(1) A business that scans a physical or digital version of a person's government or tribal-issued identification to determine the person's age solely for the sale of age-restricted items:
(a) shall use data or metadata from the scan only to determine the person's age;
(b) may not transfer or sell that data or metadata to another party; and
(c) shall permanently delete any data or metadata from the scan within 180 days.
(2) Nothing in this section may be construed to limit the collection and preservation of information required by federal law for the sale of ephedrine or pseudoephedrine.