Wyoming Data Privacy Laws: Breach Notification & Consumer Rights (2026)

Wyoming has no comprehensive consumer privacy law. Residents and businesses rely primarily on the data breach notification statute at Wyo. Stat. 40-12-501, the Genetic Data Privacy Act, and federal laws including HIPAA and GLBA for data protection.

Wyoming has no comprehensive consumer data privacy law as of May 2026. The state protects resident data through a combination of targeted statutes covering data breaches, genetic data, and synthetic imagery, along with federal sector-specific laws that fill the most significant gaps.

The state's core data protection tools are the breach notification statute at Wyo. Stat. 40-12-501 and 40-12-502 (with credit-freeze and identity-theft relief provisions at 40-12-503 through 40-12-509), the Genetic Data Privacy Act at Wyo. Stat. Title 35, Chapter 32, and a new government-sector data policy law enacted in March 2026. A landmark deepfake statute, Enrolled Act 32, takes effect July 1, 2026.

This guide covers every data privacy protection available to Wyoming residents, the compliance obligations facing businesses, and the federal framework that provides the baseline where state law is silent.

Does Wyoming Have a Comprehensive Data Privacy Law?

No. As of May 2026, Wyoming has not enacted a comprehensive consumer data privacy law comparable to the California Consumer Privacy Act, the Colorado Privacy Act, or the Virginia Consumer Data Protection Act.

Wyoming has considered comprehensive legislation on multiple occasions. During the 2024 interim session, the Legislature's Select Committee on Blockchain, Financial Technology and Digital Innovation Technology reviewed a draft Wyoming Data Privacy Act that would have extended broad consumer rights over personal data. That draft did not advance to a floor vote.

In the 2025 general session, the Legislature considered Senate File 0065, a narrower bill limiting its scope to government entities. SF0065 passed the Senate unanimously (31-0) but did not complete the House process before adjournment. The 2026 Budget Session returned to that concept: Senate File 0020 passed both chambers and was signed into law on March 6, 2026 (discussed below in the government data privacy section). Wyoming residents continue to rely on targeted state statutes and federal law for consumer data protection.

Wyoming Data Breach Notification Law (Wyo. Stat. 40-12-501 to 40-12-502)

The foundation of Wyoming's data privacy framework is its breach notification statute, codified at Wyo. Stat. 40-12-501 and 40-12-502, the first two sections of Title 40, Chapter 12, Article 5. Despite covering breach notification, Article 5 is officially captioned "Credit Freeze Reports": its remaining sections, 40-12-503 through 40-12-509, cover security freezes and post-identity-theft relief, a related but separate subject covered later on this page. The Legislature enacted the notification statute in 2007 and significantly expanded it through 2015 amendments.

Who Must Comply

The statute applies to any individual or commercial entity that conducts business in Wyoming and owns or licenses computerized data containing personal identifying information about Wyoming residents. Businesses headquartered outside Wyoming are covered if they hold data on Wyoming residents.

Third-party service providers also have obligations. If a service provider discovers a breach, it must notify the data owner as soon as practicable so the data owner can fulfill notification duties.

What Triggers a Notification

A notification duty arises when there is a "breach of the security of the data system," defined as the unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal identifying information.

Notification is not automatically required for every unauthorized access. The entity must first conduct a good-faith, reasonable, and prompt investigation to determine whether personal identifying information has been or is reasonably likely to be misused. If the investigation concludes that misuse has not occurred and is not reasonably likely, notification is not required.

Good-faith acquisition by an employee or agent for legitimate business purposes is not considered a breach, provided the information is not used for an unauthorized purpose or further unauthorized disclosure.

What Counts as Personal Identifying Information

Under Wyo. Stat. 40-12-501(a)(vii), which cross-references the 12 data elements defined at Wyo. Stat. 6-3-901(b)(iii) through (xiv), protected data consists of an individual's first name or first initial and last name combined with any of the following categories:

1. Social Security number
2. Driver's license number
3. Financial account number, credit card number, or debit card number combined with any security code, access code, or password providing financial account access
4. Tribal identification card number
5. Federal or state government-issued identification number
6. Shared secrets or security tokens used for data-based authentication and identification
7. Username or email address combined with a password or security question and answer permitting access to an online account
8. Birth certificate or marriage certificate
9. Medical information, including medical history, condition, treatment, or diagnosis by a healthcare provider
10. Health insurance information, including policy number, subscriber identification number, or application and claims history
11. Unique biometric data used for authentication purposes
12. Individual taxpayer identification number

Wyoming's definition is notably broad. The inclusion of vital records (birth and marriage certificates), tribal identification cards, and authentication tokens distinguishes it from narrower state definitions that cover only financial and Social Security data.

Notification Timing and Content

The statute requires notification "in the most expedient time possible and without unreasonable delay." Wyoming does not impose a specific day-count deadline, unlike states that require notification within 30, 45, or 72 hours. Law enforcement may request a delay if notification would impede an active criminal investigation; once law enforcement clears the delay, the entity must notify without further delay.

Required notice elements include:

• Toll-free contact numbers for the entity and for the major credit reporting agencies
• Types of personal identifying information involved in the breach
• General description of the breach incident
• Approximate date of the breach, if determinable
• Remedial actions taken to prevent further breaches
• Guidance directing residents to review account statements and monitor credit reports
• Whether notification was delayed at law enforcement's request

Methods of Notification and Substitute Notice

Notification may be made by written notice or by electronic mail notice. The statute lists electronic mail as a standalone method and does not condition it on the individual having previously consented to electronic communications. Substitute notice is permitted when direct notification is prohibitively costly. For Wyoming-based entities, substitute notice is available when costs would exceed $10,000 or when more than 10,000 individuals are affected. For out-of-state entities, the thresholds are $250,000 or 500,000 affected persons.

Substitute notice requires both of the following: conspicuous posting on the entity's website and notification to major statewide media (the notice to media must itself include a toll-free number where an individual can learn whether their data was involved).

Exemptions

Financial institutions complying with federal interagency guidance under the Gramm-Leach-Bliley Act are deemed compliant with Wyoming's notification requirements. HIPAA-covered entities and business associates complying with the HIPAA Privacy and Security Rules and the HITECH Act are also deemed compliant.

Enforcement

The Wyoming Attorney General (currently Keith Kautz, who took office in July 2025 when former AG Bridget Hill was appointed to the Wyoming Supreme Court) has exclusive enforcement authority. The Attorney General may bring an action in law or equity to address violations and recover damages. There is no private right of action under the breach notification statute; residents must file complaints with the Attorney General's office.

Wyoming Government Data Privacy Act (SF0020, Signed March 6, 2026)

Wyoming's newest data privacy law, Senate File 0020, was signed into law on March 6, 2026. This statute applies to state and local government entities, excluding the judicial branch and law enforcement agencies.

Key provisions:

• Government entities must adopt policies for the collection, access, security, and use of personal data.
• Government entities are prohibited from buying, selling, trading, or transferring personal data without explicit written consent, except for transfers between government entities or to contractors providing government services.
• Wyoming residents may request copies of their personal data held by covered government entities and may object to its accuracy, completeness, or handling. Covered entities must respond within 60 days.
• Sample policies will be developed by January 1, 2027, with staggered effective dates for various government entities.

This statute does not create comprehensive consumer rights against private businesses. Its scope is limited to government data handling.

Wyoming Enrolled Act 32: Synthetic Intimate Imagery and Deepfakes (Effective July 1, 2026)

Wyoming's most significant new privacy-related law in the 2026 session is Enrolled Act 32 (HB 102), a broader AI-crimes act that creates five new or amended sections: W.S. 1-1-143 (limited liability immunity for AI developers), 6-1-206 (use of AI is not a defense to a crime), 6-4-307 (synthetic sexual material), 6-4-308 (AI systems built for child pornography), and 6-4-701 (a new felony for AI systems designed to promote self-harm), plus amendments to Wyo. Stat. 6-4-303. The law takes effect July 1, 2026.

The privacy-relevant core of the Act addresses two related harms: nonconsensual synthetic intimate imagery involving adults, and AI-generated or computer-edited child sexual abuse material involving minors. The Act also reaches beyond privacy, into AI-developer liability and a new AI-promoted self-harm felony, covered below.

Under section 6-4-307, it is a felony to knowingly disclose or distribute synthetic intimate imagery (including AI-generated or digitally altered images) of an identifiable person without that person's consent and with intent to harm, harass, intimidate, or coerce. A first offense carries imprisonment of up to 10 years, a fine of up to $10,000, or both, at the court's discretion. A second or subsequent conviction raises the imprisonment cap to 12 years.

Section 6-4-308 makes it a separate felony to knowingly develop or distribute an AI system specifically designed to create, distribute, or promote child pornography, punishable by up to 10 years imprisonment, a fine of up to $10,000, or both. Treating AI-generated child sexual abuse material as equivalent to real child sexual abuse material is accomplished elsewhere in the Act, through amendments to Wyo. Stat. 6-4-303(b) that add using an AI system to generate child pornography and possessing AI-generated child pornography as sexual exploitation of a child offenses, carrying the same felony penalties (5 to 12 years for generation, up to 10 years for possession) as the existing statute.

The law complements the federal TAKE IT DOWN Act and Wyoming's existing nonconsensual intimate image statute at Wyo. Stat. 6-4-306, which covers real (non-synthetic) intimate images. Together, these statutes cover both authentic and AI-generated nonconsensual intimate imagery.

Beyond synthetic imagery, Enrolled Act 32 also creates Wyo. Stat. 6-4-701, a new felony for knowingly developing or distributing an AI system specifically designed to promote self-harm, punishable by up to 10 years imprisonment, a fine of up to $10,000, or both. The Act further adds Wyo. Stat. 6-1-206, stating that using an AI system to commit a crime is not a defense, and Wyo. Stat. 1-1-143, which shields AI developers from civil liability for another person's illegal use of their system unless the system was built with the knowledge or intent that its primary purpose would be illegal activity.

Wyoming Genetic Data Privacy Act (Wyo. Stat. Title 35, Chapter 32)

Wyoming enacted the Genetic Data Privacy Act through House Bill 0086 in 2022. The law took effect July 1, 2022 and is codified at Wyo. Stat. Title 35, Chapter 32.

The statute addresses privacy risks associated with consumer genetic testing services, including DNA ancestry and health testing companies.

Requirements

Businesses must obtain express, informed consent before collecting, using, or disclosing genetic data. Informed consent requires clear notice about the data to be collected and its intended use. Companies must provide transparent disclosures before collection and must implement comprehensive security programs to protect genetic data from unauthorized access or disclosure. Consumers have the right to request deletion of their genetic data when it is no longer needed for the purpose for which it was collected.

Enforcement and Private Right of Action

The Wyoming Attorney General enforces the Genetic Data Privacy Act. Under Wyo. Stat. 35-32-104(c), a person found to have violated the chapter in an action brought by the Attorney General is subject to a civil penalty of $2,500 for each violation, plus actual damages incurred by the consumers on whose behalf the action was brought and the Attorney General's costs and reasonable attorney fees. The penalty is set by statute rather than capped, and it multiplies by each violation. Violations also carry criminal misdemeanor liability of a fine of up to $1,000 per violation under Wyo. Stat. 35-32-104(a). Unlike the breach notification statute, the Genetic Data Privacy Act grants consumers a private right of action, but it is not immediate: before suing, the individual must give the alleged violator written notice of the violation, and the violator has up to 60 days to cure it. Only if the violation is not cured within 60 days may the individual bring a civil action for damages under Wyo. Stat. 35-32-104(b).

HIPAA-covered entities and business associates are exempt from this statute for data they collect as protected health information. Clinical research conducted under applicable federal regulations is also generally exempt.

Wyoming Consumer Protection Act and Data Privacy (Wyo. Stat. 40-12-101 to 40-12-114)

Wyoming's Consumer Protection Act prohibits deceptive trade practices, which provides an additional data privacy enforcement pathway.

A business commits a deceptive trade practice if it makes false or misleading representations about its products, services, or business practices, including data privacy representations. This applies in three common scenarios: a company that publishes a privacy policy promising specific protections but fails to follow them; a company that makes misleading claims about its data security measures or encryption; or a company that fails to disclose material facts about how consumer data is collected, used, or shared.

The Wyoming Attorney General's Consumer Protection and Antitrust Unit investigates and prosecutes violations. The Attorney General can seek injunctive relief, civil penalties, and damages. Consumers also have a limited private right of action, but only when the business knowingly committed an unlawful deceptive trade practice and the plaintiff demonstrates actual harm.

Wyoming Identity Theft and Credit Freeze Protections

Wyoming criminalizes identity theft under Wyo. Stat. 6-3-901, which prohibits unauthorized use of personal identifying information. Penalties depend on economic benefit: if no economic benefit was obtained or the benefit was less than $1,000, the offense is a misdemeanor carrying up to six months imprisonment and a fine of up to $750; if the economic benefit was $1,000 or more, it becomes a felony carrying up to 10 years imprisonment and a fine of up to $10,000. Courts may also order restitution to victims for costs of clearing their credit history.

Wyoming's credit freeze statute (Wyo. Stat. 40-12-503 through 40-12-509) allows residents to place a security freeze on their credit reports. The statute itself permits a consumer reporting agency to charge up to $10 per freeze placement, lift, or removal, unless the consumer provides a police report documenting identity theft, in which case the freeze is free under state law. In practice, freezes are free for all consumers today because of a 2018 federal law that preempts state freeze fees nationwide. Wyo. Stat. 40-12-504(c) sets two deadlines for temporarily lifting a freeze: three business days for a request received through the agency's standard contact method, or, since September 1, 2008, within 15 minutes for a request made through the agency's electronic contact method or by telephone during normal business hours, when the consumer supplies proper identification and the correct PIN or password. A separate three-business-day deadline in 40-12-504(d) applies to permanently removing a freeze. The freeze prevents new accounts from being opened without the consumer's express authorization.

Federal Privacy Laws That Protect Wyoming Residents

Because Wyoming lacks a comprehensive state privacy law, federal law fills critical gaps for Wyoming consumers and businesses.

TAKE IT DOWN Act (Pub. L. 119-12, Effective May 19, 2026)

President Trump signed the TAKE IT DOWN Act on May 19, 2025. The criminal prohibition on publishing nonconsensual intimate images took effect immediately on signing. The platform takedown obligations became effective May 19, 2026 (one year after enactment).

Covered online platforms must now establish procedures for individuals to request removal of nonconsensual intimate imagery, including AI-generated deepfakes. Upon receiving a valid removal notice, platforms must remove the content within 48 hours. Failure to comply constitutes an unfair or deceptive act under the FTC Act, and the FTC has enforcement authority with civil penalties available. Wyoming's Enrolled Act 32 addresses the same underlying harm at the state criminal level; the TAKE IT DOWN Act provides the federal civil enforcement mechanism against platforms.

HIPAA

The HIPAA Privacy Rule protects medical records and personal health information held by healthcare providers, health plans, and healthcare clearinghouses in Wyoming. It requires administrative, technical, and physical safeguards for protected health information and gives patients rights to access and request corrections to their medical records.

GLBA

The Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices and safeguard sensitive data. Banks, credit unions, and other financial companies operating in Wyoming must provide privacy notices to customers and maintain comprehensive data security programs.

COPPA

The Children's Online Privacy Protection Act requires websites and online services directed at children under 13 to obtain verifiable parental consent before collecting personal information. This applies to any business collecting data from Wyoming children online, regardless of where the business is located.

FTC Act Section 5

The FTC Act prohibits unfair or deceptive practices in commerce. The FTC has used this authority to take enforcement action against companies with inadequate data security practices, providing a federal baseline of privacy protection for all Wyoming consumers.

FCRA

The Fair Credit Reporting Act governs consumer reporting agencies and gives Wyoming residents rights to access, dispute, and limit use of their credit files. FCRA also imposes security requirements on furnishers and users of consumer reports.

Wyoming Recording Laws and Electronic Privacy

Wyoming is a one-party consent state under Wyo. Stat. 7-3-702. This statute bars interception of wire, oral, or electronic communications without the consent of at least one party to the conversation. A participant in a conversation may record it without the other party's knowledge. For a full analysis of recording consent requirements and penalties, see Wyoming Recording Laws.

How Wyoming Compares to States With Comprehensive Privacy Laws

Practical Steps for Wyoming Residents

Monitor credit and accounts. Review bank statements, credit card statements, and credit reports regularly. Under federal law, you are entitled to one free credit report annually from each major bureau through AnnualCreditReport.com.

Use the free credit freeze. Credit freezes are free nationwide today, including in Wyoming, because of a 2018 federal law that preempts state freeze fees (Wyoming's own statute otherwise permits a $10 fee absent a police report). File requests directly with Equifax, Experian, and TransUnion.

Review privacy policies before sharing data. Wyoming's Consumer Protection Act gives you recourse if a business makes false claims about its data practices. Read what you are agreeing to.

Request deletion of genetic data. If you have used a consumer DNA testing service, the Genetic Data Privacy Act gives you the right to request deletion of your sample and data when no longer needed.

Report deepfake and synthetic imagery violations. Starting July 1, 2026, violations of Wyo. Stat. 6-4-307 should be reported to law enforcement. Platform-level complaints about nonconsensual intimate imagery can also be submitted to the FTC under the TAKE IT DOWN Act.

File complaints with the AG. The Wyoming Attorney General's Consumer Protection and Antitrust Unit accepts complaints about data breach notification failures and deceptive privacy practices.

This article provides general legal information about Wyoming data privacy laws. It is not legal advice and does not create an attorney-client relationship. Data privacy laws change frequently. Consult with a qualified attorney licensed in Wyoming for advice about your specific situation. Information verified as of May 2026.

More Wyoming Laws

• Wyoming Deepfake Laws
• Wyoming Employee Monitoring Laws
• Wyoming GPS Tracking Laws
• Wyoming Recording Laws

Frequently Asked Questions

Does Wyoming have a comprehensive data privacy law like California or Colorado?

No. As of May 2026, Wyoming has not enacted a comprehensive consumer data privacy law. The state relies on its data breach notification statute (Wyo. Stat. 40-12-501 and 40-12-502), the Genetic Data Privacy Act (Wyo. Stat. Title 35, Chapter 32), the Government Data Privacy Act (SF0020, signed March 2026 for government entities), and federal laws including HIPAA, GLBA, COPPA, and the TAKE IT DOWN Act. The Legislature has reviewed draft comprehensive legislation in committee multiple times but has not passed a broad consumer privacy bill.

What are Wyoming's data breach notification requirements?

Under Wyo. Stat. 40-12-502, any business conducting business in Wyoming that owns or licenses computerized data containing personal identifying information about Wyoming residents must notify affected individuals when a breach materially compromises the security, confidentiality, or integrity of that data. Notification must occur in the most expedient time possible and without unreasonable delay. Required notice elements include the types of information compromised, a description and approximate date of the breach, remedial actions taken, and guidance for affected persons. The Wyoming Attorney General enforces the law exclusively; there is no private right of action.

What personal information is protected under Wyoming's breach notification law?

Wyoming defines personal identifying information broadly under Wyo. Stat. 40-12-501(a)(vii), which cross-references Wyo. Stat. 6-3-901(b)(iii) through (xiv). It covers 12 categories of data when combined with a person's name: Social Security numbers, driver's license numbers, financial account credentials, tribal identification cards, government-issued IDs, shared security tokens, usernames with passwords, birth and marriage certificates, medical information, health insurance data, biometric data, and individual taxpayer identification numbers. The definition is broader than many other states because it includes vital records, tribal IDs, and authentication tokens.

What is Wyoming Enrolled Act 32 and when does it take effect?

Wyoming Enrolled Act 32 (HB 102, 2026 session) creates five new or amended sections, including Wyo. Stat. 6-4-307 and 6-4-308. Section 6-4-307 makes it a felony to knowingly disclose or distribute nonconsensual synthetic intimate imagery, including AI-generated deepfakes of identifiable adults, with intent to harm, harass, intimidate, or coerce. A first offense carries up to 10 years imprisonment, a fine of up to $10,000, or both; a second or subsequent conviction raises the imprisonment cap to 12 years. Section 6-4-308 makes it a felony to knowingly develop or distribute an AI system designed to create or promote child pornography. The Act also creates a new felony for AI systems designed to promote self-harm (Wyo. Stat. 6-4-701) and a limited liability shield for AI developers (Wyo. Stat. 1-1-143). The law takes effect July 1, 2026.

What does the Wyoming Genetic Data Privacy Act require?

Wyoming's Genetic Data Privacy Act (Wyo. Stat. Title 35, Chapter 32, effective July 1, 2022) requires businesses to obtain express, informed consent before collecting, using, or disclosing genetic data. Consumers have the right to request deletion of their genetic data when it is no longer needed. Businesses must implement comprehensive security programs to protect genetic data. In an enforcement action by the Wyoming Attorney General, a violator is subject to a civil penalty of $2,500 for each violation, plus actual damages and the Attorney General's costs and fees, and violations also carry a separate criminal misdemeanor fine of up to $1,000. Unlike many state data privacy laws, this statute gives consumers a private right of action, but only after giving the violator written notice and a 60-day opportunity to cure.

What is the TAKE IT DOWN Act and how does it protect Wyoming residents?

The TAKE IT DOWN Act (Pub. L. 119-12) was signed May 19, 2025. Its criminal prohibition on publishing nonconsensual intimate images took effect immediately; platform takedown obligations became effective May 19, 2026. Covered online platforms must establish procedures for individuals to request removal of nonconsensual intimate imagery, including AI-generated deepfakes, and must remove content within 48 hours of receiving a valid notice. The FTC enforces the platform obligations. Wyoming residents can use this federal law alongside Wyoming's Enrolled Act 32 for both criminal and platform-level remedies.

Can Wyoming residents sue a business for a data breach or privacy violation?

It depends on the violation type. Wyoming's data breach notification statute (Wyo. Stat. 40-12-502) provides no private right of action; only the Attorney General may bring enforcement actions. The Genetic Data Privacy Act does grant consumers a private right of action to seek damages, but only after the individual gives the violator written notice and a 60-day opportunity to cure the violation. Under the Consumer Protection Act, consumers can sue businesses that knowingly commit deceptive trade practices related to data privacy, but must prove actual harm. For violations of Enrolled Act 32 (synthetic intimate imagery), victims may cooperate with criminal prosecution; the statute does not specify a separate civil remedy.