Utah Enacts New Laws on Protection of Minors in Social Media, Motor Vehicle Consumer Data Protection, and AI Policy | Practical Law

Utah Enacts New Laws on Protection of Minors in Social Media, Motor Vehicle Consumer Data Protection, and AI Policy | Practical Law

Utah has enacted SB 464, which repeals and replaces its existing social media law and creates a private right of action, SB 194, which enacts the Utah Minor Protection in Social Media Act, SB 215, which regulates motor vehicle consumer data protection, and SB 149 on AI Policy.

Utah Enacts New Laws on Protection of Minors in Social Media, Motor Vehicle Consumer Data Protection, and AI Policy

by Practical Law Data Privacy & Cybersecurity
Published on 15 Mar 2024 • Utah
Utah has enacted SB 464, which repeals and replaces its existing social media law and creates a private right of action, SB 194, which enacts the Utah Minor Protection in Social Media Act, SB 215, which regulates motor vehicle consumer data protection, and SB 149 on AI Policy.
On March 13, 2024, Utah Governor Spencer Fox enacted several new laws, including:
  • HB 464, which repeals Utah's Social Media Regulation Act (see Legal Update, Utah Enacts Social Media Regulation Act) and creates a private right of action.
  • SB 194, which enacts the Utah Minor Protection in Social Media Act.
  • SB 215, which enacts provisions related to storing, sharing, and accessing motor vehicle consumer data.
  • SB 149, which enacts the Artificial Intelligence Policy Act.

HB 464 and SB 194 (Utah Minor Protection in Social Media Act)

HB 464 and SB 194 apply to social media companies, defined as entities that own or operate a social media service. A social media service is a public website or app that:
  • Displays content that account holders primarily generate.
  • Permits an individual to register as an account holder and create a profile visible to the general public or a set of other users defined by the account holder.
  • Connects account holders to allow users to interact socially with each other within the website or application.
  • Makes available to each account holder a list or lists of other account holders with whom they share a connection within the system.
  • Allows account holders to post content that other users can view.
Under SB 194, social media companies must protect Utah minors' personal information by:
  • Implementing an age assurance system to determine whether a current or prospective Utah account holder is a minor.
  • Set default privacy settings that prioritize maximum privacy and cannot be changed without obtaining verifiable parental consent.
  • Implement and maintain reasonable security measures, including encryption.
  • Provide a notice that identifies any information the social media company collects from Utah minor account holders and how they may use or disclose that information.
  • At a minor's request, delete the personal information and remove information the minor made publicly available through the social media service.
  • Disable certain features that prolong user engagement.
  • Offer supervisory tools that the Utah minor account holder may decide to activate.
Utah's Division of Consumer Protection has rulemaking and enforcement authority under SB 194 and can impose administrative fines of up to $2,500 per violation. SB 194 takes effect on October 1, 2024.
HB 464 repeals Utah's existing Social Media Regulation Act and creates a private right of action allowing Utah minor account holders or their parents to bring a cause of action against a social media company for an adverse mental health outcome arising, in whole or in part, from the minor's excessive use of the social media company's algorithmically curated social media service. An algorithmically curated social media service is defined as a social media service that drives user engagement primarily using a curation algorithm and engagement driven design elements.
A plaintiff bringing an action under HB 464 must demonstrate that:
  • A licensed mental health care provider has diagnosed the Utah minor account holder with an adverse mental health outcome, which includes depression, anxiety, suicidal thoughts or behaviors, and self-harm thoughts or behaviors.
  • The Utah minor account holder's excessive use of an algorithmically curated social media service caused, in whole or in part, the adverse mental health outcome.
HB 464 creates a rebuttable presumption in favor of the plaintiff's cause of action, which a social media company can overcome by demonstrating it:
  • Limits a Utah minor account holder's use of the algorithmically curated social media service to no more than three hours in a 24-hour period across all devices.
  • Restricts a Utah minor account holder from accessing the algorithmically curated social media service between the hours of 10:30 p.m. and 6:30 a.m.
  • Requires the Utah minor account holder's parent or legal guardian to consent to their use of the algorithmically curated social media service.
  • Disables engagement-driven design elements for a Utah minor account holder's account.
A social media company will not be held liable for user-posted content on the algorithmically curated social media service or for declining to restrict access to or modify user posts due to their content.
HB 464 allows for the greater of $10,000 in statutory damages or the amount of actual damages for each adverse mental health outcome incidence, plus attorney's fees and costs. The law takes effect on May 1, 2024.

SB 215 (Motor Vehicle Consumer Data Protection)

SB 215 regulates consumer data within the dealer data system, defined as either:
  • A software, hardware, or firmware system that a franchisee owns, leases, or licenses that:
    • includes a system of web-based applications, computer software, or computer hardware, whether located at the franchisee's dealership or hosted remotely; and
    • stores or provides access to protected dealer data.
  • A dealership management system or a consumer relationship management system.
It does not regulate data outside of a dealer data system, including data generated by a motor vehicle or a device a consumer connects to it.
SB 215 applies to:
  • Dealer data vendors, defined as third-party dealer management system providers, consumer relationship management system providers, or third-party vendors providing similar services that store protected dealer data under a contract with the franchisee.
  • Authorized integrators, defined as third parties contracted with a franchisee to perform a specific function that allows them to access protected dealer data or to write data to a dealer data system, or both, to carry out the specific function.
  • Franchisees, defined as persons a franchisor has agreed with or permitted, in writing or in practice, to purchase, sell, or offer for sale new motor vehicles that the franchisor manufactured, produced, represented, or distributed.
SB 215 provides certain protective measures for consumer data, including:
  • A dealer data vendor must adopt and make available to a franchisee and any authorized integrator a standardized framework to share and retrieve data.
  • A dealer data vendor and an authorized integrator may access, use, store, or share protected dealer data or any other data from a dealer data system only to the extent the written agreement with the franchisee permits.
  • A service provider contract may permit the franchisee to monitor the service provider's compliance with the contract through ongoing manual reviews, automated scans, assessments, audits, or other technical and operational testing, at least once a year.
In addition, a franchisor or third party may not:
  • Access, share, sell, copy, use, or transmit protected dealer data without the franchisee's prior express written consent.
  • Engage in any act of cyber ransom.
  • Take action to prohibit or limit a franchisee's ability to protect, store, copy, share, or use protected dealer data.
SB 215 takes effect on May 1, 2024.

SB 149 (Artificial Intelligence Policy Act)

SB 149 defines a generative AI system as an AI system that:
  • Is trained on data.
  • Interacts with a person using text, audio, or visual communication.
  • Generates non-scripted outputs similar to human-created outputs with limited or no human oversight.
SB 149:
  • Requires generative AI system providers to disclose when a person is interacting with their AI system.
  • Clarifies that it is not a defense to a violation of any statute that the Division of Consumer Protection administers and enforces that a generative AI system made the violative statement, committed the violative act, or furthered the violation.
  • Creates the Artificial Intelligence Learning Laboratory Program to:
    • analyze and research the risks, benefits, impacts, and policy implications of AI technologies to inform the state regulatory framework;
    • encourage development of state AI activities;
    • evaluate the effectiveness and viability of current, potential, or proposed regulation on AI technologies with AI companies; and
    • produce findings and recommendations for AI legislation and regulation.
  • Creates the Office of Artificial Intelligence Policy (Office), which is responsible for:
    • administering the Artificial Intelligence Learning Laboratory Program;
    • consulting with businesses and other stakeholders in the state about potential regulatory proposals; and
    • engaging in rulemaking and reporting.
  • Establishes an application process for regulatory mitigation agreements, which:
    • Allows anyone who wants to use AI in Utah to apply for a regulatory mitigation, which the Office can then grant temporarily if the participant meets certain criteria set out in SB 149.
    • Specifies limitations on the scope of the AI system's use, including the number and types of users, geographic limitations, and safeguards to be implemented.
    • Allows approved participants to avoid regulatory enforcement while they develop and analyze new AI technologies.
Utah's Division of Consumer Protection will enforce SB 149 and can administer injunctive relief, award disgorgement, and impose administrative fines of up to $2,500 per violation, in addition to other relief a court may award. SB 149 takes effect on May 1, 2024.