Keypoint: The Utah legislature repealed and replaced the Utah Social Media Act in response to a lawsuit challenging the law on constitutional grounds.

Prior to closing in early March, the Utah legislature passed two bills (SB 194 and HB 464) that repeal and replace the Utah Social Media Regulation Act, which the legislature passed just last year. The bills are the second part of a legislative process in which Utah lawmakers amended the Act in response to a lawsuit filed by an Internet trade association challenging the Act on constitutional grounds. The Utah legislature previously pushed back the Act’s effective date to delay the legal challenge while lawmakers worked to revise the Act. In the below article, we provide a brief background on the Act and then discuss the changes made by the two bills.

Background

Last year Utah became one of the first states to regulate social media companies’ treatment of children with SB 152 and HB 311. Together, the bills enacted the Utah Social Media Regulation Act, Utah Code §§ 13-63-101 to 701. When the bills were passed, we provided a summary of the two bills in our weekly update. In October 2023, the Utah Division of Consumer Protection published proposed implementing rules.

However, in December 2023, NetChoice – a trade association for Internet companies – filed a complaint and motion for preliminary injunction against the Act in the United States District Court for the District of Utah. NetChoice’s complaint alleges that the Act’s provisions are unconstitutional under the First Amendment and Due Process Clause of the Fourteenth Amendment.

On January 2, 2024, the Utah District Court set a briefing schedule on NetChoice’s motion for preliminary injunction and a February 12 hearing date. As originally enacted, the Act’s requirements were to go into effect on March 1, 2024. However, when the Utah legislature opened, it quickly passed and the Governor signed SB 89, which changed the March 1, 2024 effective date to October 1, 2024. The defendants in the lawsuit then filed a motion to amend the briefing schedule and vacate the hearing date. The motion asked that the Court change the deadlines “because the effective date of the law at issue in this case has been postponed until October 1, 2024 and the Legislature is likely to repeal and replace the law during the current legislative session.” The Court granted the motion to amend and ordered the parties to provide a joint notice by March 15, 2024, proposing an updated briefing schedule.

Overview

As a starting point, HB 464 repeals the Utah Social Media Regulation Act in its entirety and creates a private right of action for harm to minors for an adverse mental health outcome arising, in whole or part, from a minor’s excessive use of a social media company’s algorithmically curated social media service. SB 194 enacts the Utah Minor Protection in Social Media Act, Utah Code §§ 13-71-101 to 401. We will begin our analysis with SB 194 and then discuss HB 464.

The Utah Minor Protection in Social Media Act (SB 194)

Applicability

The Utah Minor Protection in Social Media Act (2024 Act) applies to social media companies, which is any entity that owns or operates a social media service. “Social media service” is defined as “a public website or application that: (i) displays content that is primarily generated by account holders and not by the social media company; (ii) permits an individual to register as an account holder and create a profile that is made visible to the general public or a set of other users defined by the account holder; (iii) connects account holders to allow users to interact socially with each other within the website or application; (iv) makes available to each account holder a list or lists of other account holders with whom the account holder shares a connection within the system; and (v) allows account holders to post content viewable by other users.” Social media services do not include email, cloud storage, or document viewing, sharing or collaboration services.

Age Assurance, Rulemaking, Safe Harbor

Pursuant to Section 201, social media companies must implement an age assurance system to determine whether a current or prospective Utah account holder is a minor (i.e., an individual under the age of 18). The 2024 Act defines an “age assurance system” as “measures reasonably calculated to enable a social media company to identify whether a current or prospective Utah account holder is a minor with an accuracy rate of at least 95%.”

Section 302 requires the Division of Consumer Protection to make rules to establish the process and means by which a social media company may assure whether an account holder is a minor and obtain verifiable parental consent, and to establish criteria a social media company may use to determine whether the company’s age assurance system is 95% accurate. The 2024 Act creates a safe harbor for social media companies that comply with these rules.

Requirements

Section 202 creates five requirements for social media companies interacting with Utah minors. Social media companies must:

1. Set default privacy settings to “prioritize maximum privacy”;

Specifically, social media companies must restrict the visibility of Utah minors’ accounts to connected accounts, limit minors’ ability to share content only to connected accounts, restrict any data collection and sale of data from minors’ accounts, disable search engine indexing of minors’ account profiles, restrict direct messing to only allow direct messaging to connected accounts, and allow minors to download files with all information associated with their accounts.

Pursuant to Section 204, these default settings cannot be changed without obtaining verifiable parental consent.

• Implement and maintain reasonable security measures to protect Utah minors’ personal information;
• Provide a notice that identifies any information the social media company collects from Utah minors account holders and how that information may be used or disclosed;
• At the minors’ request, delete the personal information and remove information the minor made publicly available through the social media service; and
• Disable certain types of features that prolong user engagement.

Supervisory Tools

Section 203 requires social media companies to offer supervisory tools “that the Utah minor account holder may decide to activate.” The tools must be capable of allowing “an individual selected by the Utah minor account holder” to, among other things, set time limits for the social media service usage, schedule mandatory breaks, view usage data, including a list of connected accounts, and receive notifications when the Utah minor account holder changes these account settings.

Presumption of Confidentiality

Section 204 states that a social media company’s terms of service for Utah minors shall be presumed to include an assurance of confidentiality for the minors’ personal information. This presumption can be “overcome” by obtaining verifiable parental consent. Section 204 also identifies six circumstances in which the presumption of confidentiality does not apply.

Enforceability

The 2024 Act is enforceable by the Division of Consumer Protection. Penalties are set at $2,500 for each violation. There is no reference to a private right of action.

Effective Date

The 2024 Act takes effect on October 1, 2024.

Harm to Minors by Algorithmically Curated Social Media Service (HB 464)

In addition to repealing the Utah Social Media Regulation Act, HB 464 amends Utah Code § 76-9-201 and enacts Utah Code §§ 78-B-3-1101 to 1106. We will not discuss the amendments to section 76-9-201, which covers electronic communication harassment.

Definitions and Applicability

Although HB 464 contains its own definitions, it is important to note that Section 12 of SB 194 states that, if both bills are enacted, the following definitions in HB 464 are amended to use the definitions in SB 194: account holder, content, minor, social media company, social media service, user, Utah account holder, and Utah minor account holder. Consequently, HB 464’s applicability aligns with SB 194’s applicability.

Private Right of Action

HB 464 creates a private right of action where a Utah minor account holder or parent of a Utah minor account holder “may bring a cause of action against a social media company in court for an adverse mental health outcome arising, in who or in part, from the minor’s excessive use of the social media company’s algorithmically curates social media service.”

The bill defines “adverse mental health outcome” to include “depression, anxiety, suicidal thoughts or behaviors, and self-harm thoughts or behaviors.” It defines “algorithmically curated social media service” as “a social media service that drives user engagement primarily through the use of: (a) a curation algorithm; and (b) engagement driven design elements.”

To state a cause of action, a plaintiff must demonstrate that the Utah minor account holder has been diagnosed by a licensed mental health care provider with an adverse mental health outcome; and that the adverse mental health outcome was caused by the Utah minor account holder’s excessive use of an algorithmically curated social media service.

The bill creates a rebuttable presumption in favor of the plaintiff’s cause of action; however, it allows the social media company to overcome the rebuttal presumption (and create a rebuttal presumption in its favor) if the social media company implements certain restrictions such as limiting the amount of time of use and restricting the use to certain hours.

The bill allows for $10,000 in statutory damages for each adverse mental health outcome incidence.

Finally, the bill states that a social media company cannot be held liable based on the content of material posted by users of the algorithmically curated social media service or for declining to restrict access to or modify user posts based solely on the content of those posts.

Effective Date

The law takes effect on May 1, 2024.