Wyoming Privacy Law

Wyoming has no comprehensive consumer privacy statute, but the claim that it has enacted nothing has not been true since March 6, 2026, when the Governor signed Senate Enrolled Act 32 creating W.S. 9-21-201 and 9-21-202. That article bars a government entity from purchasing, selling, trading or transferring personal data without express written consent, and gives current and former residents a right to obtain a copy of their own data and to file an objection to its accuracy, retention or dissemination that the entity must resolve within sixty days. The breach statute takes an equally particular route: rather than listing data elements of its own, W.S. 40-12-501(a)(vii) imports twelve of them from the criminal identity-theft statute, including a tribal identification card, security tokens used for data-based authentication and a birth or marriage certificate. It sets no fixed clock, but it does require a good-faith investigation before the duty to notify is even assessed, and it dictates seven things every notice must contain.

Sector-Specific Privacy Laws in Wyoming

Data Privacy — Government Entities (W.S. 9-21-201 and 9-21-202)

Senate File 20 of the 2026 budget session, sponsored by the Select Committee on Blockchain, Financial Technology and Digital Innovation Technology, was enrolled as Senate Enrolled Act 32, assigned Chapter 48, and signed and effective on March 6, 2026. Section 9-21-202(a) provides that no government entity shall purchase, sell, trade or transfer personal data without the express written consent of the natural person the data references, subject to four exceptions: transfer to another government entity that itself complies with the article; transfer to a contracted non-government entity providing or assisting with a government service, where the contract must include protections consistent with the article, the data must be returned or destroyed once no longer necessary, and the contractor may not maintain, sell, transfer, process or otherwise use it except as necessary to provide the service; a case-by-case exception publicly approved in writing by the elected governing person or body with authority over the entity, for a term not exceeding two years per petition; and transfers permitted under HIPAA or FERPA. Subsection (b) lets any current or former Wyoming resident or their legally authorized representative request a copy of their personal data from any government entity holding it, at a fee consistent with the Wyoming Public Records Act. Subsection (c) creates a sixty-day objection process covering accuracy, completeness, pertinence, timeliness, relevance, retention, dissemination or denial of access, requiring the entity to verify identity, review the objection, and either alter, delete or grant access to the data or allow the resident to file a statement of their views alongside it, with written notice of the decision either way. The article excludes the judicial branch and law enforcement agencies from the definition of government entity, and subsection (d) subordinates it to conflicting state or federal law and to the Public Records Act.

Age Verification for Websites with Obscene Material (W.S. 14-3-501 to 14-3-505)

House Bill 43 of the 2025 general session, sponsored by Representative Lawley, was enrolled as House Enrolled Act 70, assigned Chapter 139, signed March 13, 2025 and effective July 1, 2025. Section 14-3-502(a) requires a covered platform — an entity operating a website that in the regular course of business creates, hosts or makes available material harmful to minors for purposes of making a profit, whether or not it actually profits and whether or not that is its principal business — to perform reasonable age verification on all persons accessing or attempting to access the material and to prevent access by minors. Subsection (b) then forbids the platform or any third party performing the verification from retaining any identifying information of the person after access has been granted. Section 14-3-501(a)(ix) lists the accepted verification methods, including a Wyoming driver’s licence or identification card, a United States passport or military card, a tribal identification card, another state’s licence or identification card, a credit or debit card that requires the account holder to be eighteen, and any other reliable and accurate means. Enforcement is entirely private: section 14-3-503(a) gives a parent or guardian a cause of action on the minor’s behalf, subsection (b) gives any person a claim for the knowing retention of their identifying information, subsections (c) and (d) provide damages plus court costs and reasonable attorney fees, and subsection (e) adds statutory damages of $5,000 for each instance of failure to perform age verification, with each failure a separate violation. Subsections (f) and (g) state that an action may be brought regardless of whether another court has declared any provision of the article unconstitutional unless that decision binds the court hearing the action, and that no covered platform may assert the outcome of previous litigation involving other parties as a bar.

Wyoming Consumer Protection Act (W.S. 40-12-101 to 40-12-114)

Section 40-12-105(a) makes a deceptive trade practice unlawful only where the person acts “knowingly”, in the course of his business and in connection with a consumer transaction. Section 40-12-106 supplies the injunction action by the enforcing authority, and section 40-12-107 the assurance of voluntary compliance. Section 40-12-113(c) sets the general civil penalty at not more than $10,000 for each wilful violation, defining a wilful violation as one where the person knew or should have known the conduct was unfair or deceptive; the enforcing authority may terminate an investigation or action on agreement to a stipulated penalty, and may waive the penalty where the person has already made full restitution, and is entitled to reasonable attorney’s fees and costs where penalties are assessed. Section 40-12-113(a) adds a separate $5,000 penalty for violating a permanent injunction. Section 40-12-111 raises the ceiling to $15,000 per violation, plus mandatory restitution and fees, where the wilful violation victimises or attempts to victimise an older person — defined as a person over sixty — or a person with disabilities. The private route in section 40-12-108 requires reliance on an “uncured” unlawful deceptive trade practice, and section 40-12-109 makes that a real prerequisite: the consumer must give the alleged violator written notice stating fully the nature of the practice and the actual damage suffered, within one year after initial discovery or two years following the transaction whichever occurs first, and must file within one year after furnishing that notice. Class actions are permitted under section 40-12-108(b) with a fee award tied to time reasonably expended rather than to the size of the judgment.

Theft of identity and electronic impersonation (W.S. 6-3-901 and 6-3-902)

Section 6-3-901(b) is the list the breach statute borrows from. It defines personal identifying information as the name or any of fourteen data elements: address; telephone number; Social Security number; driver’s licence number; an account, credit card or debit card number with the security code, access code or password allowing access to a financial account; a tribal identification card; a federal or state government issued identification card; shared secrets or security tokens known to be used for data based authentication; a username or email address with a password or security question and answer permitting access to an online account; a birth or marriage certificate; medical information; health insurance information; unique biometric data, meaning data generated from measurements or analysis of human body characteristics for authentication purposes; and an individual taxpayer identification number. Theft of identity is a misdemeanour where no economic benefit or a benefit under $1,000 was gained or attempted, and a felony punishable by up to ten years where $1,000 or more was gained or attempted. Section 6-3-902 makes it a misdemeanour to knowingly and without consent impersonate another person, or that person’s personal or organizational digital identity, through or on an internet website or by other electronic means including spoofing, where the person causes or attempts harm, harasses, or uses false self-identifying information as an unauthorized deceptive means to facilitate contact with another person. Subsection (c) gives a person who suffers damage or loss a civil action for compensatory damages and injunctive or other equitable relief. The digital identity terms come from W.S. 8-1-102(a)(xviii) and (xix), which define a personal digital identity as the intangible digital representation of, by and for a natural person over which he has principal authority and through which he intentionally communicates or acts.

Data Breach Notification in Wyoming

Section 40-12-502(a) does something few breach statutes do: it makes an investigation a condition precedent. An individual or commercial entity conducting business in Wyoming that owns or licenses computerized data including personal identifying information about a Wyoming resident must, on becoming aware of a breach, conduct in good faith a reasonable and prompt investigation to determine the likelihood that the information has been or will be misused; only if that investigation determines misuse has occurred or is reasonably likely to occur does the duty to notify arise, and notice is then due as soon as possible, in the most expedient time possible and without unreasonable delay. Section 40-12-501(a)(vii) defines personal identifying information as a first name or initial and last name combined with one or more of the data elements in W.S. 6-3-901(b)(iii) through (xiv) — twelve elements running from a Social Security number through a tribal identification card, shared secrets or security tokens, an online account credential, a birth or marriage certificate, medical and health insurance information, unique biometric data and an individual taxpayer identification number. Substitute notice thresholds in subsection (d)(iii) are split by where the business is based: notice cost above $10,000 or an affected class above 10,000 for Wyoming-based persons and businesses, against $250,000 or 500,000 for all other businesses operating but not based in Wyoming. Subsection (e) requires every notice to be clear and conspicuous and to carry seven items: a toll-free number for the person collecting the data and from which the individual may learn the contact details for the major credit reporting agencies; the types of information involved; a general description of the incident; the approximate date of the breach if reasonably determinable; in general terms the actions taken to protect the system from further breaches; advice to remain vigilant by reviewing account statements and monitoring credit reports; and whether notification was delayed because of a law enforcement investigation. Subsection (f) lets the Attorney General bring an action in law or equity to address any violation, to recover damages, or both.

Residents must be notified as soon as possible after an investigation determines misuse has occurred or is reasonably likely, in the most expedient time possible and without unreasonable delay; no fixed number of days. No Attorney General notification requirement for private businesses; the Attorney General may bring an action for any violation. Complaints are taken by the Wyoming Attorney General, which enforces the statute.

How Wyoming Enforces Its Privacy Laws

The Attorney General’s breach authority is broad but unstructured. Section 40-12-502(f) gives the Attorney General a single sentence of authority: an action in law or equity to address any violation of the section and for other relief that may be appropriate to ensure proper compliance, to recover damages, or both. There is no penalty schedule attached to the breach statute, no per-record fine and no reporting threshold that brings the office in automatically. The same subsection states that its provisions are not exclusive and do not relieve an individual or commercial entity from compliance with all other applicable provisions of law.

Consumer Protection Act penalties can be stipulated or waived. Section 40-12-113(c) gives the enforcing authority two paths short of judgment: it may terminate any investigation or action on the person’s agreement to pay a stipulated civil penalty, and it or the court may waive the penalty entirely where the person has previously made full restitution or reimbursement or paid actual damages to the injured consumers. Section 40-12-107 separately allows an assurance of voluntary compliance. Where penalties are assessed in litigation, the enforcing authority is entitled to reasonable attorney’s fees and costs.

Recent Enforcement in Wyoming

Uber Technologies, Inc. — delayed breach reporting, Attorney General Docket No. 190-490. The Wyoming Attorney General, with the other forty-nine states and the District of Columbia, settled with Uber Technologies over the company’s year-long delay in reporting a breach to affected drivers. The office’s account is that Uber learned in November 2016 that hackers had accessed personal information about its drivers, including driver’s licence information for approximately 600,000 drivers nationwide and a small number of drivers in Wyoming; that Uber tracked down the hackers and obtained assurances the information had been deleted; and that although the driver’s licence numbers involved triggered Wyoming law requiring notice to affected residents, the company did not report until November 2017. The settlement requires the company to comply with Wyoming data breach and consumer protection law in protecting Wyomingites’ personal information and notifying them of a breach, and to strengthen its corporate governance and data security practices. Uber agreed to pay $148 million to the states, of which Wyoming received a little over $570,000. The case is the clearest illustration of the statute’s reach, because it turned on driver’s licence numbers, one of the twelve elements W.S. 40-12-501(a)(vii) imports.

Equifax Inc. — 2017 breach, Attorney General Docket No. 191-855. Wyoming joined a coalition of fifty attorneys general in settling with Equifax over the 2017 breach affecting more than 147 million Americans, in which Social Security numbers, names, dates of birth, addresses, credit card numbers and in some cases driver’s licence numbers were exposed. The states alleged the breach occurred because Equifax failed to implement an adequate security program. The office summarises the settlement terms as ten years of free credit monitoring for affected consumers, free identity theft restoration services for all affected consumers, strengthened data security practices, a $175 million payment to the states of which $1 million went to Wyoming, and a consumer settlement fund of $300 million with the possibility of a further $125 million, from which consumers could seek reimbursement for time spent recovering from identity theft at $25 an hour up to twenty hours, out-of-pocket costs, and up to $125 for credit monitoring purchased instead of accepting the offered ten free years.

Pending Privacy Legislation

Wyoming’s government data privacy article took two sessions to pass. Senate File 65 of the 2025 general session, sponsored by the Select Committee on Blockchain, Financial Technology and Digital Innovation Technology and carrying the same title and substantially the same text, reached the House but was not considered in Committee of the Whole, with its last recorded action on February 28, 2025. The committee brought the measure back as Senate File 20 of the 2026 budget session, which passed, was enrolled as Senate Enrolled Act 32 and Chapter 48, and was signed and effective on March 6, 2026. The other privacy statute of the last two years, House Bill 43 of 2025 on age verification for websites with material harmful to minors, was signed on March 13, 2025 as Chapter 139 and took effect on July 1, 2025. No comprehensive consumer privacy act of the kind enacted in neighbouring Colorado and Montana has been passed; a Wyoming data privacy act was drafted for the Blockchain committee’s interim work but has not become law.

Federal Privacy Laws That Apply in Wyoming

Federal privacy law applies in Wyoming by sector, whatever the state has enacted: HIPAA to health information, the Gramm-Leach-Bliley Act to financial institutions, FERPA to student education records, the Fair Credit Reporting Act to consumer reports, COPPA to children under 13, and Section 5 of the FTC Act to privacy claims that do not match practice.

The state-law counterpart to section 5 is the Wyoming Consumer Protection Act (W.S. 40-12-101 to 40-12-114), which the Wyoming Attorney General enforces against businesses whose stated data practices differ from their actual ones.

Industry Rules That Reach Wyoming Businesses

With no comprehensive state statute, most privacy obligations on a Wyoming business arrive through its industry: healthcare, financial services, online services, retail, employment and education. Each is covered in its own guide.

Two of those reach Wyoming businesses regardless of industry. A company serving residents of states that have enacted comprehensive laws can owe duties under those laws while Wyoming itself has none, and any business holding personal information about Wyoming residents is subject to the state’s breach-notification statute described above.

Wyoming Privacy Law FAQ