Idaho

A person is guilty of disclosing explicit synthetic media (any image or video created or altered using technical means, such as artificial intelligence, to realistically misrepresent an identifiable individual as engaging in conduct in which the individual did not engage) when the person knowingly discloses it either knowing or having reason to know the identifiable person did not consent and that disclosure would cause substantial emotional distress, or with intent to annoy, terrify, threaten, intimidate, harass, offend, humiliate, or degrade the identifiable person, or possesses and threatens to disclose it to obtain money or other valuable consideration.

A base violation is a misdemeanor; it becomes a felony, punishable by up to ten years' imprisonment, a fine of up to $25,000, or both, where the identifiable person is under eighteen or the person was previously found guilty of a violation of this section or a similar statute elsewhere within the past five years.

Exceptions to the lack-of-consent-and-emotional-distress theory of liability under subsection (1)(a) cover disclosure for a lawful criminal investigation or prosecution, reporting unlawful conduct, a matter of genuine public interest (a public figure's mere presence does not by itself qualify), legitimate scientific research or education, or disclosure made in the normal course of civil legal proceedings or under a nondissemination court order; none of them reaches the harassment-intent theory in subsection (1)(b) or the extortion theory in subsection (1)(c).

An interactive computer service, information service, or telecommunication service is not liable for content provided by another person unless it intentionally aids or abets the disclosure. The section was added by 2024 Idaho Session Laws chapter 105 (House Bill 575) and later amended by 2026 Idaho Session Laws chapter 121 (House Bill 727), which revised only the penalty provision; the Idaho Legislature's own bill status record for House Bill 575 states an effective date of July 1, 2024.

An operator, a person who makes a conversational AI service (an artificial intelligence application, web interface, or program accessible to the general public that primarily simulates human conversation through text, visual, or aural communication, with exceptions for developer or research tools, features that are not themselves a conversational AI service, business-internal or business-to-business tools, voice assistants for consumer electronics, and enterprise-only platforms) available to the public, must clearly and conspicuously disclose that the service is artificial intelligence if a reasonable person could otherwise be misled into believing they are interacting with a human.

An operator must adopt a protocol for responding to user prompts about suicidal ideation, including referring users to crisis services, and may not cause the service to represent that it provides professional mental or behavioral health care.

For a minor account holder, an operator must give a persistent visible disclaimer, or disclose at the start of each session and at least every three hours, must not use unpredictable reward mechanics to increase engagement, must take reasonable measures against sexually explicit content and against statements suggesting the AI is sentient, human, romantically or sexually interested, or emotionally dependent, and must offer account and privacy management tools to minors and to the parents or guardians of those under thirteen.

A violation is subject to an injunction and a civil penalty of $1,000 per violation up to $500,000 per operator, or actual damages, whichever is greater, sought exclusively by the Attorney General; the Act creates no private right of action and does not make an AI model's developer liable for a third-party operator's violation. Enacted in 2026 as Senate Bill 1297 (Session Law Chapter 249), signed March 31, 2026, and effective July 1, 2027.

Title 48 Chapter 21 had already been claimed the same session by the Stop Harms from Addictive Social Media Act, so the live Idaho Statutes site carries this Act as Chapter 21 [22] and numbers its own sections 48-2201 to 48-2205, superseding the 48-2101 to 48-2105 numbering in the enacting bill's own text. A narrower 2025 predecessor limited to chatbot disclosure, House Bill 127, died in the House Business Committee.

A candidate whose action or speech is deceptively represented through synthetic media (an audio or video recording created using generative adversarial network techniques or other digital technology to depict a real event, action, or speech that did not occur, giving a fundamentally different impression than the unaltered original) in an electioneering communication may seek injunctive relief prohibiting publication and may sue the information content provider that created or developed the content for general and special damages, plus attorney's fees and costs.

It is an affirmative defense that the communication carries a stated disclosure that it has been manipulated, displayed for a video's full duration in an easily readable size, or spoken at the start, end, and every two minutes of audio over two minutes long; the plaintiff bears the burden of proving the use of synthetic media by clear and convincing evidence.

A distributing medium, rather than the information content provider, is liable only if it strips the required disclosure or itself alters the content into synthetic media. Enacted as House Bill 664 (2024 Regular Session), signed by the Governor and effective March 25, 2024 (Session Law Chapter 172). An earlier version of the same policy, House Bill 426, was returned to the House State Affairs Committee on February 5, 2024, and did not advance under its own number.

Idaho Code section 33-7007, part of the Generative Artificial Intelligence in Education Act (Idaho Code sections 33-7001 to 33-7008, enacted in 2026 as Senate Bill 1227, Session Law Chapter 71), requires that generative AI-related software, applications, and tools procured by local school districts and public charter schools comply with state and federal data privacy laws, including the Family Educational Rights and Privacy Act, the Children's Internet Protection Act, and the Children's Online Privacy Protection Act.

A vendor of such a product must disclose whether it utilizes machine learning, predictive analytics, or generative AI, and must provide assurances regarding data protection, algorithmic transparency, and responsible use. Senate Bill 1227 was signed by the Governor on March 19, 2026, as Session Law Chapter 71, and took effect July 1, 2026.

An agency, individual, or commercial entity that owns or licenses computerized data including personal information must give notice as soon as possible, and in the most expedient time possible without unreasonable delay, to each affected Idaho resident following a breach of system security. A government agency must additionally notify the Idaho Attorney General within 24 hours of discovery; this duty does not extend to a private commercial entity.

Any governmental employee who intentionally discloses personal information not subject to disclosure otherwise allowed by law is guilty of a misdemeanor, punishable by up to a $2,000 fine, up to one year in county jail, or both.

Personal information is a resident's name combined with a Social Security number, a driver's license or Idaho identification card number, or a financial account or card number with an access code, and does not include publicly available information lawfully made available to the general public from government records or widely distributed media; it carries no biometric, genetic, or health element, so a breach exposing only biometric data does not trigger this duty.

The statute, added in 2006 and amended in 2014, sets no fixed numeric notice deadline and no consumer reporting agency threshold. The provisions this entry describes came into force on different days.

The Idaho Attorney General has exclusive enforcement authority over the Genetic Testing Privacy Act.

Whenever the Attorney General has reason to believe an employer is violating, has violated, or is about to violate the chapter, the Attorney General may bring an action in the state's name for a declaratory judgment, an injunction, recovery of actual damages or restitution on behalf of the state and its agencies, and a civil penalty of up to $25,000 per violation, deposited to the state general fund. These remedies are in addition to any other available remedy at law or equity.

The chapter creates no private right of action for a genetic-information violation, unlike SDATAA's express injured-party route for student data.

An affected entity's own primary regulator, not a private plaintiff, enforces the notice duty: the primary regulator may bring a civil action to compel compliance and enjoin further violations, and an agency, individual, or commercial entity that intentionally fails to give notice is subject to a fine of up to $25,000 per breach. The chapter creates no private right of action.

SDATAA binds the State Board of Education, school districts, public charter schools, and their private vendors on the collection, use, and disclosure of K-12 student data.

A student's permanent educational record may not include, among other exclusions, the student's biometric information, Social Security number, or data collected through statewide-assessment affective computing such as facial-expression, EEG, or eye-tracking analysis (with a carve-out for special needs and exceptional students).

A person found, in a civil enforcement action by the State Board or the Department of Education or in a court action initiated by an injured party, to have violated the Act is liable for a civil penalty of up to $50,000 per violation, and all civil penalties collected are paid into the state general fund; the Act refers to a court action initiated by an injured party but grants no cause of action of its own; a district or charter school that fails to adopt, implement, and post its student-data policy faces a separate $50,000 civil penalty enforced by the State Board with Attorney General assistance.

Unless otherwise prohibited by law or court order, a school district must provide a parent or guardian with copies of all of their child's educational records upon request, so long as the child has not yet turned eighteen.

Idaho's Genetic Testing Privacy Act (Idaho Code Title 39, Chapter 83) is an employment-context genetic-privacy statute rather than a general-audience personal-data regime.

Section 39-8303 bars an "employer", defined at sec. 39-8302(4) to include any entity employing five or more persons and expressly including government, from accessing or considering an individual's private genetic information, requesting or requiring consent to release it, requesting or requiring a genetic test of an individual or blood relative, or inquiring whether either has taken or refused one, in connection with a hiring, promotion, retention, or other related employment decision.

Narrow exceptions allow a court-ordered compelled disclosure in limited circumstances and forensic or human-remains DNA analysis by an employer that conducts it. The Act creates no controller or processor duties and no consumer-facing right against a business generally. The provisions this entry describes came into force on different days.

Subsections (1) and (2) make it computer crime, a felony, to knowingly access, attempt to access, or use a computer, computer system, or network with intent to defraud, to obtain money, property, or services by false pretenses, or to commit theft, or to knowingly and without authorization alter, damage, or destroy a computer, system, network, or the software, program, documentation, or data it contains.

Subsection (3) separately makes it a misdemeanor for any person to knowingly and without authorization use, access, or attempt to access a computer, computer system, or network, or the software, program, documentation, or data contained in it, with no further intent element beyond knowledge and lack of authorization.

Neither this section nor its companion definitions section, Idaho Code section 18-2201, which defines only technical terms such as access, computer, and computer network, states what counts as authorization or exempts ordinary access to a publicly available page. Idaho Code section 18-2202 was added by 1984 Idaho Session Laws chapter 68, section 1, whose enacted text carries no effective-date clause and declares no emergency.

A law with neither takes effect on July 1 of the year of the regular session or sixty days after the session ends, whichever is later, under Idaho Code section 67-510, and no source states the resulting day for this act.

The office of information technology services is directed to ensure that all state agencies implement and maintain cybersecurity best practices. The office must require all state agencies to implement and use multifactor identification to access information technology devices or services, including local and remote network access to any email accounts, cloud storage accounts, web applications, networks, databases, or servers.

The office is authorized and directed to direct state agencies and officials on penetration tests and vulnerability scans of state technology systems in order to identify steps to mitigate identified risks. State agencies means all state agencies or departments, boards, commissions, councils, and institutions of higher education, but not the elected constitutional officers and their staffs, the legislature and its staffs, or the judiciary.

Multifactor identification means using two or more different types of identification credentials to achieve authentication. The legislative branch and its staff, the judicial branch and its staff, and the elected constitutional officers and their staffs shall implement the use of multifactor identification. House Bill 35 of 2025 became Session Law Chapter 6 and took effect on July 1, 2025.

Requires a publisher of a website whose share of material harmful to minors meets the applicability criteria to perform reasonable age verification, via a digitized identification card or a commercial age verification system using government issued identification or transactional data, and prevent minors from accessing the material. Creates a private right of action with statutory damages of at least $10,000. Enacted as 2024 Idaho Session Laws chapter 113.

Requires large social media platforms, those with at least $1 billion in worldwide advertising revenue, to use reasonable age estimation for Idaho account holders and obtain verifiable parental consent before a child, defined as an Idaho resident 16 years of age or younger, may hold an account, and bars addictive interface features and certain advertising directed at children. A platform may treat an account holder as an adult only with at least 80 percent confidence the user is older than 16. Creates a private right of action. Signed April 2, 2026, as 2026 Idaho Session Laws chapter 268.