SB 322 creates a regulatory sandbox in Utah public schools to safely test educational AI tools under new safety standards. It directly affects public schools, educators, students, and edtech vendors by requiring safety testing, parental opt-out rights, and prohibitions against AI simulating personal relationships with students. Key provisions include mandatory evidence-based evaluations, transparency requirements for vendors, integration with existing student data privacy laws (Title 53E), and a five-year sunset. The bill establishes new oversight through an Education Technology Advisory Council and limits the State Board of Education’s role in approving pilot programs.
HB 450 amends Utah's Government Data Privacy Act and Government Records Access and Management Act to strengthen state data privacy oversight. It restructures the Utah Privacy Commission to include state agencies, cities, counties, and education representatives, transfers oversight to a new Utah Office of Data Privacy, and creates a data privacy ombudsman to handle complaints. The bill requires joint studies on government use of passive data collection technology and removes duplicative rules while expanding correction procedures beyond personal data. These changes directly affect Utah state and local government entities that collect or manage public data.
SB 290 strengthens privacy protections for victims and witnesses in Utah criminal cases by regulating access to their nonpublic electronic data, such as personal messages or intimate images shared with law enforcement. It requires law enforcement to implement secure "virtual rooms" for defendants' attorneys to review sensitive data without copying it, creates a presumption against disclosing intimate images, and mandates clear disclosure of devices used in investigations. The bill directly affects victims/witnesses (who gain greater control over their private information), law enforcement (who must adopt new policies), and defendants (who must seek court approval to access nonpublic data). Key provisions include defining "nonpublic victim or witness data," requiring prosecutors to notify defendants about device searches, and limiting data sharing to specific court-approved scenarios. The bill makes no changes to existing evidence disclosure rules under Utah Rules of Criminal Procedure.
Utah's HJR 27 is a joint resolution urging federal lawmakers to establish a national regulatory framework allowing banks and credit unions to safely custody digital assets like cryptocurrencies. It states current regulatory gaps prevent traditional financial institutions from offering secure custody services, increasing risks of fraud and hacking for customers. The resolution specifically calls for federal permission for these institutions to partner with regulated crypto firms and provide custody options. This would keep digital asset management within Utah's regulated financial institutions rather than offshore exchanges, aligning with Utah's fintech leadership.
SB 275 creates Utah's State-Endorsed Digital Identity Program, managed by the Department of Government Operations. It establishes a digital identity bill of rights, sets standards for verifying identities, and allows state-verified digital IDs to be used as proof of age (e.g., for purchasing alcohol or tobacco). The program requires government agencies, healthcare providers, and digital wallet services to follow specific security and privacy rules when processing these identities. It does not create new costs, as no funding is appropriated, and replaces outdated electronic ID provisions upon sunset review.
SB 298, the "Programmable Money Amendments," modifies Utah's Uniform Commercial Code to regulate digital payment methods (like digital tokens or programmable currency). It directly affects businesses that issue or accept programmable money by requiring them to offer free non-digital payment options and banning discrimination based on political views, religion, medical history, or lawful firearm ownership. The bill prohibits denying transactions due to environmental/social/governance compliance or diversity programming, mandates written explanations for denied transactions within 30 days, and allows affected parties to seek punitive damages or revoke an issuer’s license. It explicitly clarifies that the law does not restrict cryptocurrency purchases or sales by any party.
SB 294 creates a standardized digital "Student Achievement Backpack" for Utah K-12 students, providing a unified view of their academic progress across schools and programs. It requires the system to operate without transferring or storing student data (keeping records in original school systems), using a "visualization-only interface" to show existing data securely. The bill defines who can access this profile - students, parents, teachers, and administrators - and ensures it supports personalized learning, postsecondary planning, and seamless transitions between schools. It does not replace existing school data systems or alter current reporting requirements.
SB 296 requires Utah schools and colleges to obtain clear, informed consent from students before sharing their educational data (like transcripts, enrollment records, and course history). It mandates a secure digital consent system by July 2027, prohibits bundling unrelated terms with consent requests, and ensures students can revoke consent anytime. The bill directly affects students (including minors, where parents must consent) and educational institutions, while prohibiting schools from restricting consent rights or requiring waivers of unrelated privacy protections. It aligns with federal FERPA law but adds Utah-specific rules for data disclosure, including creating a private right of action if third parties violate these requirements.
HB 474 updates Utah's Uniform Commercial Code to modernize rules for digital transactions. It replaces "writing" with "record" to include electronic documents and creates new rules for controlling digital assets like bank accounts, electronic titles, and payment intangibles. The bill clarifies when a secured party (e.g., a bank or lender) has control over electronic records, affecting how security interests attach and are enforced in digital transactions. Businesses, financial institutions, and individuals using electronic contracts or digital assets in Utah will directly experience these changes, as the bill aligns Utah's commercial law with current electronic commerce practices.
HB 158 amends Utah law to broaden protections against unauthorized tracking by renaming the offense to "unlawful use of a tracking device or tracking application." It makes it illegal to place trackers on personal property (excluding vehicles) or use tracking apps to monitor someone after they revoke consent, even if initial permission was given. The bill adds statutory damages for victims who choose this option over compensatory damages in civil cases. It includes exemptions for licensed private investigators (under specific conditions), parents tracking minors, caregivers for vulnerable adults, and law enforcement acting under court orders or official duties. The law applies directly to individuals using tracking technology and aims to strengthen privacy rights against persistent monitoring.
