On March 13, 2024, Governor Spencer Cox signed Utah’s Social Media Amendments, SB 194 and HB 464. Utah was the first state last year to pass laws strictly limiting minors’ use of social media. These laws were challenged in two lawsuits: one brought by social media users and another brought by NetChoice, a trade association representing internet companies.

In the face of these lawsuits and after similar laws in Arkansas and Ohio were enjoined as unconstitutional, Utah passed these two new bills, which repeal the existing Social Media Regulation Act and revise covered entities’ obligations. While the new law shares similarities with its predecessor in many ways, there are some substantive new features that companies will want to keep in mind.

This alert summarizes the Social Media Amendments’ key provisions, which will take effect on October 1, 2024.

Who Is a Covered Entity Under the Social Media Amendments?

The Social Media Amendments apply to social media services, which are public websites or applications that:

• display content primarily generated by account holders, not the company;
• allow individuals to register as account holders and create profiles that are either:
  • visible to the general public, or
  • visible to a set of users defined by the account holder;
• connect account holders to allow them to interact socially within the website or application;
• make available to each account holder a list or lists of connections with other account holders (e.g., a list of followers); and
• allow account holders to post content viewable by other users.

The requirements do not apply to email, cloud storage, or document viewing, sharing, or collaboration services.

Notably, the private right of action provision (discussed further below) only applies to “algorithmically-curated social media services,” defined as social media services that drive user engagement primarily through the use of a curation algorithm and engagement-driven design elements.

Who Is Considered a Minor?

A minor is an individual who is under 18 years old that has not been emancipated or married. Companies should be mindful that not all state laws regarding minors’ use of their services define this term in the same way, as some define minors as individuals under 16 years old.

What Do the Social Media Amendments Require, and what Are the Penalties?

Although part of the same legislative agenda, the provisions within SB 194 and HB 464 are quite distinct. As such, we will address them in turn.

Utah SB 194

SB 194 requires covered entities to:

• implement an age assurance system that determines whether new and existing account holders are minors, with a 95 percent accuracy level;
• receive parental consent before collecting, using, or disclosing minors’ personal information;
• provide opt-in supervisory tools at the minor’s discretion (notably, the law does not require the supervisor to be a parent), including tools that allow the supervisor to set time limits, schedule breaks, and view certain settings in the minor’s account; and
• disable features that prolong minors’ engagement, including autoplay, infinite scroll, and push notifications.

The law also includes a number of requirements regarding the data privacy and security of minors’ data, including:

• setting maximum default privacy settings, including:
  • restricting minors’ account visibility and ability to share or direct message to only connected accounts;
  • disabling search engine indexing of minors’ accounts; and
  • restricting data collection/sale of data to what is required for core functioning of the service;
• implementing and maintaining security measures to protect minors’ personal information;
• providing a privacy notice explaining what information may be collected from a minor’s account, and how it is used or disclosed; and
• upon the minor’s request, deleting the minors’ information or material made publicly available by the minor via the service.

These provisions can only be enforced by the Utah Division of Consumer Protection. Companies may be fined a civil penalty up to $2,500 per violation, either in court or as imposed by the Division director. If the Division brings an action in court, the court may also order disgorgement, award actual damages, and attorneys fees, court costs, and investigative fees incurred by the government. Any entity that subsequently violates its administrative or court order may be subject to a civil penalty of up to $5,000 per violation.

Importantly, SB 194 contains a safe harbor whereby a company that creates an age assurance system and verifies parental consent according to the criteria established by the Division of Consumer Protection cannot be subject to an enforcement action. The Division will likely come out with proposed rules in the next few months.

Utah HB 464

HB 464 creates a private right of action for any adverse mental health outcome caused (in whole or part) by a Utah minor account holder's excessive use of a social media company's algorithmically curated social media service.

The bill includes a rebuttable presumption in favor of the minor that harm was caused by excessive use. Although it claims to offer an affirmative defense for social media companies to defend against the private right of action, it is simply a rebuttable presumption in favor of the company that the harm was not caused by excessive use. This means a company could still be subject to liability even if it meets the criteria for the rebuttable presumption in its favor.

To take advantage of the rebuttable presumption, the company must demonstrate that it:

• disables engagement driven design elements (autoplay, infinite scroll, push notifications), which is already required by SB 194;
• limits a Utah minor’s use of the service to three hours per day across all devices;
• imposes a curfew that restricts a Utah minor from using the service from 10:30 p.m.-6:30 a.m. MT; and
• requires parental consent for the minor’s use of the service.

The minor or their parent or guardian can bring a private right of action against the company and, if successful, can be awarded $10,000 for each adverse mental health outcome incidence or actual damages (whichever is greater), and attorney fees and costs. The company can’t be held liable based on the content of material posted by the service’s users. There is no state enforcement of HB 464.

Key Takeaways

Minors’ online privacy and safety is at the center of attention for state, federal, and international lawmakers. If you have a website or application that may have minors using the service, it is important to monitor legislative and regulatory developments in this space to ensure that your business is keeping up with compliance obligations.¹ And while some of these laws are facing legal challenges, in the case of Utah, the passage of these Social Media Amendments signal that the Utah legislature and governor believe this law will be able to survive a legal challenge.

Wilson Sonsini Goodrich & Rosati routinely helps companies navigate complex online privacy, security, and safety issues, especially in the area of children’s and minors’ data. We will continue to monitor guidance and other state-level developments to assist clients with compliance. For more information or advice concerning your compliance efforts, please contact Deno Himonas, Christopher Olsen, Larissa Lee, Rebecca Weitzel Garcia, or any member of the firm’s litigation or privacy and cybersecurity practices.

---

^[1]The Wilson Sonsini Data Advisor regularly issues alerts on these topics. We have previously issued alerts regarding the Texas social media law, the New York settlement with the College Board, the Federal Trade Commission’s ongoing COPPA rulemaking, the multi-state suit against Meta for alleged children and teen harms, and the UK Privacy Regulator’s continued focus on children’s privacy, among others.