Idaho

A person is guilty of disclosing explicit synthetic media (any image or video created or altered using technical means, such as artificial intelligence, to realistically misrepresent an identifiable individual as engaging in conduct in which the individual did not engage) when the person knowingly discloses it either knowing or having reason to know the identifiable person did not consent and that disclosure would cause substantial emotional distress, or with intent to annoy, terrify, threaten, intimidate, harass, offend, humiliate, or degrade the identifiable person, or possesses and threatens to disclose it to obtain money or other valuable consideration.

A base violation is a misdemeanor; it becomes a felony, punishable by up to ten years' imprisonment, a fine of up to $25,000, or both, where the identifiable person is under eighteen or the person was previously found guilty of a violation of this section or a similar statute elsewhere within the past five years.

Exceptions to the lack-of-consent-and-emotional-distress theory of liability under subsection (1)(a) cover disclosure for a lawful criminal investigation or prosecution, reporting unlawful conduct, a matter of genuine public interest (a public figure's mere presence does not by itself qualify), legitimate scientific research or education, or disclosure made in the normal course of civil legal proceedings or under a nondissemination court order; none of them reaches the harassment-intent theory in subsection (1)(b) or the extortion theory in subsection (1)(c).

An interactive computer service, information service, or telecommunication service is not liable for content provided by another person unless it intentionally aids or abets the disclosure. Added in 2024 (chapter 105) and amended in 2026 (chapter 121); the codified section's own history note gives only the enacting and amending chapters and years, not a specific commencement day, so the commencement date is left unset rather than assumed.

An operator, a person who makes a conversational AI service (an artificial intelligence application, web interface, or program accessible to the general public that primarily simulates human conversation through text, visual, or aural communication, with exceptions for developer or research tools, features that are not themselves a conversational AI service, business-internal or business-to-business tools, voice assistants for consumer electronics, and enterprise-only platforms) available to the public, must clearly and conspicuously disclose that the service is artificial intelligence if a reasonable person could otherwise be misled into believing they are interacting with a human.

An operator must adopt a protocol for responding to user prompts about suicidal ideation, including referring users to crisis services, and may not cause the service to represent that it provides professional mental or behavioral health care.

For a minor account holder, an operator must give a persistent visible disclaimer, or disclose at the start of each session and at least every three hours, must not use unpredictable reward mechanics to increase engagement, must take reasonable measures against sexually explicit content and against statements suggesting the AI is sentient, human, romantically or sexually interested, or emotionally dependent, and must offer account and privacy management tools to minors and to the parents or guardians of those under thirteen.

A violation is subject to an injunction and a civil penalty of $1,000 per violation up to $500,000 per operator, or actual damages, whichever is greater, sought exclusively by the Attorney General; the Act creates no private right of action and does not make an AI model's developer liable for a third-party operator's violation. Enacted in 2026 as Senate Bill 1297 (Session Law Chapter 249), signed March 31, 2026, and effective July 1, 2027.

Title 48 Chapter 21 had already been claimed the same session by the Stop Harms from Addictive Social Media Act, so the live Idaho Statutes site carries this Act as Chapter 21 [22] and numbers its own sections 48-2201 to 48-2205, superseding the 48-2101 to 48-2105 numbering in the enacting bill's own text. A narrower 2025 predecessor limited to chatbot disclosure, House Bill 127, died in the House Business Committee.

A candidate whose action or speech is deceptively represented through synthetic media (an audio or video recording created using generative adversarial network techniques or other digital technology to depict a real event, action, or speech that did not occur, giving a fundamentally different impression than the unaltered original) in an electioneering communication may seek injunctive relief prohibiting publication and may sue the information content provider that created or developed the content for general and special damages, plus attorney's fees and costs.

It is an affirmative defense that the communication carries a stated disclosure that it has been manipulated, displayed for a video's full duration in an easily readable size, or spoken at the start, end, and every two minutes of audio over two minutes long; the plaintiff bears the burden of proving the use of synthetic media by clear and convincing evidence.

A distributing medium, rather than the information content provider, is liable only if it strips the required disclosure or itself alters the content into synthetic media. Enacted as House Bill 664 (2024 Regular Session), signed by the Governor and effective March 25, 2024 (Session Law Chapter 172). An earlier version of the same policy, House Bill 426, was returned to the House State Affairs Committee on February 5, 2024, and did not advance under its own number.

An agency, individual, or commercial entity that owns or licenses computerized data including personal information must give notice as soon as possible, and in the most expedient time possible without unreasonable delay, to each affected Idaho resident following a breach of system security. A government agency must additionally notify the Idaho Attorney General within 24 hours of discovery; this duty does not extend to a private commercial entity.

Any governmental employee who intentionally discloses personal information not subject to disclosure otherwise allowed by law is guilty of a misdemeanor, punishable by up to a $2,000 fine, up to one year in county jail, or both.

Personal information is a resident's name combined with a Social Security number, a driver's license or Idaho identification card number, or a financial account or card number with an access code, and does not include publicly available information lawfully made available to the general public from government records or widely distributed media; it carries no biometric, genetic, or health element, so a breach exposing only biometric data does not trigger this duty.

The statute, added in 2006 and amended in 2014, sets no fixed numeric notice deadline and no consumer reporting agency threshold.

The Idaho Attorney General has exclusive enforcement authority over the Genetic Testing Privacy Act.

Whenever the Attorney General has reason to believe an employer is violating, has violated, or is about to violate the chapter, the Attorney General may bring an action in the state's name for a declaratory judgment, an injunction, recovery of actual damages or restitution on behalf of the state and its agencies, and a civil penalty of up to $25,000 per violation, deposited to the state general fund. These remedies are in addition to any other available remedy at law or equity.

The chapter creates no private right of action for a genetic-information violation, unlike SDATAA's express injured-party route for student data.

An affected entity's own primary regulator, not a private plaintiff, enforces the notice duty: the primary regulator may bring a civil action to compel compliance and enjoin further violations, and an agency, individual, or commercial entity that intentionally fails to give notice is subject to a fine of up to $25,000 per breach. The chapter creates no private right of action.

SDATAA binds the State Board of Education, school districts, public charter schools, and their private vendors on the collection, use, and disclosure of K-12 student data.

A student's permanent educational record may not include, among other exclusions, the student's biometric information, Social Security number, or data collected through statewide-assessment affective computing such as facial-expression, EEG, or eye-tracking analysis (with a carve-out for special needs and exceptional students).

Unlike Idaho's general breach and genetic-privacy statutes, SDATAA arms an injured party directly: a person found, in a court action initiated by an injured party or in a civil enforcement action by the State Board or the Department of Education, to have violated the Act is liable for a civil penalty of up to $50,000 per violation; a district or charter school that fails to adopt, implement, and post its student-data policy faces a separate $50,000 civil penalty enforced by the State Board with Attorney General assistance.

Unless otherwise prohibited by law or court order, a school district must provide a parent or guardian with copies of all of their child's educational records upon request, so long as the child has not yet turned eighteen.

Idaho's Genetic Testing Privacy Act (Idaho Code Title 39, Chapter 83) is an employment-context genetic-privacy statute rather than a general-audience personal-data regime.

Section 39-8303 bars an "employer", defined at sec. 39-8302(4) to include any entity employing five or more persons and expressly including government, from accessing or considering an individual's private genetic information, requesting or requiring consent to release it, requesting or requiring a genetic test of an individual or blood relative, or inquiring whether either has taken or refused one, in connection with a hiring, promotion, retention, or other related employment decision.

Narrow exceptions allow a court-ordered compelled disclosure in limited circumstances and forensic or human-remains DNA analysis by an employer that conducts it. The Act creates no controller or processor duties and no consumer-facing right against a business generally.

Subsections (1) and (2) make it computer crime, a felony, to knowingly access, attempt to access, or use a computer, computer system, or network with intent to defraud, to obtain money, property, or services by false pretenses, or to commit theft, or to knowingly and without authorization alter, damage, or destroy a computer, system, network, or the software, program, documentation, or data it contains.

Subsection (3) separately makes it a misdemeanor for any person to knowingly and without authorization use, access, or attempt to access a computer, computer system, or network, or the software, program, documentation, or data contained in it, with no further intent element beyond knowledge and lack of authorization.

Neither this section nor its companion definitions section, Idaho Code section 18-2201, which defines only technical terms such as access, computer, and computer network, states what counts as authorization or exempts ordinary access to a publicly available page.

Idaho Code section 18-2202 was added by 1984 Idaho Session Laws chapter 68; the codified section's own history note carries only the enacting chapter and session-law page, not a specific commencement day, so the commencement date is left unset rather than assumed.

Requires a publisher of a website where more than one third of content is harmful to minors to perform reasonable age verification, via a digitized identification card or a commercial age verification system using government issued identification or transactional data, and prevent minors from accessing the material. Creates a private right of action with statutory damages of at least $10,000 per violation. Enacted as 2024 Idaho Session Laws chapter 113.