HB 498 amends Utah's App Store Accountability Act to strengthen protections for minors. It requires app stores to implement clearer age ratings, provide detailed content descriptions to parents, and obtain verifiable parental consent before allowing in-app purchases for users under 18. The bill adds new rules for pre-installed applications (excluding core device functions) and defines "minor accounts" requiring parent affiliation. These changes directly affect app store providers, developers, and parents managing children's mobile device usage, with enforcement handled by Utah's Division of Consumer Protection.
SB 293 creates Utah's Consumer Pricing Act, prohibiting most suppliers from using consumer data to increase prices for goods or services. It directly affects businesses selling products or services, requiring them to avoid using personal data for price hikes unless specific exceptions apply. Key provisions mandate that suppliers using automatic pricing systems must retain related data for at least one year and define terms like "automatic pricing system" and "biometric data." The Division of Consumer Protection will enforce these rules, adding Chapter 82 to Utah's consumer protection laws without appropriating new funds.
HB 320 amends Utah's existing Artificial Intelligence Policy framework by clarifying definitions (like "artificial intelligence" and "regulatory mitigation agreement"), updating the Office of Artificial Intelligence Policy's duties, and modifying the Artificial Intelligence Learning Laboratory Program. The bill establishes a structured process for AI companies to test new technologies under temporary regulatory flexibility (via "regulatory mitigation agreements") while requiring them to report findings and safeguard consumer data. It directly affects state agencies managing AI regulation, AI developers participating in the Learning Laboratory, and Utah consumers through future policy guidance. The Office must annually report program outcomes and policy recommendations to the legislature, with no new funding requested.
HB 408 requires social media platforms to let users transfer portions of their personal data - including connections, content, and interactions - to other platforms within five business days. It mandates real-time data sharing when users switch services, requires explicit user consent before sharing comments or interactions during transfers, and protects platforms from penalties for temporary technical issues if they make good-faith fixes. The bill clarifies that platforms must provide data in a portable, usable format but exempts them from sharing internal algorithms, derived data, or proprietary formats that lack industry standards. This directly affects Utah social media users and platforms operating in the state, focusing on user control over their digital data.
HB 357 updates Utah's privacy law to cover data collected by motor vehicles. It requires car manufacturers to add privacy controls in vehicles, exempts safety data (like speed or braking) from needing driver consent, and mandates the Motor Vehicle Division to inform drivers about their privacy rights. The law directly affects car manufacturers and applies to personal data collected from drivers through their vehicles. This creates new transparency requirements for vehicle data while allowing safety-related information to be used without explicit permission.
HB 327 amends Utah's laws governing automatic license plate readers (LPRs) used by government and law enforcement. It directly affects police departments, state agencies, and other public entities that collect license plate data. The bill replaces outdated rules with new requirements, including mandatory data security measures, limits on how long data can be stored, and restrictions on sharing data with other agencies. It also requires agencies to report how they use LPRs, ensuring transparency in their deployment. The law makes no changes to funding or creates new surveillance powers, focusing solely on standardizing existing LPR data handling practices.
HB 407 requires Utah's State Board of Education to establish a statewide student information system for public schools, while allowing local school districts to maintain their own systems under specific conditions. The bill sets strict requirements for local systems - including data security, compliance with state standards, and mandatory audits for noncompliance - and mandates implementation timelines. It also specifies that all school districts must collect and manage student data through this system or approved local alternatives, ensuring data accessibility for parents and educators via the "Student Achievement Backpack" feature. The bill makes no new funding appropriations and updates multiple Utah Code sections related to education data management.
HB 55 requires schools and government agencies contracting with education technology vendors to include specific privacy clauses in their agreements. It mandates that if a vendor illegally sells student data (violating state or federal law), the school must notify the vendor within 30 days and terminate the contract if the violation isn’t fixed within another 30 days. The bill also prohibits vendors from charging fees or seeking damages for contract termination due to privacy violations and repeals a prior provision allowing vendors to respond to student feedback requests. This directly affects schools, their ed tech vendors, and student data privacy protections under Utah law.
SB 38 reorganizes Utah's consumer protection laws by renaming and renumbering existing chapters, such as moving the Health Spa Services Act to "Fitness Center Services," and adds a new Chapter 77 specifically requiring generative AI service providers to disclose certain information to consumers. It updates registration and reporting rules for businesses, clarifies the Division of Consumer Protection's enforcement authority, and specifies when the division may deny or revoke business registrations. The bill directly affects businesses operating in regulated sectors like credit services, charitable solicitations, fitness centers, and now AI service providers. Key changes include mandatory AI disclosures, updated surety bond requirements, and streamlined processes for maintaining registration with the division.
