Utah Children’s Privacy Laws (2026)

SB 142 (2025), amended by HB 498 (2026)

Enacted, not yet effective · App store · effective 2027-05-06 · binds app stores, developers

Ages: Under 18 (minors); statutory age categories: child under 13, younger teenager 13-15, older teenager 16-17, adult 18+

Requires: App store providers must verify a user's age category at account creation and obtain verifiable parental consent before a minor downloads apps or makes in-app/app purchases; minor accounts must be linked to a parent account. Developers must check age category and parental-consent status via the app store's data systems.

Timing: Duties and the private right of action begin 2027-05-06: HB 498 (2026), in effect on the governor's signature 2026-03-18 after two-thirds votes in both houses, inserted 'Beginning May 6, 2027' at the head of each app store provider duty, developer duty and private-action clause (Utah Code 13-76-201, -202, -401). For an account that already exists, the app store provider must request and verify the holder's age category within 12 months after the day the 13-76-201 obligations take effect. SB 142 as enacted in 2025 had set 2026-05-06 for the duties and 2026-12-31 for enforcement.

Litigation: CCIA v. Brown, No. 2:26-cv-00094 (D. Utah): CCIA's First Amendment, vagueness and Commerce Clause challenge, filed 2026-02-05 against the Attorney General and the Division of Consumer Protection director, was voluntarily dismissed by stipulation on 2026-04-21 after HB 498 removed government enforcement; the parties stipulated that the amended Act authorizes no government enforcement, only a private cause of action, and the defendants agreed not to enforce it. Never enjoined. A private right of action for a harmed minor or parent remains.

Entry last reviewed 2026-10-01

SB 194 / HB 464 (2024)

Enacted, enjoined · Social media · effective 2024-10-01 · binds operators, platforms

Ages: Under 18 (minors)

Requires: Social media companies must run an age assurance system (at least 95% accurate, with a documentary-evidence appeal decided within 30 days) to identify Utah minor account holders. For those minors they must set maximum-privacy defaults, disable autoplay, infinite scroll and engagement-prompting push notifications, and offer supervisory tools the minor may choose to activate, letting a person the minor selects set daily time limits and schedule mandatory breaks; verifiable parental consent is required only before a minor changes the default privacy settings or to lift the presumed confidentiality of the minor's personal information, and the Act has no account-creation consent gate and no curfew. HB 464 separately lets a minor or parent sue over a diagnosed adverse mental-health outcome from excessive use of an algorithmically curated service, with a rebuttable presumption of causation and the greater of $10,000 per adverse mental-health outcome or actual damages; a company that imposes a 3-hour daily cap, a 10:30 p.m. to 6:30 a.m. block, parental consent to use and disabled engagement-driven design gets the opposite presumption.

Litigation: NetChoice v. Reyes (now captioned NetChoice v. Brown, 10th Cir. No. 24-4100, after the Utah AG changed): U.S. District Court (Chief Judge Shelby) granted a preliminary injunction on 2024-09-10 on First Amendment grounds, barring the defendants from enforcing any part of the Act, Utah Code 13-71-101 to 401. Injunction remains in effect; case was argued and submitted to a 10th Circuit panel (Holmes, Kelly, Moritz) on 2025-11-20, still undecided (not stayed, vacated, or reversed). The order by its terms covers only Utah Code 13-71 and does not reach HB 464's private right of action (78B-3-1101 to 1106), in effect since 2024-10-01.

Entry last reviewed 2026-10-01

S.B. 227 (2022 General Session)

In force · Privacy law (minors) · effective 2023-12-31 · binds operators

Ages: Known children under 13 only (no heightened protections for teens 13-17)

Requires: The UCPA's only minor-specific heightened duties apply to a 'known child', a child being an individual younger than 13 (Utah Code 13-61-101(8)). A controller may not process the sensitive data of a known child except in accordance with the federal COPPA, 15 U.S.C. 6501 et seq. (13-61-302(3)(b)), and satisfies any parental-consent obligation by following COPPA's verifiable-parental-consent mechanisms (13-61-102(3)); a parent or legal guardian exercises the child's data rights (13-61-202(2)). The Act adds no opt-in consent, targeted-advertising, profiling, or 'sell'/share restrictions for teens aged 13-17; they are treated as adults under the law's opt-out framework.

Litigation: Not enjoined. The Utah Division of Consumer Protection and the State of Utah sued Snap Inc. in the Third Judicial District Court, Salt Lake County, on 2025-06-30 under the UCPA and the Consumer Sales Practices Act, alleging among other counts that Snapchat's My AI feature violated the known-child clause, Utah Code 13-61-302(3)(b), by giving parents no meaningful opportunity to consent to their under-13 child's use of it. Snap's earlier federal suit to block that enforcement, Snap Inc. v. Brown, No. 2:25-cv-00490 (D. Utah), was denied a temporary restraining order on 2025-06-23 and dismissed without prejudice on Younger abstention grounds on 2026-03-24, with its preliminary-injunction motion denied as moot.

Entry last reviewed 2026-10-01

S.B. 226 (2025 General Session); Laws of Utah 2025, ch. 465; Utah Code 13-77-101 to -106 (enacted as 13-75, technically renumbered)

In force · AI companion · effective 2025-05-07 · binds operators

Ages: All users, age neutral: the statute contains no minor-specific provision

AI chatbot access for minors: Safeguards only (in force).

Requires: A supplier that uses generative AI (a system designed to simulate human conversation by text, audio or visual means) to interact with someone in connection with a consumer transaction must disclose that the person is dealing with AI and not a human when the person clearly and unambiguously asks, and individuals providing services in an occupation licensed or state-certified through the Department of Commerce must disclose AI use up front in high-risk interactions (collecting sensitive health, financial or biometric data, or giving advice relied on for significant personal decisions). A service whose AI clearly and conspicuously discloses at the outset and throughout the interaction that it is AI is shielded from enforcement of those disclosure duties, and the fact that AI made a statement or took an act is no defense to a violation of a consumer-protection statute the Division enforces. Enforced by the Division of Consumer Protection with fines of up to $2,500 per violation; the act replaced former Utah Code 13-2-12 (2024) and has no minor-specific duties.

Litigation: None. Not challenged.

Entry last reviewed 2026-10-01