Idaho Consumer Data Protection Act (ICDPA)

· About Idaho Consumer Data Protection Act (ICDPA)

Key Takeaways

  • Idaho does not have a comprehensive Idaho Consumer Data Protection Act regulating access, correction, deletion, or opt-out rights; the state’s operative privacy framework remains the breach-notification law and the Idaho Consumer Protection Act.
  • Businesses handling Idaho residents’ personal data must still maintain reasonable security, because Idaho’s breach-notification statute requires safeguards and can trigger Attorney General enforcement for failures tied to unfair or deceptive practices.
  • Idaho’s main consumer-privacy enforcement authority is the Idaho Attorney General, who can seek injunctions, restitution, investigative costs, and civil penalties under the Idaho Consumer Protection Act, with penalties reaching $5,000 per violation.
  • Intentional failure to notify of a security breach can carry a separate civil fine of up to $25,000 per breach under Idaho’s breach-notification law.
  • There is no Idaho statewide comprehensive privacy-law threshold, no statutory consumer-rights package like the CCPA/CPA/CPRA, and no Idaho-specific universal opt-out or data-protection-assessment mandate as of 6 September 2026.
  • Any claim that Idaho adopted a comprehensive consumer data privacy law in 2025 or 2026 is incorrect based on the currently available official state materials and reputable practice summaries.

What It Is

Idaho has no comprehensive consumer data privacy statute equivalent to the Colorado Privacy Act, Virginia Consumer Data Protection Act, or California Consumer Privacy Act. The operative state rules are instead the Idaho breach-notification provisions in Title 28 and the Idaho Consumer Protection Act in Title 48, which together govern security incident notice and deceptive or unfair privacy practices.

The Idaho Attorney General enforces the consumer-protection statute, while breach-notification obligations are enforced through Idaho’s statutory enforcement structure and the AG’s consumer-protection authority. The Idaho Legislature’s current code materials continue to show Title 48, Chapter 6 as the consumer-protection law and Title 28, Chapter 51 as the breach-notification framework. [1][2]

There is no Idaho comprehensive privacy act with an adoption date, in-force date, or phase-in milestones to list. The relevant statutory dates are instead the dates of Idaho’s existing consumer-protection and breach-notification provisions, which predate 2025 and remain in force.

Who Must Comply

The breach-notification law applies broadly to entities that own or license computerized data including personal information, and to agencies, individuals, and commercial entities that experience a qualifying breach. The consumer-protection law applies to any person or business engaging in unfair or deceptive acts or practices in trade or commerce. [1][2]

There is no Idaho-specific applicability threshold such as annual revenue, volume of records, or percentage of revenue from data sales, because Idaho has not enacted a comprehensive consumer privacy regime. There is also no general extraterritorial scope test like “targets Idaho consumers and processes X records,” because the state has not adopted such a law.

Exemptions are therefore limited to the subject matter of the existing statutes, including areas already regulated by sector-specific federal law and ordinary legal defenses under the consumer-protection framework. In practice, banks, insurers, healthcare entities, telecom providers, and other regulated firms must still comply with Idaho breach-notice and deception rules to the extent those statutes apply.

Core Requirements

  1. Maintain reasonable security. Covered entities must protect computerized personal information with safeguards that are reasonable in light of the sensitivity of the data and the organization’s operations; failure can become the basis for enforcement under Idaho’s consumer-protection framework. [1][2]
  2. Provide breach notice when required. If a qualifying security breach occurs, notice must be given under Idaho’s breach-notification law to affected individuals and, where applicable, to the Attorney General or other authorities. [1]
  3. Avoid deceptive privacy promises. If a privacy notice, contract, or public statement says data will be protected or used in a certain way, the Idaho Consumer Protection Act can treat broken privacy promises as unfair or deceptive conduct. [2]
  4. Cooperate with Attorney General enforcement. The Attorney General may seek injunctions, restitution, expenses, investigative costs, and attorney’s fees in consumer-protection actions, so incident response should preserve evidence and support truthful disclosures. [2]
  5. Treat intentional non-notification as high-risk. Idaho law separately penalizes intentional failure to give breach notice, creating exposure beyond ordinary consumer-protection remedies. [1]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | No comprehensive Idaho consumer privacy act | N/A | No statewide GDPR/CPRA-style consumer rights regime is in force. | | Breach notice to affected persons | Promptly after discovery, as required by statute | Notice must follow Idaho’s breach-notification requirements. [1] | | Attorney General enforcement for deceptive practices | Ongoing | The Idaho Consumer Protection Act authorizes civil enforcement. [2] |

The maximum exposure under the Idaho Consumer Protection Act includes civil penalties of up to $5,000 per violation, plus injunctions, restitution, reasonable expenses, investigative costs, and attorney’s fees. [2]

For intentional failure to give breach notice, Idaho law provides a civil fine of up to $25,000 per breach. That penalty is separate from consumer-protection remedies and can be significant where notice decisions are delayed or suppressed. [1]

No Idaho statute currently creates the modern privacy-law sanctions seen elsewhere, such as universal opt-out enforcement, dedicated private-right-of-action damages for privacy rights violations, or formal cure-period structures for consumer privacy requests.

How to Comply

  1. Map data and notice triggers. Identify what personal information is collected, where it is stored, and which systems would trigger Idaho breach notice if compromised.
  2. Align security controls to ISO 27001. Use an information-security management system to document risk ownership, access control, encryption, logging, supplier security, and incident response.
  3. Use NIST CSF 2.0 for operational maturity. Build detect, protect, respond, and recover workflows around asset inventory, monitoring, containment, and restoration.
  4. Add governance discipline from ISO 42001 where AI is used. If AI systems process personal information, define roles, lifecycle controls, human oversight, and model-risk review even though Idaho has no AI-specific privacy statute.
  5. Test breach-notification playbooks. Pre-draft notices, escalation trees, regulator-contact lists, and legal-review steps so a breach can be assessed quickly and accurately.
  6. Audit privacy claims and customer-facing statements. Make sure website notices, contracts, and sales materials match actual data practices, because deceptive claims can create Idaho Consumer Protection Act exposure.
  7. Train incident and customer-support teams. Staff should know when a complaint, access request, fraud report, or security alert might indicate a reportable incident.
  8. Review vendor and processor contracts. Require security commitments, incident reporting timelines, cooperation obligations, and audit rights from service providers handling Idaho resident data.

Related Regulations

  • California CCPA/CPRA: California has a far broader consumer-rights framework, so multinational privacy programs often use California as the baseline and then map Idaho’s narrower breach and deception rules onto it.
  • Colorado Privacy Act: Colorado imposes controller obligations and consumer rights that Idaho does not, making Colorado a useful comparator for gap analysis.
  • Virginia CDPA: Virginia’s law is comprehensive and rights-based, while Idaho remains centered on breach notice and unfair-practice enforcement.
  • FTC Act Section 5: Federal deception enforcement overlaps with Idaho’s consumer-protection theory when privacy statements overpromise security or understate data use.
  • HIPAA: Healthcare entities often rely on HIPAA for sector-specific privacy and security controls, but Idaho breach-notice and consumer-protection rules can still matter outside HIPAA’s exclusive scope.

FAQ

Does Idaho have a consumer data privacy law like California?

No. Idaho does not currently have a comprehensive consumer data privacy law with access, deletion, correction, opt-out, or profiling rights. The state’s operative privacy framework is the breach-notification statute and the Idaho Consumer Protection Act. [1][2]

Does the Idaho law apply to companies outside Idaho?

There is no Idaho comprehensive privacy statute with an express extraterritorial test, because no such statute exists. However, out-of-state companies can still be subject to Idaho’s breach-notification and consumer-protection rules if they collect, hold, or misrepresent protections for Idaho residents’ personal information. [1][2]

What penalties can Idaho regulators seek for privacy violations?

The Idaho Consumer Protection Act allows civil penalties of up to $5,000 per violation, plus injunctions, restitution, costs, and attorney’s fees. Intentional failure to give breach notice can separately trigger a fine of up to $25,000 per breach. [1][2]

Is there a private right of action under Idaho’s privacy laws?

Idaho’s consumer-protection and breach-notification framework is primarily enforced by the Attorney General rather than through a general privacy-law private right of action. Private litigation may still arise under other legal theories, but Idaho has not enacted a comprehensive consumer privacy statute creating a dedicated private damages claim. [1][2]

Were there 2025 or 2026 amendments that created the ICDPA?

No current Idaho enactment has created a comprehensive “Idaho Consumer Data Protection Act.” As of 6 September 2026, reputable legislative materials and practice summaries still show that Idaho has not adopted a comprehensive consumer privacy law. [1][2]

What should a compliance team do first in Idaho?

Start with breach-response readiness, security controls, and truth-in-marketing review of privacy disclosures. If the organization already complies with ISO 27001 or NIST CSF 2.0, those controls map well to Idaho’s practical requirements even though the state lacks a dedicated privacy-rights statute.

Sources

Put it into practice

More compliance guides