WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(1)(a)–(b) As used in this section: (a) "Artificial intelligenceArtificial intelligence"Artificial intelligence" means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.Idaho Code § 48-2101(1)(a)" means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments. (b) "Biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b)" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.
(2)(a)–(b) 1 A person may not capture a biometric identifier of an individual for a commercial purpose unless the person: (i) Informs the individual before capturing the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b); and (ii) Receives the individual's consent to capture the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b). (b) For the purposes of this subsection, an individual has not been informed of and has not provided consent for the capture or storage of a biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) for a commercial purpose based solely on the existence of an image or other media containing one (1) or more biometric identifiers of the individual on the internet or other publicly available source unless the image or other media was made publicly available by the individual to whom the biometric identifiersBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) relate.
(3)(a) 2 Persons or entities possessing a biometric identifier of an individual that is captured for a commercial purpose: (a) May not sell, lease, or otherwise disclose the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) to another person unless: (i) The individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death; (ii) The disclosure completes a financial transaction that the individual requested or authorized; (iii) The disclosure is required or permitted by state or federal law; or (iv) The disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant;
(3)(b) 3 Shall store, transmit, and protect from disclosure the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) using reasonable care and in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects any other confidential information the person possesses;
(3)(c) 4 Shall destroy the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) within a reasonable time, but no later than the first anniversary of the date the purpose for collecting the identifier expires, except as provided by subsection (4) of this section; and
(3)(d) 5 Shall provide a method for an individual to revoke consent to the storage and transmission of a biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) at any time and shall immediately destroy the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) upon receiving a revocation of consent unless maintaining the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) is required by another law.
(4) 4 If a biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) captured for a commercial purpose is used in connection with an instrument or document that is required by another law to be maintained for a period longer than the period prescribed by subsection (3)(c) of this section, the person who possesses the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) shall destroy the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) within a reasonable time, but no later than the first anniversary of the date the instrument or document is no longer required to be maintained by law.
(5) If a biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) captured for a commercial purpose has been collected for security purposes by an employer, the purpose for collecting the identifier pursuant to subsection (3)(c) of this section is presumed to expire on termination of the employment relationship.
(6) A person who violates the provisions of this section is subject to a civil penalty of not to exceed twenty-five thousand dollars ($25,000) for each violation. The attorney general may bring an action to recover civil penalties pursuant to this subsection.
(7)(a)–(c) The provisions of this section do not apply to: (a) Voiceprint data retained by a financial institution or an affiliate of a financial institution, as those terms are defined by 15 U.S.C. 6809; (b) The processing or storage of biometric identifiersBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) involved in the developing, training, evaluating, disseminating, or otherwise offering of artificial intelligenceArtificial intelligence"Artificial intelligence" means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.Idaho Code § 48-2101(1)(a) models or systems, unless a system is used or deployed for the purpose of uniquely identifying a specific individual; or (c) The development or deployment of an artificial intelligenceArtificial intelligence"Artificial intelligence" means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.Idaho Code § 48-2101(1)(a) model or system for the purposes of: (i) Preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any other illegal activity; (ii) Preserving the integrity or security of a system; or (iii) Investigating, reporting, or prosecuting a person responsible for a security incident, identity theft, fraud, harassment, a malicious or deceptive activity, or any other illegal activity.
(8) 6 If a biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) captured for the purpose of training an artificial intelligenceArtificial intelligence"Artificial intelligence" means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.Idaho Code § 48-2101(1)(a) system is subsequently used for a commercial purpose not described by subsection (7) of this section, the person possessing the biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b) is subject to: (a) The provisions of this section regarding the possession and destruction of a biometric identifierBiometric identifier"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.Idaho Code § 48-2101(1)(b); and (b) The penalties associated with a violation of this section.
Section 48-2101 is the sole operative section of the bill and establishes Idaho's biometric identifier protection regime. It defines key terms, sets notice-and-consent requirements for commercial capture, imposes data security, retention, disclosure, and destruction obligations on possessors, and provides a revocation mechanism. Enforcement is by attorney general civil penalty action at up to $25,000 per violation.
Critically, subsection (7)(b) carves out the processing or storage of biometric identifiers for developing, training, evaluating, disseminating, or otherwise offering AI models or systems — unless the system is used to uniquely identify a specific individual. Subsection (7)(c) further exempts AI development or deployment for defined security and fraud-prevention purposes. Subsection (8) creates a reattachment trigger: if biometric data originally captured for AI training is later used for a non-exempt commercial purpose, the full statute's possession and destruction obligations — and associated penalties — apply.