Idaho Consumer Data Protection Act (ICDPA)

The Idaho Consumer Data Protection Act (ICDPA) establishes consumer rights over personal data, including access, correction, and deletion, and requires businesses to implement security measures to protect consumer data.

JurisdictionIdaho
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

I apologize, but I do not have enough accurate information to provide a comprehensive analysis of the Idaho Consumer Data Protection Act (ICDPA) with the level of detail and sourcing you requested. The search results do not contain sufficient authoritative information about an Idaho Consumer Data Protection Act to construct a reliable analysis meeting your specifications.

The search results primarily discuss privacy laws in other states, with only limited mentions of Idaho's data breach notification law. There does not appear to be a comprehensive Idaho Consumer Data Protection Act referenced in the provided information.

To provide an accurate and well-sourced analysis as requested, I would need access to official Idaho government sources and regulatory documents specifically outlining the requirements and provisions of an Idaho Consumer Data Protection Act. Without such authoritative sources, I cannot confidently make claims about the law's key requirements, compliance challenges, implementation practices, updates, related regulations, or industry impacts.

If you have additional authoritative sources about an Idaho Consumer Data Protection Act, I would be happy to analyze those and provide a comprehensive breakdown following your specified format. Alternatively, I could provide an analysis of privacy laws in other states that are more thoroughly covered in the search results, such as Indiana or Montana, if that would be helpful.

Recent developments

  • — Risk‑management and GRC tools profiling Idaho reiterate that **no comprehensive consumer data protection act is yet effective**, meaning that any planned ICDPA‑style regulation is still viewed as prospective; organizations are urged to track legislative developments closely given national trends toward expanding consumer privacy rights.[3] (source)
  • — A 2026‑oriented state‑by‑state U.S. data privacy law tracker explains that only a subset of states have enacted broad consumer data privacy statutes and notes Idaho as a state with **data breach notification but no comprehensive consumer data privacy act**, signaling that an ICDPA‑type regulation remains non‑operative and influencing businesses to treat Idaho largely as a breach‑notification jurisdiction.[10] (source)
  • — The National Conference of State Legislatures’ 2025 consumer privacy bill tracker lists multiple Idaho consumer‑protection/privacy proposals (e.g., H 127 on AI disclosures and S 1111 on digital advertising truth‑in‑sales) that **failed or adjourned**, underscoring legislative interest in privacy without resulting in passage of a comprehensive ICDPA.[8] (source)
  • — Industry guidance pieces for compliance teams advise that companies operating in Idaho should monitor for **potential comprehensive privacy legislation such as an ICDPA**, but until such a law is passed, they should primarily align with general U.S. state privacy best practices and Idaho’s breach‑notification and sector‑specific rules.[2] (source)
  • — A 2025 analysis of Idaho data protection law states that **Idaho does not yet have a comprehensive data privacy law**, and discusses only breach‑notification and student‑data privacy statutes, reinforcing that the ICDPA is, at most, a proposed framework and not an operative regulation as of mid‑2025.[2] (source)
  • — Guidance from the Idaho Attorney General’s Office on **security breach notification obligations** continues to highlight Idaho Code §28‑51‑105 and related provisions, with no reference to an ICDPA‑style comprehensive consumer data protection framework, shaping industry compliance programs around incident reporting rather than broader ICDPA rights.[1] (source)
  • — Commentary on privacy enforcement in Idaho, including the FTC’s Kochava case, frames Idaho as a jurisdiction where **federal and sector‑specific actions fill gaps left by the absence of a state‑level comprehensive consumer privacy law**, suggesting that if an ICDPA is introduced, enforcement expectations will be influenced by these existing federal actions.[5] (source)
  • — Updated industry overviews of Idaho privacy law in spring 2025 note that Idaho still **does not have a comprehensive consumer data privacy statute in effect**, emphasizing that the state’s primary general privacy regime remains its data breach notification law and sector‑specific rules, implying that any ICDPA proposal had not yet been enacted.[3] (source)
  • — Idaho enacted HB 149 creating a **“Consumer Privacy in Mortgage Applications”** section within the Residential Mortgage Practices Act, tightening controls on mortgage trigger leads and treating certain lead‑generation practices as violations of the Idaho Consumer Protection Act; this is a targeted privacy measure but not a broad ICDPA‑style consumer data protection regime.[6] (source)
  • — Multistate privacy legislation trackers in early 2025 reference a proposed **Idaho Consumer Data Protection Act (ICDPA)** as part of a new wave of state consumer data privacy bills, outlining typical rights such as access, deletion, correction, and limits on sale of personal data, but indicating the bill was still in proposal/committee stages at that time.[9] (source)

Read the full guide to Idaho Consumer Data Protection Act (ICDPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates