Regulon.AI — ID-H-0744 · ID HB 744 (Biometric Identifiers)

Summary

Idaho HB 744 creates new Chapter 21 of Title 48, Idaho Code, regulating the capture, storage, disclosure, and destruction of biometric identifiers (retina/iris scans, fingerprints, voiceprints, hand or face geometry) for commercial purposes. Any person capturing biometric identifiers for a commercial purpose must provide advance notice and obtain consent, and must comply with data security, destruction, and consent-revocation requirements. The statute contains a significant carve-out for the processing or storage of biometric identifiers involved in developing, training, evaluating, or offering AI models or systems, unless the system is used to uniquely identify a specific individual. Enforcement is exclusively through civil penalties of up to $25,000 per violation brought by the attorney general. The act takes effect July 1, 2026 on an emergency basis.

Enforcement & Penalties

Enforcement Authority

Attorney general enforcement only. The attorney general may bring a civil action to recover civil penalties for violations. No private right of action is created. Enforcement is agency-initiated.

Penalties

Civil penalty of up to $25,000 per violation. No private damages, injunctive relief, or attorney fees provisions. Penalties are recoverable only by the attorney general.

Who Is Covered

Compliance Obligations 7 obligations · click obligation ID to open requirement page

D-01 Automated Processing Rights & Data Controls · D-01.8 · Deployer · Biometrics

Idaho Code § 48-2101(2)(a)-(b)

Plain Language

Before capturing any biometric identifier for a commercial purpose, a person must inform the individual and obtain their consent. Consent cannot be inferred from the mere existence of the individual's image or media containing biometric identifiers on the internet or other publicly available sources — the individual themselves must have made the image or media publicly available for such availability to count as notice or consent. This is an affirmative opt-in requirement.

Statutory Text

(2)(a) A person may not capture a biometric identifier of an individual for a commercial purpose unless the person: (i) Informs the individual before capturing the biometric identifier; and (ii) Receives the individual's consent to capture the biometric identifier. (b) For the purposes of this subsection, an individual has not been informed of and has not provided consent for the capture or storage of a biometric identifier for a commercial purpose based solely on the existence of an image or other media containing one (1) or more biometric identifiers of the individual on the internet or other publicly available source unless the image or other media was made publicly available by the individual to whom the biometric identifiers relate.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · Biometrics

Idaho Code § 48-2101(3)(a)

Plain Language

Persons or entities possessing commercially-captured biometric identifiers may not sell, lease, or otherwise disclose them to third parties except in four narrow circumstances: (1) the individual consents for identification in case of disappearance or death, (2) the disclosure completes a financial transaction the individual requested, (3) the disclosure is required or permitted by law, or (4) the disclosure is made to or by law enforcement pursuant to a warrant. All other third-party disclosures are prohibited.

Statutory Text

(3) Persons or entities possessing a biometric identifier of an individual that is captured for a commercial purpose: (a) May not sell, lease, or otherwise disclose the biometric identifier to another person unless: (i) The individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death; (ii) The disclosure completes a financial transaction that the individual requested or authorized; (iii) The disclosure is required or permitted by state or federal law; or (iv) The disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant;

Other · Biometrics

Idaho Code § 48-2101(3)(b)

Plain Language

Persons possessing commercially-captured biometric identifiers must store, transmit, and protect them using reasonable care, at a level at least as protective as the manner in which they protect other confidential information. This establishes a floor — biometric data must receive at least the same security treatment as any other confidential data the entity possesses.

Statutory Text

(b) Shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects any other confidential information the person possesses;

Other · Biometrics

Idaho Code § 48-2101(3)(c), (4), (5)

Plain Language

Persons possessing commercially-captured biometric identifiers must destroy them within a reasonable time, and no later than one year after the purpose for collection expires. If the biometric identifier is connected to an instrument or document required by another law to be retained longer, the destruction deadline extends to one year after that other law's retention requirement ends. For employer-collected biometric identifiers used for security purposes, the collection purpose is presumed to expire upon termination of the employment relationship, triggering the one-year destruction clock.

Statutory Text

(c) Shall destroy the biometric identifier within a reasonable time, but no later than the first anniversary of the date the purpose for collecting the identifier expires, except as provided by subsection (4) of this section; and (4) If a biometric identifier captured for a commercial purpose is used in connection with an instrument or document that is required by another law to be maintained for a period longer than the period prescribed by subsection (3)(c) of this section, the person who possesses the biometric identifier shall destroy the biometric identifier within a reasonable time, but no later than the first anniversary of the date the instrument or document is no longer required to be maintained by law. (5) If a biometric identifier captured for a commercial purpose has been collected for security purposes by an employer, the purpose for collecting the identifier pursuant to subsection (3)(c) of this section is presumed to expire on termination of the employment relationship.

D-01 Automated Processing Rights & Data Controls · D-01.3 · Deployer · Biometrics

Idaho Code § 48-2101(3)(d)

Plain Language

Entities possessing commercially-captured biometric identifiers must provide individuals with a mechanism to revoke consent to storage and transmission at any time. Upon receiving a revocation, the entity must immediately destroy the biometric identifier — unless retention is independently required by another law. This is an ongoing opt-out right that must be available throughout the data lifecycle, not just at collection.

Statutory Text

(d) Shall provide a method for an individual to revoke consent to the storage and transmission of a biometric identifier at any time and shall immediately destroy the biometric identifier upon receiving a revocation of consent unless maintaining the biometric identifier is required by another law.

Other · Biometrics

Idaho Code § 48-2101(7)(b)-(c)

Plain Language

Two broad AI-related exemptions apply: (1) Processing or storing biometric identifiers for AI model development, training, evaluation, dissemination, or offering is exempt — unless the system is used to uniquely identify a specific individual, in which case all obligations apply. (2) AI development or deployment for security purposes — including fraud prevention, threat detection, system integrity, and investigation of illegal activity — is fully exempt with no individual-identification carve-back. Product counsel should note that the AI training exemption has a significant re-entry trigger: under subsection (8), if a biometric identifier captured for AI training is subsequently used for a non-exempt commercial purpose, all of the statute's possession, destruction, and penalty provisions snap into effect.

Statutory Text

(7) The provisions of this section do not apply to: (b) The processing or storage of biometric identifiers involved in the developing, training, evaluating, disseminating, or otherwise offering of artificial intelligence models or systems, unless a system is used or deployed for the purpose of uniquely identifying a specific individual; or (c) The development or deployment of an artificial intelligence model or system for the purposes of: (i) Preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any other illegal activity; (ii) Preserving the integrity or security of a system; or (iii) Investigating, reporting, or prosecuting a person responsible for a security incident, identity theft, fraud, harassment, a malicious or deceptive activity, or any other illegal activity.

Other · Biometrics

Idaho Code § 48-2101(8)

Plain Language

If a biometric identifier was initially captured for AI training purposes (and thus exempt under subsection (7)(b)), but is later repurposed for a commercial use not covered by any of the subsection (7) exemptions, the full statute snaps back into effect. The possessor becomes subject to all possession and destruction requirements and is liable for civil penalties. This means AI developers must track the provenance and downstream use of biometric training data — a biometric identifier that starts life as exempt training data can retroactively trigger compliance obligations if its use shifts to a non-exempt commercial purpose.

Statutory Text

(8) If a biometric identifier captured for the purpose of training an artificial intelligence system is subsequently used for a commercial purpose not described by subsection (7) of this section, the person possessing the biometric identifier is subject to: (a) The provisions of this section regarding the possession and destruction of a biometric identifier; and (b) The penalties associated with a violation of this section.