Idaho Site Laws Report: Laws, Updates, and Information That May Affect Your Website and eCommerce

Why Idaho Site Laws Changed in 2026

Idaho has never enacted a comprehensive consumer privacy statute. No privacy bill of the Virginia or Connecticut type advanced in the 2026 session. So Idaho still relies on targeted statutes rather than one umbrella law. Those targeted statutes still reach nearly every website. Several of them are new.

The 2026 session ran from January 12 through April 3, 2026. Lawmakers sent four AI related bills and one social media bill to Governor Brad Little. He signed the chatbot bill on March 31, 2026, and the social media bill next. The result is a patchwork of Idaho site laws. The sections below take each piece in turn.

Senate Bill 1297: The Conversational AI Safety Act

The biggest change to Idaho site laws in 2026 is Senate Bill 1297. The Senate passed the bill 21 to 12 on March 19, 2026. The House passed the bill 54 to 12 on March 27, 2026. Governor Little signed SB 1297 on March 31, 2026. The law took effect July 1, 2026.

The law reaches further than most state chatbot laws. Operators of publicly accessible conversational AI services are covered. That includes customer service chatbots, website assistants, and voice agents. Internal developer tools and basic voice assistants for timers or music are exempt. Unlike Georgia and Hawaii, Idaho does not limit coverage to companion style bots.

If a user could reasonably believe a human is talking, you must disclose the AI. Operators must adopt protocols that direct users expressing suicidal thoughts to crisis services. You may not claim or imply that the AI provides licensed mental health care. When you know or have reasonable certainty that a user is a minor, stricter rules apply. A visible disclosure must appear at session start and at least every three hours.

For minors, operators may not use gamification features designed to increase engagement. Operators must block sexually explicit content and provide parental supervision tools. Those tools must cover screen time, privacy settings, and notifications. Violations carry $1,000 per violation, capped at $500,000 per operator, or actual damages. Courts may also issue injunctions, and the law includes a private right of action.

For a small business site, this law reaches your chatbot today. A simple order tracking bot needs a clear AI disclosure at minimum. Any bot that could encounter a teenager needs the three hour reminders. Because Colorado, Connecticut, and Georgia rules arrive in 2027, building compliance now serves several states. Idaho gives you no waiting period.

House Bill 542: The Stop Addictive Social Media Act

The second new law is House Bill 542, the Stop Addictive Social Media Act. The House passed the bill 62 to 7 on February 9, 2026. The Senate passed an amended version 21 to 14 on March 20, 2026. Governor Little signed the bill on April 1, 2026, and the law took effect July 1. NetChoice asked the governor to veto the bill, citing digital ID and surveillance concerns.

The law applies to social media platforms with at least $1 billion in annual advertising revenue. Covered platforms must obtain verifiable parental consent before users under 16 create accounts. Default privacy settings for minors must sit at the highest level. Platforms must disable addictive features for minors, including autoplay and infinite scrolling. Targeted advertising to minors is prohibited.

The age estimation rule is unusual. Platforms must estimate age after 25, 50, and 100 hours of use. An account counts as a minor’s unless the platform shows 80 percent confidence otherwise. The law includes a private right of action for emotional distress from negligent implementation. Similar laws in Utah, Arkansas, and Georgia were blocked in court.

Most small business sites fall far below the $1 billion revenue threshold. Still, the law signals where Idaho site laws are heading. A community forum or app popular with teens should watch for litigation. As of this update, no injunction has been reported. That could change quickly.

House Bill 498: Age Verification for Adult Content

Idaho joined the age verification wave in 2024. House Bill 498 was signed in April 2024 and took effect July 1, 2024. The law appears at Idaho Code section 18-1520. Any commercial site that publishes material harmful to minors must verify that users are adults. The rule applies when one third or more of the site’s content is harmful to minors.

Verification may use a government ID or a commercial age verification system. Sites may not retain identifying information after access is granted. Parents may sue on behalf of minors who access the material. The Attorney General may also seek civil penalties. A typical business, portfolio, or eCommerce site falls well below the one third threshold.

Breach Notification Under Idaho Code 28-51-105

The breach notification statute is one of the older Idaho site laws. The law appears at Idaho Code sections 28-51-104 through 28-51-107. The statute applies to any commercial entity doing business in Idaho that holds computerized personal information. Personal information means a name combined with a Social Security number or driver’s license number. Account numbers with access codes also qualify.

After a breach of unencrypted data, you must investigate promptly to determine misuse. If misuse has occurred or is reasonably likely, you must notify affected residents. Notice must go out in the most expedient time possible and without unreasonable delay. You may delay only at a law enforcement request. Notice may go by mail, telephone, or email.

Idaho does not require private businesses to notify the Attorney General. Government agencies must notify the Attorney General within 24 hours. A business that fails to give required notice faces a fine of up to $25,000. The Attorney General enforces the statute. A written breach plan remains the sensible default, and a multistate plan should include regulator notice.

The Idaho Consumer Protection Act and Your Online Store

Idaho polices advertising through the Idaho Consumer Protection Act at Idaho Code section 48-601. The Act prohibits unfair or deceptive acts in trade or commerce. Idaho courts look to Federal Trade Commission interpretations for guidance. That makes federal advertising standards part of Idaho site laws. The Attorney General enforces the Act with civil penalties of up to $5,000 per violation.

For your site, this is the law behind the everyday rules. Reference prices that were never charged create exposure. Timers that reset on every visit create exposure. Subscription trials that convert without clear disclosure create exposure. Hidden fees and staff written testimonials do the same.

Consumers may recover actual damages or $1,000, whichever is greater, plus attorney fees. Idaho also added a telephone solicitation chapter that covers marketing texts. Prior consent is required before automated marketing texts to Idaho numbers. Treating every product page as regulated advertising keeps you clear of complaints. Reviewing text consent language does the same.

Idaho Site Laws for eCommerce: Sales and Use Tax

Idaho imposes a state sales tax of 6 percent. A few resort cities and auditorium districts add small local option taxes. Following the 2018 Wayfair decision, Idaho enacted House Bill 259, effective June 1, 2019. Remote sellers must register once Idaho sales exceed $100,000 in the current or previous calendar year. Idaho has no transaction count test.

The same law made marketplace facilitators responsible for collecting on facilitated sales. Those marketplace sales do not count toward your own threshold. Idaho uses destination sourcing for remote sellers. Registration runs through the State Tax Commission at no charge. Once registered, you charge the rate for the customer’s delivery address.

Digital goods present a wrinkle. Idaho taxes digital music, books, and videos when the buyer gains permanent use rights. Subscriptions and streaming with only temporary access are exempt. Remotely accessed software is also exempt. Check your product categories against Commission guidance instead of trusting default platform settings.

What You Should Do Now

You do not need a compliance department to satisfy Idaho site laws. You do need a short list of concrete tasks. Each step below addresses a rule already in force. Each also positions you well if a privacy bill arrives in 2027.

1. Add a clear AI disclosure to every chatbot and voice agent today, plus crisis protocols and three hour reminders for minors.
2. Map every place you store personal information, confirm encryption, and write a breach plan that reaches residents quickly.
3. Review pricing displays, subscription flows, reviews, and text consent against the Consumer Protection Act.
4. Total your direct Idaho sales against the $100,000 threshold and register with the State Tax Commission if needed.
5. If your site hosts user profiles or uploads, review the HB 542 and HB 498 thresholds and document why they do not apply.

Once those tasks are done, you will be current on the Idaho site laws covered here. Put two dates on your calendar. Watch for any court challenge to HB 542. Then mark January 2027, when the next session opens. Idaho laws usually take effect July 1, which gives you a predictable window each summer.

Key Takeaways

• SB 1297, the Conversational AI Safety Act, took effect July 1, 2026, and covers ordinary customer service chatbots.
• HB 542, the Stop Addictive Social Media Act, took effect July 1, 2026, for platforms with $1 billion in ad revenue.
• HB 498 has required age verification on adult content sites since July 1, 2024.
• Breach notices are due without unreasonable delay, with a $25,000 fine for failing to notify.
• Remote sellers collect Idaho sales tax after $100,000 in sales, with no transaction count test.

Frequently Asked Questions About Idaho Site Laws

Does Idaho have a privacy law like California’s CCPA?

No. Idaho has never enacted a comprehensive consumer privacy statute. No such bill advanced in 2026. Idaho relies on the breach statute, the Consumer Protection Act, and the new online safety laws. Federal law fills the remaining gaps.

Do Idaho site laws apply to my business if I am located in another state?

Yes, in most cases. SB 1297 reaches any publicly accessible chatbot offered to Idaho users. The breach statute covers anyone holding Idaho residents’ data. The Consumer Protection Act covers sales to Idaho consumers. Sales tax rules apply once your Idaho sales exceed $100,000.

Do Idaho site laws require age verification on my website?

Only in two situations. Sites with one third or more harmful content must verify adult users under HB 498. Social media platforms with $1 billion in ad revenue must estimate age under HB 542. A typical business site meets neither test. Federal COPPA rules still apply if your site targets children under 13.

How quickly must I report a data breach in Idaho?

You must notify affected residents in the most expedient time possible and without unreasonable delay. Private businesses do not notify the Attorney General. Failing to give required notice carries a fine of up to $25,000 per breach.

Do Idaho site laws require me to disclose AI chatbots on my website?

Yes, since July 1, 2026. SB 1297 requires disclosure whenever a user could reasonably believe a human is talking. Known minors must see the disclosure at session start and every three hours. Crisis protocols and parental tools are also required.

Conclusion

Idaho site laws in 2026 reward the owner who reads effective dates rather than assumptions. SB 1297 brought chatbot rules into force on July 1, 2026, reaching ordinary customer service bots. HB 542 targets billion dollar platforms but signals the direction of travel. HB 498 confines age verification to adult content sites. The breach statute and the Consumer Protection Act reach nearly every online seller.

No privacy bill advanced in 2026, but the new safety laws show an active Legislature. Finish the five tasks above this fall. You will meet every current requirement while staying ready for the next session.

Take the Next Step

Staying compliant does not require a law degree. You do need a reliable place to check the rules as they change. Bookmark this report and review your chatbot, breach plan, and tax registration before 2027. If you want a second set of eyes, ask a website professional or an Idaho attorney. A short review today costs far less than a $1,000 per violation chatbot claim tomorrow.

Updates

NEWEST UPDATE

10/17/2026: Conversational AI Safety Act (SB 1297)

Status: Enacted

A material correction affects Idaho chatbot compliance. The Conversational AI Safety Act, SB 1297, was enacted on March 31, 2026, but its operative date is July 1, 2027, not July 1, 2026. Its AI-disclosure, suicide-response, and minor-account-holder provisions therefore are not yet effective. When the law takes effect, its coverage depends on the statutory definition of a public conversational AI service; the enacted text excludes, among other things, tools designed to provide outputs on a narrow and discrete topic and certain features within a non-conversational application. Enforcement is through Attorney General-sought civil penalties and injunctions; the statute expressly does not create a private right of action. Also, Idaho’s adult-content age-verification law is Title 6, Chapter 38, not Idaho Code section 18-1520; it provides private civil enforcement and bars state enforcement.

Sources: Official or supporting source | Official or supporting source | Official or supporting source | Official or supporting source | Official or supporting source

PRIOR UPDATE

10/01/2026: Conversational AI Safety Act (SB 1297)

Status: Enacted

Idaho’s Conversational AI Safety Act, enacted as SB 1297, is not currently effective. The statute takes effect on July 1, 2027, not July 1, 2026. It therefore does not presently impose the AI-disclosure, crisis-response, minor-protection, or parental-tool requirements described for covered conversational AI services. The enacted definition also excludes a chatbot used only for customer service, along with specified business-facing, internal, narrow-topic, developer, and voice-assistant tools. When the law becomes effective, civil penalties and injunctions may be sought by the Idaho Attorney General; the statute expressly does not create a private right of action. Idaho’s separate Stop Harms from Addictive Social Media Act (HB 542) remains effective as of July 1, 2026 for qualifying large social-media platforms.

Sources: Official or supporting source | Official or supporting source | Official or supporting source | Official or supporting source