Adds to existing law to establish provisions regarding the capture or use of biometric identifiers.

LEGISLATURE OF THE STATE OF IDAHO Sixty-eighth Legislature Second Regular Session - 2026 IN THE HOUSE OF REPRESENTATIVES HOUSE BILL NO. 744 BY WAYS AND MEANS COMMITTEE AN ACT1 RELATING TO BIOMETRIC IDENTIFIERS; AMENDING TITLE 48, IDAHO CODE, BY THE2 ADDITION OF A NEW CHAPTER 21, TITLE 48, IDAHO CODE, TO ESTABLISH PRO-3 VISIONS REGARDING THE CAPTURE OR USE OF BIOMETRIC IDENTIFIERS; AND4 DECLARING AN EMERGENCY AND PROVIDING AN EFFECTIVE DATE.5

Be It Enacted by the Legislature of the State of Idaho:6

SECTION 1. That Title 48, Idaho Code, be, and the same is hereby amended7 by the addition thereto of a NEW CHAPTER, to be known and designated as Chap-8 ter 21, Title 48, Idaho Code, and to read as follows:9 CHAPTER 2110 CAPTURE OR USE OF BIOMETRIC IDENTIFIERS11 48-2101. CAPTURE OR USE OF BIOMETRIC IDENTIFIERS. (1) As used in this12 section:13 (a) "Artificial intelligence" means any machine-based system that, for14 any explicit or implicit objective, infers from the inputs the system15 receives how to generate outputs, including content, decisions, pre-16 dictions, or recommendations, that can influence physical or virtual17 environments.18 (b) "Biometric identifier" means a retina or iris scan, fingerprint,19 voiceprint, or record of hand or face geometry.20 (2)(a) A person may not capture a biometric identifier of an individual21 for a commercial purpose unless the person:22 (i) Informs the individual before capturing the biometric iden-23 tifier; and24 (ii) Receives the individual's consent to capture the biometric25 identifier.26 (b) For the purposes of this subsection, an individual has not been in-27 formed of and has not provided consent for the capture or storage of a28 biometric identifier for a commercial purpose based solely on the ex-29 istence of an image or other media containing one (1) or more biometric30 identifiers of the individual on the internet or other publicly avail-31 able source unless the image or other media was made publicly available32 by the individual to whom the biometric identifiers relate.33 (3) Persons or entities possessing a biometric identifier of an indi-34 vidual that is captured for a commercial purpose:35 (a) May not sell, lease, or otherwise disclose the biometric identifier36 to another person unless:37 (i) The individual consents to the disclosure for identification38 purposes in the event of the individual's disappearance or death;39 (ii) The disclosure completes a financial transaction that the40 individual requested or authorized;41

2 (iii) The disclosure is required or permitted by state or federal1 law; or2 (iv) The disclosure is made by or to a law enforcement agency for a3 law enforcement purpose in response to a warrant;4 (b) Shall store, transmit, and protect from disclosure the biometric5 identifier using reasonable care and in a manner that is the same as or6 more protective than the manner in which the person stores, transmits,7 and protects any other confidential information the person possesses;8 (c) Shall destroy the biometric identifier within a reasonable time,9 but no later than the first anniversary of the date the purpose for col-10 lecting the identifier expires, except as provided by subsection (4) of11 this section; and12 (d) Shall provide a method for an individual to revoke consent to the13 storage and transmission of a biometric identifier at any time and shall14 immediately destroy the biometric identifier upon receiving a revoca-15 tion of consent unless maintaining the biometric identifier is required16 by another law.17 (4) If a biometric identifier captured for a commercial purpose is used18 in connection with an instrument or document that is required by another law19 to be maintained for a period longer than the period prescribed by subsec-20 tion (3)(c) of this section, the person who possesses the biometric identi-21 fier shall destroy the biometric identifier within a reasonable time, but no22 later than the first anniversary of the date the instrument or document is no23 longer required to be maintained by law.24 (5) If a biometric identifier captured for a commercial purpose has25 been collected for security purposes by an employer, the purpose for col-26 lecting the identifier pursuant to subsection (3)(c) of this section is27 presumed to expire on termination of the employment relationship.28 (6) A person who violates the provisions of this section is subject to29 a civil penalty of not to exceed twenty-five thousand dollars ($25,000) for30 each violation. The attorney general may bring an action to recover civil31 penalties pursuant to this subsection.32 (7) The provisions of this section do not apply to:33 (a) Voiceprint data retained by a financial institution or an affili-34 ate of a financial institution, as those terms are defined by 15 U.S.C.35 6809;36 (b) The processing or storage of biometric identifiers involved in37 the developing, training, evaluating, disseminating, or otherwise of-38 fering of artificial intelligence models or systems, unless a system39 is used or deployed for the purpose of uniquely identifying a specific40 individual; or41 (c) The development or deployment of an artificial intelligence model42 or system for the purposes of:43 (i) Preventing, detecting, protecting against, or responding to44 security incidents, identity theft, fraud, harassment, malicious45 or deceptive activities, or any other illegal activity;46 (ii) Preserving the integrity or security of a system; or47 (iii) Investigating, reporting, or prosecuting a person responsi-48 ble for a security incident, identity theft, fraud, harassment, a49 malicious or deceptive activity, or any other illegal activity.50

3 (8) If a biometric identifier captured for the purpose of training an1 artificial intelligence system is subsequently used for a commercial pur-2 pose not described by subsection (7) of this section, the person possessing3 the biometric identifier is subject to:4 (a) The provisions of this section regarding the possession and de-5 struction of a biometric identifier; and6 (b) The penalties associated with a violation of this section.7

SECTION 2. An emergency existing therefor, which emergency is hereby8 declared to exist, this act shall be in full force and effect on and after9 July 1, 2026.10