Board of Education must publish a data inventory and dictionary of every individual student data field in the system, including fields proposed for collection and any held with no current purpose, and update it at least annually.
• What stays out. A student's educational record in the system may not include juvenile delinquency and criminal records (with a narrow exception), medical and health records, the student's Social Security number, biometric information, gun ownership records, sexual orientation, or religious affiliation. Except for special needs and exceptional students, it may not include data from statewide assessments gathered by affective computing (facial expressions, brain waves, heart rate, eye tracking and similar) or data measuring attitudes, dispositions or social skills.
• Access. Limited to authorized state board and department staff and vendors, districts and their vendors, postsecondary staff, students and parents, and other agencies as required by law. Public reports use aggregate data only. Release of personally identifiable student data needs board approval and then legislative approval.
• Vendors. Contracts must restrict use of data, set destruction dates, and either bar secondary uses such as sales, marketing or advertising, or disclose them in detail with express parental consent before deployment.
• Out of state. Confidential data may not leave Idaho except in listed cases such as a student transferring or a vendor contract.
• Security plan and audits. The board must keep a data security plan covering access, encryption, staff training, audits, breach planning and retention, and report audit results to the governor and legislature each year.
• New collections. Any new student data collection is provisional until the governor and legislature approve it; unapproved collections expire and must be deleted.
• Parents. Districts must give parents copies of all their child's educational records on request until the child turns 18.
• Penalties. A person found to have violated the section is liable for a civil penalty of up to $50,000 per violation. A district or charter school that fails to adopt, implement and post the board's model data policy, where an inappropriate release of data occurs, faces the same cap per violation. Unauthorized releases of identifiable student data must be reported to parents or students consistent with 28-51-105.

Lesson 05 covers FERPA, which sits underneath. A 2024 bill to revise the student data provisions, House Bill 411, was returned to the House Education Committee and went no further.

Genetic testing

Idaho's Genetic Testing Privacy Act (39-8301 and following, 2006) is an employment law. An employer with five or more employees, including state and local government, may not access or consider private genetic information in hiring, promotion or retention, may not require a genetic test or a release, and may not ask whether a worker or a blood relative took or refused a test (39-8303). Narrow exceptions allow a court order on a compelling-need finding, and forensic labs may test staff DNA to detect sample contamination. The Attorney General may sue for injunctions, damages and civil penalties of up to $25,000 per violation (39-8304).

A 2024 law (House Bill 670) added 39-8305, which bars medical and research facilities in Idaho from using genetic sequencers or analysis software produced by companies from listed foreign adversary countries. The chapter does not regulate consumer genetic testing companies or the sale of genetic data by them. Lesson 03 covers the federal Genetic Information Nondiscrimination Act and the state laws aimed at consumer genetic testing.

The Consumer Protection Act

When Idaho privacy disputes do not fit a specific statute, they usually run through the Idaho Consumer Protection Act, Title 48, Chapter 6 (1971). Section 48-603 lists unfair and deceptive acts in trade or commerce, such as representing that goods or services have characteristics or benefits they do not have. Under 48-606, the Attorney General may sue for declaratory judgments, injunctions, restitution, specific performance and civil penalties of up to $5,000 per violation, and must usually give notice and a chance to sign an assurance of voluntary compliance first. Section 48-607 lets a court add orders such as revoking a license or barring a business from operating in Idaho. Under 48-608, a person who buys or leases goods or services and suffers an ascertainable loss of money or property may sue for actual damages or $1,000, whichever is greater, with an enhanced recovery of $15,000 or treble damages for qualifying elderly or disabled victims.

The legislature has used the act as the enforcement hook for newer privacy rules. A violation of the 2025 mortgage trigger lead section (26-31-211A, from House Bill 149) is a violation of the act; it requires a lender soliciting a mortgage applicant from a credit bureau "trigger lead" to say it is not affiliated with the lender the consumer applied to and that it bought the consumer's information. A knowing or reckless violation of the 2026 social media act is treated as a violation of 48-603. The act also contains 48-603E on unfair bulk email advertising.

Children online: the 2024 age verification law and the 2026 social media act

Age verification. House Bill 498 (2024), signed March 20, 2024 and effective July 1, 2024, created Idaho Code 6-3801 and following. A commercial entity that knowingly and intentionally publishes material harmful to minors from a website with "a substantial portion" of such material is liable if it fails to perform reasonable age verification, or verifies age and then gives a minor access (6-3803). An entity or third party doing the verification "shall not retain any identifying information" afterward. Enforcement is by private suit only: a person exposed to the material, or a parent, may sue for injunctions, damages and statutory damages of at least $10,000, within four years (6-3804). In June 2025 the U.S. Supreme Court upheld a similar Texas law under intermediate scrutiny in Free Speech Coalition v. Paxton, 6 to 3 (lesson 05).

Social media. House Bill 542 (2026), the Stop Harms from Addictive Social Media Act, was signed April 2, 2026 and took effect July 1, 2026, as Title 48, Chapter 21. It reaches only a "covered social media platform," one that with its affiliates generated at least $1 billion in worldwide advertising revenue in one of the prior three years. A "child" is an Idaho resident 16 or younger.

• Within 14 days after an account holder first reaches 25 cumulative hours of use in six months, the platform must estimate age. It may treat the user as older than 16 only with 80 percent confidence, rising to 90 percent after a second trigger, with updates every 100 hours (48-2103). Accounts held continuously for seven years are exempt.
• Applicants must give a birth date. A platform may not open or keep a child's account without verifiable parental consent, and consent data must be deleted right after use (48-2104).
• Child accounts default to the most private settings and may not show "addictive interface features" (infinite scroll, profile-based feeds, engagement push notifications, autoplay, like counts, usage badges) or profile-based paid ads.
• Platforms must close a minor's account within seven days of the minor's request or 14 days of a parent's.
• A child or parent may sue for negligent, reckless or knowing violations; for reckless or knowing ones, the greater of actual damages or $10,000 in statutory damages, plus fees, within three years. A platform that used reasonable means and efforts is not liable (48-2105). Waivers are void (48-2106).

The act uses the federal COPPA definitions of personal information and parental notice and adds browsing history, biometrics and geolocation. Two earlier efforts failed: the 2023 Parental Rights Protection of Minors Act (Senate Bill 1163), on harmful material reached through devices, failed in the Senate 17 to 18, and the 2024 Parental Rights in Social Media Act (Senate Bill 1417) was never reported out of Senate State Affairs.

License plate readers: 49-1432

Idaho Code 49-1432 was added by Senate Bill 1180 (2025), which passed the Senate 25 to 10 and the House 45 to 24, was signed April 4, 2025 as chapter 316, and took effect July 1, 2025. It applies to the state and every political subdivision.

• An agency may use plate readers and their data for law enforcement, traffic flow analysis, or both.
• Law enforcement use is limited to investigating felonies, misdemeanors and traffic accidents and searching for missing or endangered persons. The devices may not be used to enforce traffic infractions other than those tied to an accident.
• Access is limited to authorized personnel under access controls. The data may not be used for any non-law enforcement purpose, "including but not limited to personal use, political activity, or surveillance" unrelated to the allowed purposes.
• Misuse brings discipline, administrative penalties and criminal prosecution where applicable.
• Agencies must train every authorized user on privacy, legal compliance and ethical use; log every query with user, date, time and purpose; and audit the logs every six months.

The section sets no retention limit and says nothing about sharing data with other agencies or with a vendor's national network. Course 31's lesson on plate readers: benefits, misuse and law covers those questions and the Fourth Amendment side.

Digital ID and other 2026 laws

Senate Bill 1299 (2026), signed March 31, 2026 and effective July 1, 2026, adds 67-2364. A state or local public entity, or a contractor acting for one, may not require anyone to obtain or use digital identification, may not deny or reduce any service or benefit for refusing it, and must keep accepting physical ID. It may not require a person to open or hand over a phone to verify identity, and showing a digital ID is not consent to search the device. Digital ID may be used only for immediate verification; a public entity may not track people, keep identity data past the transaction, or use digital ID as a shared credential across agencies. The Attorney General enforces after a 15-day cure notice, and any aggrieved person may sue for declaratory or injunctive relief and fees.

Also from 2026: Senate Bill 1297, the Conversational AI Safety Act, which requires operators of chatbots designed to simulate conversation to adopt safety protocols, show a persistent AI disclaimer to users it knows are minors, avoid "gamification" meant to drive excessive engagement, take measures to prevent sexually explicit content and offer parental supervision tools, according to its statement of purpose; it takes effect July 1, 2027. House Bill 727 revised the video voyeurism law and the penalty for disclosing explicit synthetic media under 18-6606, a crime created in 2024 by House Bill 575. And 2024's House Bill 664, the Freedom from AI-Rigged (FAIR) Elections Act at 67-6628A, provides for court relief against the publication of synthetic media in electioneering communications, with exceptions (see the course on literature, signs and ads).

Financial privacy and government security

The 2023 Second Amendment Financial Privacy Act (House Bill 295, at 18-3326 and 18-3326A, effective July 1, 2023) aims to stop payment card processing, including the merchant category code for firearms retailers announced by the card networks in 2022, from being used to track lawful firearm and ammunition purchases in Idaho. It prohibits certain records and registries, bars certain discriminatory acts by financial institutions, and authorizes the Attorney General to act. It is a privacy law aimed at a single kind of transaction data.

For state government's own systems, House Bill 35 (2025, effective July 1, 2025) amended 67-827A to require the Office of Information Technology Services to implement cybersecurity best practices and multifactor identification across executive agencies, and added a new section, numbered 67-2362 in the bill and now codified as 67-2363 after a 2026 renumbering (2026 session law chapter 251), to extend multifactor identification to the legislative and judicial branches and elected constitutional officers. House Bill 22 (2025) added data security compliance training for Division of Motor Vehicles systems at 49-202.

Public records and privacy

Idaho's Public Records Act protects much personal information held by government. Section 74-106 exempts most personnel records beyond pay, job history and similar items, along with employees' home addresses, phone numbers, Social Security and license numbers, and a long list of other personal records. In 2023, House Bill 47 added a definition of "unwarranted invasion of personal privacy" to 74-101: disclosure of information used to identify, locate or harass a juvenile, a victim of an alleged crime of mass violence or domestic violence, or a victim of physical or sexual abuse, or disclosure likely to violate legitimate and substantial privacy interests weighed against general public information. The name, age, sex and hometown of a deceased person after next-of-kin notice are not an invasion. Course 47, Idaho Public Records Requests, covers how to request records and how the exemptions are argued.

Idaho privacy statutes at a glance

Statute	What it covers	Who it binds	Main duties or rights	Enforcer	Penalty
28-51-104 to 107	Breach of name plus SSN, license or ID, or account number with code	Agencies, individuals, businesses and nonprofits doing business in Idaho	Investigate; notify residents without unreasonable delay; agencies tell the AG in 24 hours	Primary regulator (usually the AG)	Up to $25,000 per breach for intentional failure; $2,000 and jail for employees' intentional disclosure
28-51-103	Card receipts	Merchants	No more than last five digits; no expiration date	Prosecutor, then cardholder	$250, then $1,000
28-52 (Credit Report Protection Act)	Credit freezes	Credit bureaus	Freeze in three business days; PIN	AG and consumers	$100 to $1,000 per consumer; $100,000 aggregate cap in AG actions
18-3126, 18-3128	Misappropriating personal identifying information	Anyone	Crime	Prosecutors	Felony: up to $50,000, five years
18-6701 to 6709	Interception of calls and communications	Anyone	One-party consent	Prosecutors; victims sue	Felony: up to $5,000, five years; civil $100 a day or $1,000 minimum
33-133	Student data system	State Board, Department, districts, charters, vendors	Inventory, limits, vendor contracts, security plan, model policy	State Board with the AG	Up to $50,000 per violation
39-8301 to 8305	Genetic testing	Employers with five or more employees; medical and research facilities (sequencers)	No use of genetic information in employment	AG	Up to $25,000 per violation
48-601 and following	Unfair and deceptive practices	Anyone in trade or commerce	No deception; private suits for loss	AG Consumer Protection Division; consumers	Up to $5,000 per violation; $1,000 minimum private recovery
48-2101 to 2106 (2026)	Child social media accounts	Platforms with $1 billion or more in ad revenue	Age estimation, parental consent, no addictive features for children	Families; AG under 48-603	$10,000 statutory damages for reckless or knowing violations
6-3801 to 3809 (2024)	Adult websites	Commercial publishers of harmful material	Reasonable age verification; no retention of ID data	Private suits only	At least $10,000 statutory damages
49-1432 (2025)	License plate readers	State and local agencies	Purpose limits, access controls, training, logs, semiannual audits	Agencies; prosecutors for misuse	Discipline and prosecution where applicable
67-2364 (2026)	Government digital ID	Public entities and contractors	Digital ID optional; no demands to open a phone; no tracking or retention	AG; aggrieved persons	Injunctions and fees
74-101, 74-106	Personal information in public records	Public agencies	Exemptions from disclosure	Courts on records appeals	Records law remedies

The 2023 to 2026 bills and what happened

Year	Bill	Subject	Outcome
2023	H 47	Public records: defines unwarranted invasion of personal privacy	Law, chapter 256, effective July 1, 2023
2023	H 295	Second Amendment Financial Privacy Act	Law, chapter 303, effective July 1, 2023
2023	S 1163	Parental Rights Protection of Minors Act (harmful material on devices)	Failed in the Senate, 17 to 18
2024	H 498	Age verification for adult websites	Law, chapter 113, effective July 1, 2024
2024	H 575	Crime of disclosing explicit synthetic media (18-6606)	Law, chapter 105, effective July 1, 2024
2024	H 664	FAIR Elections Act, synthetic media in electioneering	Law, chapter 172, effective March 25, 2024
2024	H 670	End Organ Harvesting Act; bar on foreign adversary genetic sequencers	Law, chapter 318, effective July 1, 2024
2024	H 411	Student education data revisions	Returned to House Education Committee
2024	S 1417	Parental Rights in Social Media Act	Held in Senate State Affairs
2025	S 1066	Breach law rewrite and free credit monitoring	Passed Senate 27 to 6; retained on House general orders at session end
2025	S 1180	License plate readers (49-1432)	Law, chapter 316, effective July 1, 2025
2025	H 35	State cybersecurity best practices and multifactor identification	Law, chapter 6, effective July 1, 2025
2025	H 22	DMV data security compliance training	Law, chapter 23, effective July 1, 2025
2025	H 149	Mortgage trigger leads	Law, chapter 87, effective July 1, 2025
2025	H 117	Insurance Data Security Act	Returned to House Business Committee
2025	H 127	Disclosure of AI communications	Held in House Business
2025	S 1111	Truth in digital advertising sales	Passed Senate 19 to 16; held in House Business
2026	H 542	Stop Harms from Addictive Social Media Act	Law, chapter 268, effective July 1, 2026
2026	S 1299	Limits on digital identification (67-2364)	Law, chapter 250, effective July 1, 2026
2026	S 1297	Conversational AI Safety Act	Law, chapter 249, effective July 1, 2027
2026	H 727	Video voyeurism and synthetic media penalty	Law, chapter 121, effective July 1, 2026
2026	S 1448	Material harmful to minors definitions	Law, chapter 343, effective July 1, 2026
2026	H 744	Consent before capturing biometric identifiers for a commercial purpose; $25,000 penalty	Held in House Environment, Energy and Technology
2026	H 592	Hospital collection of patient immigration status data	Held in House Health and Welfare

House Bill 744 is worth a second look. Modeled closely on Texas's biometric law, it would have required notice and consent before capturing a retina or iris scan, fingerprint, voiceprint or face geometry for a commercial purpose, barred selling the data with narrow exceptions, required destruction within a year after the purpose ended, and let the Attorney General seek up to $25,000 per violation. It was printed and referred to committee on February 23, 2026, and its bill page shows no further action. Idaho has no biometric privacy law as of October 2026.

Questions and answers

Does Idaho's breach law apply to a nonprofit or a campaign?

Yes. "Commercial entity" includes associations, organizations and any other legal entity "whether for profit or not-for-profit." A campaign committee or advocacy group that holds donors' card numbers with security codes, or volunteers' Social Security numbers, is covered.

Does it apply to an out-of-state company?

It applies to one that "conducts business in Idaho" and owns or licenses Idaho residents' personal information. A national retailer selling to Idahoans is covered.

How fast must a business notify me?

Idaho sets no day count: "in the most expedient time possible and without unreasonable delay." If the business also had customers in Washington or Colorado, it likely worked to their 30-day limits, and Idaho residents often get the same letter at the same time.

My email password was stolen. Does Idaho require notice?

Not under Idaho's breach law as of October 2026, because online credentials are not on Idaho's list. Change the password everywhere you used it and turn on multifactor login.

Can I sue under Idaho's breach law?

The chapter gives no private right of action; the primary regulator enforces it. If a business's deception cost you money, the Consumer Protection Act's 48-608 private action may apply.

Is a school allowed to sell my child's data?

Under 33-133, vendor contracts must either bar secondary uses such as sales, marketing and advertising, or disclose them in detail and get express parental consent first. Ask the district for its contract and its posted model policy.

Do the police need a warrant to look at plate reader data?

Idaho's statute does not say. It limits purposes and requires logging and audits. The Fourth Amendment questions are in course 31.

Does the 2026 social media law apply to small apps?

No. It reaches only platforms that, with their affiliates, earned at least $1 billion in worldwide ad revenue in one of the prior three years.

Hard questions

Should Idaho pass a broad consumer privacy law?

Supporters point to the states that have, and argue Idahoans should have the same rights to see, delete and stop the sale of their data that residents of neighboring Oregon, Montana and Utah have. Opponents argue that the laws impose compliance costs, that national companies already honor requests voluntarily, and that a patchwork of state laws is a reason for Congress to act instead. Idaho's legislature has, so far, preferred targeted laws, as the bill table shows.

Should Idaho require free credit monitoring after a breach?

S1066's backers argued that the organization that lost the data should bear the cost of protection, not the victim. The fiscal note's $150 per victim estimate shows the other side: for a public agency, that comes from taxpayers, and a credit freeze, which is free, blocks more fraud than monitoring does. The bill passed the Senate and stalled in the House without a recorded floor vote there.

Private lawsuits or attorney general enforcement?

Idaho has used both. The breach law and digital ID law rely mainly on the Attorney General. The age verification law relies only on private suits, and the social media act on private suits plus the Attorney General. Supporters of private enforcement say an office with limited staff cannot police every platform. Opponents argue that private suits with $10,000 statutory damages invite litigation unrelated to real harm, and, for the age verification law, that private-only enforcement paired with the chapter's sovereign immunity language is built to make pre-enforcement court challenges harder.

Is age estimation itself a privacy risk?

The social media act requires platforms to estimate users' ages from data they already hold and says it creates no duty to collect more. Supporters say that limits the intrusion and protects children. Critics of age assurance laws in general argue that pushing platforms to infer age at 80 or 90 percent confidence encourages more profiling of everyone, and that disputes will push adults to upload ID. The act's dispute process allows "any commercially reasonable age verification process," so how often that happens will show in practice.

Should plate reader data have a retention limit?

Law enforcement agencies argue that older data solves cold cases and that logs and audits, which Idaho now requires, deter misuse. Privacy advocates argue that months or years of location history on drivers who did nothing wrong is the real risk, regardless of audits. The 2025 Idaho law chose purpose limits and auditing over a retention cap; course 31's plate reader lesson has more on the debate.