Ask Reggi Your Question Now
Can I use third-party email marketing tools that collect personal information in Idaho? What are the requirements?
Requirements for Using Third-Party Email Marketing Tools in Idaho
If you are using third-party email marketing tools that collect personal information in Idaho, you must comply with the requirements of the Gramm-Leach-Bliley Act (GLBA) and the Idaho Code.
Under IDAPA 18.01.01.450, the opt-out requirements in Sections 250, 251, and 400 of the Idaho Code do not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee provides the initial notice in accordance with Section 100 and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information.
However, IDAPA 18.01.01.400 states that a licensee will not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless the licensee has provided the consumer with an initial notice as prescribed under Section 100, an opt-out notice as prescribed in Sections 250 and 251, and a reasonable opportunity to opt out of the disclosure before it discloses the information to the nonaffiliated third party. If a consumer opts out, the licensee cannot disclose nonpublic personal financial information about that consumer to a nonaffiliated third party, other than as permitted by Sections 450, 451, and 452.
Therefore, if you are using third-party email marketing tools that collect personal information in Idaho, you must provide consumers with an initial notice, an opt-out notice, and a reasonable opportunity to opt out of the disclosure before disclosing any nonpublic personal financial information to the third party. Additionally, you must enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information.
Jurisdiction
Idaho