Regulon — ID-H-0744 · ID HB 744 (Biometric Identifiers)

Summary

Idaho HB 744 regulates the capture, storage, disclosure, and destruction of biometric identifiers (retina/iris scans, fingerprints, voiceprints, hand/face geometry) for commercial purposes. Before capturing a biometric identifier, a person must inform the individual and obtain consent; consent cannot be inferred from publicly available images unless the individual themselves made the data public. Possessors must protect biometric data with reasonable care, destroy it within one year of purpose expiration, provide a revocation mechanism, and may only disclose it under narrow exceptions. The law creates a broad AI training exemption: processing or storage of biometric identifiers for developing, training, or evaluating AI models or systems is exempt unless the system is used to uniquely identify a specific individual. Enforcement is exclusively through the Attorney General, with civil penalties up to $25,000 per violation.

Enforcement & Penalties

Enforcement Authority

The Attorney General may bring a civil action to recover civil penalties for violations of this section. No private right of action is created. Enforcement is agency-initiated by the Attorney General.

Penalties

Civil penalty of not to exceed $25,000 per violation. No private damages, injunctive relief, or attorney fees provisions. Penalties are recoverable only by the Attorney General.

Who Is Covered

Compliance Obligations 7 obligations · click obligation ID to open requirement page

D-01 Automated Processing Rights & Data Controls · D-01.8 · Deployer · Biometrics

Idaho Code § 48-2101(2)(a)-(b)

Plain Language

Before capturing any biometric identifier for a commercial purpose, a person must inform the individual and obtain the individual's consent. Consent cannot be inferred from the mere existence of an image or media containing the individual's biometric identifiers on the internet or other publicly available sources — the individual themselves must have made that data publicly available for it to count. This is an affirmative opt-in consent requirement with a specific carve-out prohibiting constructive consent from scraped public data.

Statutory Text

(2)(a) A person may not capture a biometric identifier of an individual for a commercial purpose unless the person: (i) Informs the individual before capturing the biometric identifier; and (ii) Receives the individual's consent to capture the biometric identifier. (b) For the purposes of this subsection, an individual has not been informed of and has not provided consent for the capture or storage of a biometric identifier for a commercial purpose based solely on the existence of an image or other media containing one (1) or more biometric identifiers of the individual on the internet or other publicly available source unless the image or other media was made publicly available by the individual to whom the biometric identifiers relate.

Other · Deployer · Biometrics

Idaho Code § 48-2101(3)(a)

Plain Language

Persons or entities possessing a commercially captured biometric identifier may not sell, lease, or otherwise disclose it to any third party except under four narrow exceptions: the individual consents for disappearance/death identification purposes; the disclosure completes a financial transaction the individual authorized; disclosure is required or permitted by state or federal law; or the disclosure is made to law enforcement pursuant to a warrant. This is effectively a default prohibition on biometric data sharing with very limited carve-outs.

Statutory Text

(3) Persons or entities possessing a biometric identifier of an individual that is captured for a commercial purpose: (a) May not sell, lease, or otherwise disclose the biometric identifier to another person unless: (i) The individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death; (ii) The disclosure completes a financial transaction that the individual requested or authorized; (iii) The disclosure is required or permitted by state or federal law; or (iv) The disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant;

Other · Deployer · Biometrics

Idaho Code § 48-2101(3)(b)

Plain Language

Entities possessing commercially captured biometric identifiers must store, transmit, and protect them using reasonable care, at a level at least as protective as the entity uses for its other confidential information. This establishes a floor — not a ceiling — requiring that biometric data receive at least parity treatment with the entity's most sensitive data categories.

Statutory Text

(b) Shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects any other confidential information the person possesses;

Other · Deployer · Biometrics

Idaho Code § 48-2101(3)(c), (4), (5)

Plain Language

Entities must destroy commercially captured biometric identifiers within a reasonable time, but no later than one year after the purpose for collecting them expires. If the biometric identifier is tied to a document that another law requires to be retained longer, the destruction deadline extends to one year after that legal retention requirement ends. For employer-collected biometric identifiers used for security purposes, the collection purpose is presumed to expire when the employment relationship terminates — meaning destruction must occur within one year of the employee's departure.

Statutory Text

(c) Shall destroy the biometric identifier within a reasonable time, but no later than the first anniversary of the date the purpose for collecting the identifier expires, except as provided by subsection (4) of this section; and (4) If a biometric identifier captured for a commercial purpose is used in connection with an instrument or document that is required by another law to be maintained for a period longer than the period prescribed by subsection (3)(c) of this section, the person who possesses the biometric identifier shall destroy the biometric identifier within a reasonable time, but no later than the first anniversary of the date the instrument or document is no longer required to be maintained by law. (5) If a biometric identifier captured for a commercial purpose has been collected for security purposes by an employer, the purpose for collecting the identifier pursuant to subsection (3)(c) of this section is presumed to expire on termination of the employment relationship.

D-01 Automated Processing Rights & Data Controls · D-01.3 · Deployer · Biometrics

Idaho Code § 48-2101(3)(d)

Plain Language

Entities must provide a mechanism for individuals to revoke consent to biometric identifier storage and transmission at any time. Upon receiving a revocation, the entity must immediately destroy the biometric identifier — unless maintaining it is required by another law. This is an ongoing opt-out right, not a one-time election. The destruction obligation upon revocation is immediate, with no cure period or grace window.

Statutory Text

(d) Shall provide a method for an individual to revoke consent to the storage and transmission of a biometric identifier at any time and shall immediately destroy the biometric identifier upon receiving a revocation of consent unless maintaining the biometric identifier is required by another law.

Other · Biometrics

Idaho Code § 48-2101(7)(a)-(c)

Plain Language

Three categories of activity are fully exempt from the chapter's requirements: (1) voiceprint data retained by financial institutions as defined under federal law (15 U.S.C. § 6809); (2) processing or storage of biometric identifiers for developing, training, evaluating, or offering AI models or systems — unless the AI system is used to uniquely identify a specific individual; and (3) development or deployment of AI systems for security, fraud prevention, system integrity, and law enforcement investigation purposes. The AI training exemption is particularly broad — it permits scraping and storing biometric data for model training without consent, notice, or destruction obligations, as long as the resulting system is not deployed to identify specific people. This creates no new compliance obligation.

Statutory Text

(7) The provisions of this section do not apply to: (a) Voiceprint data retained by a financial institution or an affiliate of a financial institution, as those terms are defined by 15 U.S.C. 6809; (b) The processing or storage of biometric identifiers involved in the developing, training, evaluating, disseminating, or otherwise offering of artificial intelligence models or systems, unless a system is used or deployed for the purpose of uniquely identifying a specific individual; or (c) The development or deployment of an artificial intelligence model or system for the purposes of: (i) Preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any other illegal activity; (ii) Preserving the integrity or security of a system; or (iii) Investigating, reporting, or prosecuting a person responsible for a security incident, identity theft, fraud, harassment, a malicious or deceptive activity, or any other illegal activity.

Other · Biometrics

Idaho Code § 48-2101(8)

Plain Language

If biometric identifiers originally captured under the AI training exemption are later repurposed for a non-exempt commercial use (e.g., uniquely identifying individuals or uses outside the security/fraud exceptions), the full chapter applies — including all possession, destruction, and penalty provisions. This is a re-entry trigger, not an independent obligation. It prevents entities from laundering biometric data through an initial 'AI training' purpose to evade the chapter's requirements for subsequent commercial uses.

Statutory Text

(8) If a biometric identifier captured for the purpose of training an artificial intelligence system is subsequently used for a commercial purpose not described by subsection (7) of this section, the person possessing the biometric identifier is subject to: (a) The provisions of this section regarding the possession and destruction of a biometric identifier; and (b) The penalties associated with a violation of this section.