Latest update · 28 September 2026
Lead Signal
Idaho enacted two sector-specific privacy and surveillance-adjacent statutes this cycle, both taking effect July 1, 2026, despite the state having no comprehensive consumer data-privacy law on its books. The more sweeping of the two for the online-platform sector is the Stop Harms from Addictive Social Media Act (HB542, enacted as Chapter 268), which requires large social-media platforms to implement age-estimation methods -- with the confidence level required scaling upward the longer a user spends on the platform -- to obtain verifiable parental consent before granting an account to a user aged 15 or younger, and to disable specified addictive design features for those accounts. This is a material, enforceable obligation aimed squarely at platforms serving minors, layered onto a state that otherwise has no general data-subject-rights or lawful-processing regime to draw on.
Running alongside it is Idaho Code §67-2364, enacted via Senate Bill 1299, which prohibits government entities from requiring digital identification and from compelling an individual to surrender or unlock a personal electronic device for identity-verification purposes. The final enacted version replaced the bill's original statutory-damages and civil-penalty provisions with an Attorney General enforcement mechanism triggered only after written notice and a 15-day cure period -- a materially softer compliance posture than the bill originally contemplated, and one that shifts the practical bite of the law toward negotiated compliance rather than automatic liability.
Other Developments
Both new laws land on top of a jurisdiction that continues to lack a comprehensive privacy statute; the state's only cross-cutting enforcement tool for data practices generally remains the general Idaho Consumer Protection Act, applied by the Attorney General. That baseline architecture was not itself altered this cycle and is not re-narrated here, but it is the backdrop against which both SB1299 and HB542 should be read: each is a narrow, sector- or actor-specific carve-out rather than a component of a broader privacy code.
Cross-Monitor Connections
The digital-ID limitation under SB1299 touches on government use of identity-verification tooling and device-unlock demands; readers tracking financial-sector KYC/identity-verification obligations in Idaho should note this as a boundary condition on government-mandated digital-ID use, though the crypto and world-payments monitors carry any sector-specific identity-verification analysis directly and this brief does not extend into that territory.
Outlook
Both laws take effect July 1, 2026, and the near-term question for each is less about their text than about their durability. The SHASM Act's age-estimation and parental-consent mandates for social-media platforms sit squarely in the path of the First Amendment and dormant-commerce-clause challenges that have met comparable statutes in other states, and platform-side opposition reported around the bill signals litigation risk before or shortly after the effective date. SB1299's digital-ID prohibition, by contrast, faces a lower litigation profile given its narrower government-entity scope and its softened AG-enforcement-with-cure-period mechanism, but its practical reach -- including whether it touches any state digital-identity-adjacent tooling used in financial-sector identity verification -- remains untested. Idaho's overall trajectory this cycle is toward tightening in these two specific corridors even as its general privacy-law gap persists.
Standing brief · as of 23 August 2026
Written before the update above. Where they differ, the update is the more recent position.
Lead Signal
Idaho enacted the Stop Harms from Addictive Social Media Act, signed April 2, 2026 and effective July 1, 2026, creating a new Idaho Code Title 48, Chapter 21. Covered social-media platforms must estimate the age of account holders and identify users under sixteen using specified triggers, including interest-based behavioral signals rather than solely document-based verification, and must obtain verifiable parental consent before establishing or continuing an account for a user under sixteen, alongside offering parents password-protected monitoring and time-limit controls. Covered platforms may not present addictive interface features in the display or feed shown to a child account holder, and the Act prohibits profile-based paid commercial advertising directed at children's covered-platform accounts. SHASM positions Idaho among the first states to enact binding minors' social-media age-verification and parental-consent law, notwithstanding the continued absence of a comprehensive omnibus privacy statute.
Other Developments
SHASM's age-verification mechanism itself is a contested implementation detail: it relies on interest-based behavioral inference from usage data rather than traditional document verification, and a state-policy critique warns the design could require logging minute-by-minute activity tied to verified identities. This raises unresolved profiling and data-collection questions distinct from the statute's stated child-safety purpose, and the profiling dimension sits alongside the marketing-restriction dimension as a second live implementation thread this cycle. On enforcement, the Act provides for remedies and enforcement under the new Chapter 21 framework, though the scope of any private right of action, as opposed to Attorney General-only enforcement, was not independently verified against the full statutory text this cycle.
Cross-Monitor Connections
SHASM's behavioral-inference age-estimation mechanism and its addictive-interface-design prohibitions overlap with themes the artificial-intelligence monitor tracks under algorithmic profiling governance; readers following that monitor will see the same underlying mechanism assessed for its automated-inference characteristics rather than its data-protection consequence. The advertising-restriction dimension of SHASM also intersects with commercial-privacy themes the advennt and crypto monitors do not independently cover for this jurisdiction this cycle.
Outlook
The principal open question is how SHASM's Chapter 21 enforcement and redress mechanism operates in practice, particularly whether affected minors or parents hold a private right of action or whether enforcement runs solely through the Attorney General; full statutory text was not independently verified this cycle. A second open question is whether the interest-based age-estimation mechanism is implemented in a way that avoids the minute-by-minute behavioral logging state-policy critics have warned against. Both questions are likely to sharpen as the July 1, 2026 effective date is tested in practice.