Utah Children's Privacy Laws (2026)

App Store Accountability Act · SB 142 (2025), amended by HB 498 (2026)

Enacted — not yet effective — Signed into law; its effective date is still in the future. · App store · effective 2027-05-06 · binds app stores, developers

Ages: Under 18 (minors); standard age categories: child <13, younger minor 13-15, older minor 16-17, adult 18+

Requires: App store providers must verify a user's age category at account creation and obtain verifiable parental consent before a minor downloads apps or makes in-app/app purchases; minor accounts must be linked to a parent account. Developers must check age category and parental-consent status via the app store's data systems.

Litigation: CCIA filed a First Amendment challenge in federal court; voluntarily dismissed Apr 21, 2026 after HB 498 (signed Mar 18, 2026) removed the Utah AG's enforcement authority, mooting the AG-directed claim. Never enjoined. A private right of action remains.

Utah Minor Protection in Social Media Act · SB 194 / HB 464 (2024)

Enacted — enjoined — Passed, but a court has currently blocked enforcement. · Social media · effective 2024-10-01 · binds operators, platforms

Ages: Under 18 (minors)

Requires: Social media companies must verify the age of Utah account holders, default minors into heightened-protection settings (curfew/notification/design limits), and obtain parental consent for minor accounts. HB 464 adds a private right of action holding algorithmic-curation platforms liable for harms to minor users.

Litigation: NetChoice v. Reyes: U.S. District Court (Chief Judge Shelby) granted a preliminary injunction on 2024-09-10 on First Amendment grounds. Injunction remains in effect; Utah's appeal argued before the 10th Circuit in Nov 2025, no decision as of 2026-06-27 (not stayed, vacated, or reversed).

Utah Consumer Privacy Act (UCPA) — minors' provisions · S.B. 227 (2022 General Session)

In force — Effective and enforceable today. · Privacy law (minors) · effective 2023-12-31 · binds operators

Ages: Known children under 13 only (no heightened protections for teens 13-17)

Requires: The UCPA's only minor-specific heightened duties apply to a consumer 'known to be' a child, defined as under 13 (Utah Code 13-61-101(8)). A controller may not process the sensitive data of a known child except in accordance with the federal COPPA, 15 U.S.C. 6501 et seq. (13-61-302(3)(b)), and satisfies any parental-consent obligation by following COPPA's verifiable-parental-consent mechanisms (13-61-102(3)); a parent or legal guardian exercises the child's data rights (13-61-202(2)). The Act adds no opt-in consent, targeted-advertising, profiling, or 'sell'/share restrictions for teens aged 13-17 — they are treated as adults under the law's opt-out framework.