Idaho Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Idaho has no dedicated biometric privacy law. The state's breach notification statute (Idaho Code 28-51-104) does not cover fingerprints, facial scans, or other biometric identifiers, leaving residents with no state-level consent or disclosure rights. House Bill 744 (2026) would have added those protections, but the bill died without a committee hearing when the Idaho Legislature adjourned for the year on April 2, 2026.

Idaho is one of the majority of U.S. states without a dedicated law governing biometric data. Residents who clock in with a fingerprint, unlock a phone with facial recognition, or provide a retina scan to access a secure facility have limited state-level protections for that data.

This guide covers what Idaho law currently does and does not address when it comes to biometric information, the legislative proposals that have so far failed to pass, and what protections exist right now.

For broader context on Idaho's overall privacy framework, see the parent guide to Idaho Data Privacy Laws.

What Counts as Biometric Data

Biometric data includes unique physical or behavioral characteristics used to identify a person. Common examples include fingerprints, facial geometry (the measurements used by facial recognition systems), iris and retina scans, voiceprints, palm prints, and hand geometry.

States that regulate biometric data typically define these identifiers in statute and set rules for how organizations handle them. Idaho has not taken that step.

The failed House Bill 744, which died in committee in 2026, would have defined a "biometric identifier" as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry. That definition aligns closely with the approach taken by Illinois BIPA and Texas CUBI.

Idaho's Current Legal Framework

Breach Notification Law (Idaho Code 28-51-104 et seq.)

Idaho's primary data security law is the Identity Theft/Data Breach Notification Act, codified at Idaho Code 28-51-104 through 28-51-107. This law requires businesses and government agencies to notify Idaho residents when a security breach compromises their personal information.

However, the statute defines "personal information" under Idaho Code 28-51-104 as an individual's name combined with one or more of the following:

• Social Security number
• Driver's license or Idaho identification card number
• Financial account, credit card, or debit card numbers (with required security codes or passwords)

Biometric data such as fingerprints, facial scans, and voiceprints are not included in this definition. A data breach that exposes only biometric records would not trigger notification obligations under current Idaho law.

Penalties for intentional failure to notify reach up to $25,000 per breach under Idaho Code 28-51-107. Public agencies must notify the Idaho Attorney General within 24 hours of discovering a breach, a duty set out in Idaho Code 28-51-105.

Consumer Protection Act (Idaho Code 48-601 et seq.)

Idaho's Consumer Protection Act prohibits unfair and deceptive trade practices. While the statute does not reference biometric data specifically, a business that made false promises about how it collects or protects biometric information could face enforcement action under this law.

The Idaho Attorney General enforces the Consumer Protection Act. The law also creates a private right of action, but its entry requirement is narrower than it first appears. Under Idaho Code 48-608, the action belongs only to a person "who purchases or leases goods or services" and thereby suffers an ascertainable loss from a practice the chapter declares unlawful. A plaintiff who clears that threshold may recover actual damages or $1,000, whichever is greater, plus attorney's fees. In a class action, the statute caps the $1,000 alternative at a total of $1,000 for the entire class, not $1,000 per member.

That purchase-or-lease predicate matters a great deal in biometric disputes. In the situations readers ask about most often, a store or venue face-scanning the people who walk in, or an employer fingerprinting a worker at a time clock, the scanned person has not bought or leased anything from the entity doing the scanning. In those cases 48-608 supplies no remedy at all. Even where a purchase does exist, the right of action reaches deceptive conduct generally. It is not a BIPA-style right tied specifically to biometric data collection or consent, which is the real gap compared to Illinois.

Student Data Protections (Idaho Code 33-133)

Idaho does protect biometric data in one specific context: education. The Student Data Accessibility, Transparency and Accountability Act (SDATAA) includes a student's "biometric record" in its definition of personally identifiable student data.

Under this law:

• Student biometric information may not be included in a student's educational record
• Schools must obtain written parental consent before private vendors can use individual student data for secondary purposes
• Schools cannot use "affective computing" technologies that analyze facial expressions, EEG brain wave patterns, or other biometric signals through statewide assessments (with limited exceptions for special needs students)

This protection is narrow. It applies only to K-12 educational settings and does not extend to private employers, commercial businesses, or government agencies outside of education.

Children's Social Media Accounts (Idaho Code 48-2101 to 48-2106)

The Stop Harms from Addictive Social Media Act, added to the Idaho Code in 2026 and codified at Idaho Code 48-2101 through 48-2106, is the only other Idaho statute that names biometric identifiers outright. Its definition of "personal information" in Idaho Code 48-2102 expressly covers "any photograph or biometric information that is used or could reasonably be used to identify the account holder, including but not limited to fingerprints, voiceprints, iris or retina imagery scans, facial templates, and gait imagery or metrics."

Idaho Code 48-2105 backs that up with a private right of action for a child or parent, including $10,000 in statutory damages where the platform's violation was reckless or knowing. That is the closest thing Idaho law has to a BIPA-style claim.

Its reach is very narrow. The act applies only to social media platforms that generated at least $1 billion in worldwide advertising revenue in one of the preceding three years, and only as to Idaho residents 16 or younger. It does not touch employers, retailers, venues, landlords, or any other ordinary collector of biometric data, so it does not change the overall picture for adults in Idaho.

Law Enforcement Fingerprinting (Idaho Code 67-3004)

Idaho law governs the collection and use of fingerprints by law enforcement under Idaho Code 67-3004. When a person is arrested for a retainable offense, the arresting agency must collect fingerprints and submit them to the state bureau for identification.

The statute includes provisions for shielding fingerprint records from public disclosure when a court determines a person is eligible and public safety would not be compromised. This applies only to law enforcement records and does not affect private-sector fingerprint collection.

No Employer-Specific Biometric Rules

Idaho does not restrict employers from collecting fingerprints, facial scans, or other biometric data from workers. Businesses that use biometric time clocks, fingerprint-based door access, or facial recognition for security are not required by state law to:

• Obtain written consent before collecting biometric data
• Disclose how biometric data will be stored or used
• Establish retention schedules or destruction timelines
• Limit sharing of biometric data with third parties

This stands in sharp contrast to states like Illinois, where the Biometric Information Privacy Act requires informed written consent and imposes statutory damages of $1,000 to $5,000 per violation.

One adjacent limit does apply to Idaho employers. Idaho Code 39-8303 bars an employer from accessing or taking into consideration an individual's private genetic information, from requiring a person or a blood relative to submit to a genetic test, and from inquiring whether someone has taken or refused one. The definition at Idaho Code 39-8302 reaches employers with five or more employees, public and private alike.

That statute does not close the biometric gap. Genetic data is legally distinct from biometric identifiers, and H0744, Illinois BIPA, and Texas CUBI all leave DNA out of their biometric definitions. But it does mean Idaho employers are not entirely unregulated when it comes to biological information about workers.

Legislative History

Senate Bill 1066 (2025) - Failed

Senate Bill 1066 would have expanded Idaho's breach notification law to cover "unique biometric data generated for authentication purposes" as protected personal information. The engrossed bill would also have added passport numbers, a username or email address paired with a password, individual medical history, treatment, diagnosis or DNA profile, and individual taxpayer identification numbers to the same definition, and would have required an entity to offer affected residents at least 12 months of free credit monitoring plus information on how to place a credit freeze.

The bill would not have changed Idaho's notification timing rule. Current law at Idaho Code 28-51-105 already provides that notice "must be made in the most expedient time possible and without unreasonable delay," and S1066 carried that sentence forward unchanged.

S1066 passed the Idaho Senate 27-6-2 on March 10, 2025, and crossed over to the House. However, it was retained on General Orders on April 4, 2025, and did not advance further. The bill is considered dead for the 2025 session.

House Bill 744 (2026) - Died in Committee

House Bill 744 was the most significant biometric privacy proposal introduced in Idaho during the 2026 session. Introduced on February 20, 2026, the bill would have added a new chapter to Title 48 of Idaho Code to regulate the commercial capture and use of biometric identifiers.

Key provisions include:

• Consent requirement: A person may not capture a biometric identifier for a commercial purpose without first informing the individual and receiving consent. An image of a person posted online by someone else would not have counted as consent
• Restrictions on sharing: Companies possessing biometric data face limitations on selling, leasing, or disclosing it, with exceptions for identification in the event of the individual's disappearance or death, completing a financial transaction the individual requested or authorized, disclosures required or permitted by state or federal law, and disclosures made by or to a law enforcement agency in response to a warrant
• Data security and destruction: Biometric identifiers had to be protected at least as well as the holder's other confidential information and destroyed within a reasonable time, no later than one year after the purpose for collecting them expired. Where an employer collected an identifier for security, that purpose was presumed to expire when the employment ended
• Artificial intelligence and financial carve-outs: The bill did not reach voiceprint data retained by a financial institution or its affiliate, and it exempted the processing or storage of biometric identifiers involved in developing, training, evaluating, disseminating, or otherwise offering artificial intelligence models unless a system was used or deployed to uniquely identify a specific individual. A parallel carve-out covered AI developed or deployed to prevent, detect, or investigate security incidents, identity theft, fraud, harassment, and similar illegal activity
• Penalties: Civil penalties of up to $25,000 per violation, enforceable by the Idaho Attorney General
• Commercial scope only: The bill reached only the capture of a biometric identifier "for a commercial purpose," so government collection and use fell outside it by definition. The bill contained no separate government exemption clause

H0744 was referred to the House Environment, Energy & Technology Committee on February 23, 2026, and never received a committee hearing. The bill died when the Idaho Legislature adjourned sine die on April 2, 2026, and would need to be reintroduced as a new bill in a future session to become law.

Federal Protections That Apply in Idaho

Because Idaho lacks a state biometric privacy law, federal statutes provide the primary guardrails for biometric data in most contexts.

Section 5 of the FTC Act allows the Federal Trade Commission to bring enforcement actions against companies engaged in unfair or deceptive practices involving biometric data. The FTC has taken action against companies for deceptive facial recognition practices and inadequate biometric data security.

HIPAA protects biometric data when collected or used by covered healthcare entities and their business associates. Fingerprint or facial recognition data in a healthcare setting falls under the HIPAA Privacy Rule.

FERPA restricts how educational institutions handle student biometric data, complementing Idaho's own SDATAA protections at the federal level.

COPPA imposes strict requirements on collecting biometric data from children under 13, including parental consent requirements enforced by the FTC.

How Idaho Compares to Other States

Idaho falls into one of the least protective tiers for biometric privacy. For comparison:

• Illinois has the strongest biometric law in the country (BIPA), with a private right of action and statutory damages of $1,000 to $5,000 per violation
• Texas and Washington have biometric-specific statutes enforced by their attorneys general
• States with comprehensive privacy laws (like Colorado, Connecticut, and Virginia) classify biometric data as sensitive and require consent for processing
• Idaho has no general biometric-specific protections and no comprehensive privacy law currently in effect. Its only statutes naming biometric identifiers are narrow ones covering student data (Idaho Code 33-133) and children's accounts on large social media platforms (Idaho Code 48-2101 to 48-2106)

Had H0744 passed, Idaho would have joined the small group of states with standalone biometric privacy legislation. However, the bill's commercial-only scope, its artificial intelligence carve-outs, and its lack of a private right of action would have placed it below Illinois in terms of enforcement strength, and the measure would need to be reintroduced in a future session for another chance at becoming law.

This article provides general legal information about Idaho biometric privacy laws. It is not legal advice. Laws and regulations change frequently, and this content may not reflect the most recent developments. Consult a qualified attorney licensed in Idaho for advice about your specific situation.

More Idaho Laws

• Idaho Deepfake Laws
• Idaho Employee Monitoring Laws
• Idaho GPS Tracking Laws
• Idaho Recording Laws