What is the Utah Social Media Regulation Act?

UPDATE: March 27, 2024
As of early March 2024, the Utah legislature repealed and replaced the Utah Social Media Regulation Act with SB 194 and HB 464. Utah lawmakers amended the Act in response to a lawsuit filed by an Internet trade association challenging the Act on constitutional grounds. 

What is the Utah Social Media Regulation Act?

Utah Governor Spencer Cox signed the Social Media Regulation Act into law on March 23, 2023, that incorporates both HB311 and SB 152. The regulation was supposed to go into force on March 1, 2024, holding social media companies accountable to ensure minors under 18 are protected online.  

Governor Cox anticipates social media companies will challenge the regulation in court to stop the law going into effect. This law adds momentum for other states to hold social media companies accountable to ensure kids across the country are protected online. Other states, such as Texas, Ohio and Louisiana have similar proposals in the works, along with New Jersey. 

Here is a breakdown of the regulation.

H.B. 311 Highlights:

• Prohibits social media companies using design features that cause a minor to become addicted to that platform.
  
  
• Authorizes a private right of action to collect attorney fees and damages from a social media company for harm incurred by a minor's use of the company's social media platform and creates a rebuttable presumption that harm and causation occurred in some circumstances.

S.B. 152 Requires a social media company to:

• Verify the age of a Utah resident seeking to maintain or open a social media account
• Obtain the consent of a parent or guardian before a Utah resident under the age of 18 may maintain or open an account
• Prohibit permitting a Utah resident to open an account if that person does not meet age requirements under state or federal law
• Prohibit minors direct messaging with certain accounts
• Not show the minor's account in search results
• Not display advertising
• Not collect, share, or use personal information from the account, with certain exceptions
• May not target or suggest ads, accounts, or content
• Shall limit hours of access to a minor, subject to parental or guardian direction from having access during the hours of 10:30 p.m. to 6:30 a.m.
• Provide a parent or guardian access to the content and interactions of an account held by a Utah resident under the age of 18 with a password or other means for the parent or guardian to access the account, which shall allow the parent or guardian to view all posts the Utah minor account holder makes under the social media platform account; and all responses and messages sent to or by the Utah minor account holder in the social media platform account.

Enforcement
The Regulation grants the Division of Consumer Protection enforcement and auditing authority to enforce requirements under the act. The division may audit the records of a social media company to determine compliance with the requirements or to investigate a complaint, including a random sample of a social media company's records and other audit methods.

A social media company is subject to a civil penalty of $250,000 for each practice, design, or feature shown to have caused addiction; and a civil penalty of up to $2,500 for each Utah minor account holder who is shown to have been exposed to the practice, design, or feature found to have caused addiction under Subsection (3)(a)(i).

A social media company shall not be subject to a civil penalty if the social media company, as an affirmative defense, demonstrates that the social media company:

• Instituted and maintained a program of at least quarterly audits of the social media company's practices, designs, and features to detect practices, designs, or features that have the potential to cause or contribute to the addiction of a minor user
  
  
• Corrected, within 30 days of the completion of an audit described in Subsection (3)(b)(i), any practice, design, or feature discovered by the audit to present more than a de minimus risk of violating this section
  
  

How is a social media company/platform defined under the regulation?
A "Social media company" means a person or entity that:

• provides a social media platform that has at least 5,000,000 account holders worldwide
• is an interactive computer service
• an online forum that a social media company makes available for an account holder to:
  • create a profile
  • upload posts
  • view the posts of other account holders
  • interact with other account holders or users

"Social media platform" does not include an online service, website, or application: where the predominant or exclusive function is:

• electronic mail
• direct messaging consisting of text, photos, or videos that are sent between devices by electronic means, where messages are: shared between the sender and the recipient; only visible to the sender and the recipient; and are not posted publicly
• a streaming service that: provides only licensed media in a continuous flow from the service, website, or application to the end user; and does not obtain a license to the media from a user or account holder by agreement to its terms of service
• news, sports, entertainment, or other content that is preselected by the provider and not user generated, and any chat, comment, or interactive functionality that is provided incidental to, directly related to, or dependent upon provision of the content
• online shopping or e-commerce, if the interaction with other users or account holders is generally limited to: the ability to upload a post and comment on reviews; the ability to display lists or collections of goods for sale or wish lists; and other functions that are focused on online shopping or e-commerce rather than interaction between users or account holders
• interactive gaming, virtual gaming, or an online service, that allows the creation and uploading of content for the purpose of interactive gaming, edutainment, or associated entertainment, and the communication related to that content
• photo editing that has an associated photo hosting service, if the interaction with other users or account holders is generally limited to liking or commenting
• a professional creative network for showcasing and discovering artistic content, if the content is required to be non-pornographic
• single-purpose community groups for public safety if:
  • the interaction with other users or account holders is generally limited to that single purpose; and the community group has guidelines or policies against illegal content
  • providing career development opportunities, including professional networking, job skills, learning certifications, and job posting and application services
  • business to business software
  • a teleconferencing or videoconferencing service that allows reception and transmission of audio and video signals for real time communication
  • cloud storage; shared document collaboration; cloud computing services, which may include cloud storage and shared document collaboration
  • providing access to or interacting with data visualization platforms, libraries, or hubs
  • to permit comments on a digital news website, if the news content is posted only by the provider of the digital news website
  • providing or obtaining technical support for a platform, product, or service
  • academic or scholarly research; or genealogical research; or where: the majority of the content that is posted or created is posted or created by the provider of the online service, website, or application; and the ability to chat, comment, or interact with other users is directly related to the provider's content
  • that is a classified ad service that only permits the sale of goods and prohibits the solicitation of personal services
  • that is used by and under the direction of an educational entity, including:
    • a learning management system
    • a student engagement program
    • a subject or skill-specific program

If you would like support to get into shape with Utah's Social Media Regulation Act, then please contact PRIVO by clicking here.