1. (1) Any record of a presentation of a state digital identity may only be processed by a digital wallet provider, a verifier, or a relying party:

   1. (a) for the primary purpose for which the presentation was performed; or
   2. (b) if required by law.

2. (2) Information provided by a holder, verifier, or relying party to a verifier or relying party in the course of a presentation may only be:

   1. (a) processed for the primary purpose for which the holder disclosed the information; and

   2. (b) used, retained, sold, or shared:

      1. (i) following conspicuous notice to and express authorization by the holder; or
      2. (ii) if required by law.

Enacted by Chapter 436, 2026 General Session