Law / United States / 
Idaho
HB 542 (2026), Stop Harms from Addictive Social Media Act
Idaho Code tit. 48, ch. 21 (2026 Idaho Sess. Laws ch. 268)
In force since .
A social media and minors rule binding private bodies.
- Age threshold
- 17
- How the hook was established
- express
- What makes it apply
- Data subject residence, User location
- Obligation class
- Age verification, Consent, Design code
- Verification methods
- Parental consent, Third party service, Self declaration
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Applies to you only if your social media platform has at least $1 billion in worldwide advertising revenue.
- Use reasonable age estimation for Idaho account holders, and treat an account holder as an adult only with at least 80 percent confidence that the user is older than 16.no control in the NIST Privacy Framework
- Obtain verifiable parental consent before a child (an Idaho resident 16 years of age or younger) may hold an account.NIST Privacy FrameworkCT.PO-P1
- Do not use addictive interface features, or certain advertising, directed at children.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Civil penalty available to the Idaho Attorney General under the Idaho Consumer Protection Act, Idaho Code sec. 48-606(1)(e), for a knowing or reckless violation, which sec. 48-2105(3)(a) of this Act deems a violation of Idaho Code sec. 48-603.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Statutory damages
Available only where the covered platform's violation was reckless or knowing: the child or parent recovers actual damages established at trial or $10,000 in statutory damages, whichever is greater. A negligent violation recovers declaratory or injunctive relief, damages (including harm to mental health and emotional distress), court costs and reasonable attorney fees, but no $10,000 statutory floor. Punitive damages are separately available where the violation is part of a consistent pattern of reckless or knowing conduct.
- As of
- Currency
- USD
- Per person reckless
- 10,000
Who enforces it
Enforcement body
Idaho Attorney General, who may exercise the investigative, legal, and other authority of the Idaho Consumer Protection Act (Idaho Code chapter 6, title 48) against a knowing or reckless violation; a child or parent also has a private right of action.
Settledness
- As of
- Open questions
- Does a feed that a platform ranks by overall popularity across all users, using no information about the account holder, fall outside "profile-based feed" in Idaho Code Section 48-2102(11)(a)?
- When a feed mixes content from accounts the account holder "follows" with content the platform selects using personal information, is the whole feed a "profile-based feed" despite Idaho Code Section 48-2102(11)(b)?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Log retention
The documentation of consent the platform must retain under section 48-2102(15) is a separate record and the statute states no period for it.
- As of
- Basis
- Fixed
- Prohibits retaining
- Information collected to obtain verifiable parental consent, which must be deleted immediately after an attempt to obtain the consent, except to the extent needed to comply with another state or federal law or regulation
Logging duty
Section 48-2104(1)(b) bars a covered platform from creating or maintaining a child's account without verifiable parental consent, and section 48-2102(15) defines that consent to require that the platform has retained documentation sufficient to reasonably establish it was obtained. The statute names no period for keeping that documentation, and it separately requires the platform to delete the information it collected to obtain consent immediately after the attempt. Section 48-2103(3) says nothing in the age-estimation section creates a duty to request, collect or retain information about an account holder, so the age estimate itself carries no record duty.
- Kind
- Explicit
- As of
- Provision
- Idaho Code sec. 48-2102(15), definition of verifiable parental consent, applied by sec. 48-2104(1)(b) and (4)
- Trigger
- consent_or_optout
What this law does
Requires large social media platforms, those with at least $1 billion in worldwide advertising revenue, to use reasonable age estimation for Idaho account holders and obtain verifiable parental consent before a child, defined as an Idaho resident 16 years of age or younger, may hold an account, and bars addictive interface features and certain advertising directed at children. A platform may treat an account holder as an adult only with at least 80 percent confidence the user is older than 16. Creates a private right of action. Signed , as 2026 Idaho Session Laws chapter 268.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .