{
 "jurisdiction_id": "US-ID",
 "jurisdiction": "United States – Idaho",
 "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-06",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 28,
  "sub_modules": 57,
  "source_register": 13
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "A functioning enforcement authority and a narrow breach-notification statute exist, but there is no comprehensive material/territorial scope framework or registration regime.",
   "claims": [
    {
     "statement": "The Idaho Attorney General, currently Raúl Labrador, is the state's chief law-enforcement officer with general consumer-protection authority that extends to privacy-adjacent enforcement.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/attorney-general/raul-labrador/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Idaho has no comprehensive state consumer-privacy statute; data-protection matters are governed by federal FTC Act Section 5 authority and applicable federal sectoral laws, plus the state's breach-notification statute.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Idaho Code Title 28, Chapter 51, §28-51-105 governs disclosure of breach of security of computerized personal information by an agency, individual, or commercial entity.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (legal research compilation)",
     "source_url": "https://www.dataguidance.com/legal-research/idaho-statutes-title-28-chapter-51-identity-1",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Idaho breach-notification statute's material scope is limited to unencrypted computerized personal information as statutorily defined, and does not establish a general processing-activity scope test.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/issues/consumer-protection/consumer-protection-101/privacy/data-breaches/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Idaho's breach law applies based on the residency of affected individuals rather than an establishment- or targeting-based territorial test.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/issues/consumer-protection/consumer-protection-101/privacy/data-breaches/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "red",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "No general lawful-basis, consent, or special-category framework exists at the state level; coverage is incidental via federal sectoral overlays only.",
   "claims": [
    {
     "statement": "Idaho has no state-law-enumerated lawful bases for processing personal data equivalent to GDPR Art. 6; processing legality is instead assessed under federal sectoral frameworks and FTC Act unfairness/deception standards.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No Idaho state statute establishes a special/sensitive-category data regime; where sensitive health data is involved, protection derives from federal HIPAA coverage of covered entities rather than Idaho law.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "red",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "No comprehensive consumer data-subject-rights framework exists; only a narrow FERPA-derived education-records right applies.",
   "claims": [
    {
     "statement": "Idaho does not grant a general consumer right of access to personal data held by businesses, in contrast to states with comprehensive privacy statutes.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Federal FERPA affords parents and eligible students limited rights to inspect and seek amendment of education records maintained by Idaho schools and their education-technology vendors, though FERPA itself carries no private right of action.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/at-congressional-hearing-on-student-privacy-ferpas-scope-contracts-take-cen/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "A functioning breach-notification duty exists and federal enforcement has imposed retention obligations by consent order, but no general accountability/DPIA/DPO/ROPA framework exists.",
   "claims": [
    {
     "statement": "Idaho has no general statutory security-of-processing standard; reasonable-security obligations are enforced incidentally through FTC Act Section 5 unfairness doctrine.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "Federal Trade Commission / US District Court",
     "source_url": "https://www.ftc.gov/system/files/ftc_gov/pdf/71-OpiniononMTD.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Idaho Code Title 28, Chapter 51, §28-51-105 requires agencies, individuals, or commercial entities to disclose breaches of security involving computerized personal information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (legal research compilation)",
     "source_url": "https://www.dataguidance.com/legal-research/idaho-statutes-title-28-chapter-51-identity-1",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The FTC's 2026 stipulated final order against Idaho-based data broker Kochava requires the company to create a data-retention schedule mandating deletion of sensitive location data on an established timeframe.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No state-level cross-border transfer framework exists; adequacy and transfer-mechanism questions are resolved exclusively at the US federal level, which is out of scope for this state-bound JID.",
   "claims": []
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Multiple federal sectoral overlays plus two narrow Idaho sector statutes provide partial coverage, but no unifying framework exists.",
   "claims": [
    {
     "statement": "The federal Gramm-Leach-Bliley Act applies nationally, including to financial institutions operating in Idaho, imposing privacy-notice and safeguarding obligations in the absence of a state financial-privacy statute.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Federal HIPAA Privacy and Security Rules apply to covered entities and business associates handling protected health information in Idaho.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Idaho enacted HB 348 in 2014 restricting access to state prescription-drug-monitoring-program databases.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/idaho-ag-talks-about-breach-notification-his-role-as-privacy-enforcer",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The federal Fair Credit Reporting Act governs credit-reporting and scoring activity affecting Idaho residents, with no supplementary Idaho state statute identified.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Idaho enacted SB 1372 in 2014 restricting access to student data, supplementing federal FERPA education-records protections.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/idaho-ag-talks-about-breach-notification-his-role-as-privacy-enforcer",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "No dedicated adtech/commercial-privacy statute exists at the state level; the only meaningful check is reactive federal FTC enforcement.",
   "claims": [
    {
     "statement": "The FTC's 2026 stipulated order against Idaho-based data broker Kochava prohibits the sale, sharing, or disclosure of sensitive location data without consumers' affirmative express consent, enforced under federal Section 5 authority rather than a state cross-context-advertising statute.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Idaho has meaningful and growing AI-transparency and chatbot-specific legislation, but lacks a biometric-specific regime, general ADM-transparency right, or profiling restriction.",
   "claims": [
    {
     "statement": "Idaho House Bill 127 (2025), codified as new Idaho Code §48-603h, deems it an unfair trade practice for AI communications to mislead consumers into believing they are interacting with a human absent clear disclosure, effective July 1, 2025.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/idaho-bill-consumer-protection-against-misleading-ai",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "By June 2026, Idaho was reported among the states with the broadest chatbot-law approach, covering any publicly accessible conversational AI service that primarily simulates human conversation, rather than limiting scope to companion apps.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/chatbot-laws-coming-to-a-state-near-you",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Idaho is among the states that have enacted deepfake legislation addressing nonconsensual intimate images and deceptive audio/visual media related to voting or candidates.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/open-letter-why-now-is-the-time-to-act-on-us-state-ai-legislation",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "amber",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Federal COPPA plus a state student-data statute and emerging chatbot minor-protections provide partial coverage, but no dedicated age-verification, parental-consent, or dependent-adult privacy statute exists.",
   "claims": [
    {
     "statement": "Multi-state chatbot laws, including Idaho's, are reported to share a common structure imposing additional minor-specific AI disclosures and content restrictions once an operator has reason to believe a user is a minor.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/chatbot-laws-coming-to-a-state-near-you",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Federal COPPA requires operators of online services directed to children under 13 to obtain verifiable parental consent before collecting personal information, applicable nationally including to Idaho-serving operators.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/idaho-ag-talks-about-breach-notification-his-role-as-privacy-enforcer",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Idaho enacted SB 1372 in 2014 to restrict access to student data, addressing education-sector data-privacy concerns identified by the Idaho Attorney General's office.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/idaho-ag-talks-about-breach-notification-his-role-as-privacy-enforcer",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "green",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-idaho/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Despite the absence of a comprehensive statute, enforcement is demonstrably active via both the Idaho AG and federal FTC action against an Idaho-based entity within the review window.",
   "claims": [
    {
     "statement": "The FTC possesses investigative and injunctive authority under Section 5 of the FTC Act, and has used it to pursue permanent injunctions against Idaho-based entities such as data broker Kochava.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission / US District Court",
     "source_url": "https://www.ftc.gov/system/files/ftc_gov/pdf/71-OpiniononMTD.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "In May 2026, the FTC obtained a stipulated final order in the U.S. District Court for the District of Idaho banning data broker Kochava and its subsidiary from selling sensitive location data without consumers' affirmative express consent.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Some state breach-notification statutes allow private rights of action for noncompliance; Idaho's is not among the states most commonly cited as providing such a right, and enforcement is primarily attorney-general-driven.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/issues/consumer-protection/consumer-protection-101/privacy/data-breaches/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "As of June 2026, Idaho was reported among 11 U.S. states that had passed chatbot laws regulating AI systems designed to interact with consumers, adopting one of the broadest scope definitions alongside Colorado, Iowa, and Nebraska.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/chatbot-laws-coming-to-a-state-near-you",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  }
 ]
}