Yesterday, Utah’s Social Media Regulation Act (“SMRA”) was signed into law by Gov. Spencer Cox.
The SMRA applies to businesses that provide a social media platform with at least five (5) million account holders worldwide. The definition of “social media platform” is broad but includes 24 exceptions that generally narrow the SMRA’s scope to a lay-person’s typical understanding of a social media platform.
It goes into effect on May 3, 2023 with numerous compliance requirements and prohibitions for social media platforms coming into force beginning March 1, 2024.
Requirements:
- Verify the age of an existing or new Utah account holder.
- Obtain parental or guardian consent for minor accounts.
- If age and parental/guardian consent cannot be verified, then access to the account shall be denied.
- Prohibit minor account holders from accessing their accounts between the hours of 10:30pm and 6:30am (with the time zone based on IP address) unless the consenting parent/guardian changes the default setting.
- Provide the consenting parent or guardian with a means to:
- access the minor’s account;
- view all posts the minor has made;
- view all responses and messages sent to, or by, the minor account holder; and
- change or eliminate the minor account holder’s permitted access time to use their account.
Prohibitions:
- Do not permit direct messaging between an account held by a minor and an account held by another user that is not linked to the minor’s account through “friending.”
- Do not display a minor’s account in search results for another user that is not linked to the minor’s account through “friending.”
- Do not display any advertising in the minor’s account.
- Do not collect or use any personal information from the posts, content, messages, text, or usage activities of the minor’s account subject to an “as necessary to comply with law” exception.
- Do not target or suggest groups, services, products, posts, accounts, or users in the minor’s account.
The SMRA also establishes the Division of Consumer Protection, which is tasked with enforcement and promulgating rules with respect to nine (9) different topics, which include age verification, identification standard for age verification, what constitutes parental/guardian consent and data handling requirements.
Additionally, the SMRA provides a private right of action that allows plaintiffs to recover attorney’s fees, court costs, and the greater of $2,500 per violation or actual damages. The Utah Attorney General’s enforcement powers include injunctive relief, ordering disgorgement of any money received from violations, civil penalties of $2,500 per violation, and actual damages. Notably, organizations are entitled to a 30-day cure period when they receive a notice of violations from the Utah Attorney General.
Readers may recall that California’s Age-Appropriate Design Code Act (“AADA”) is effective as of July 1, 2024, which means that social media platforms will likely have compliance obligations under both the SMRA and AADA. Conceptually, the SMRA is focused on providing parental oversight to minor’s social media usage while the AADA is focused on how an online service “likely to be accessed by children” is designed. Both laws do, however, aim to provide additional privacy controls within the online service to protect minor users and limit the use of their personal information.
Our team has prepared the below chart as a reference guide when comparing the SMRA and AADA. This chart is not an exhaustive list of all requirements and prohibitions for either law. Each topic has some slight nuances, but the chart does flag relevant overlaps. We encourage you to contact the authors for more detailed information.
Topics | UT SMRA | CA AADA |
Key Requirements |
||
Perform Data Privacy Impact Assessment |
X |
|
Perform age verification for all account holders | X | X |
Obtain parental consent for minors’ accounts | X | |
Provide parental controls for minors’ account | X | |
Include heightened default privacy settings for minors’ accounts | X | X |
Provide special notices for data collection | X | |
Key Prohibitions |
||
No Dark patterns | X | |
No Profiling | X | |
No advertising and “suggestions” of groups, services, posts, etc. | X | |
No collection, use, sale or sharing of personal information from minor’s account (subject to limited exceptions) | X | X |
No use of personal information collected for age verification for other purposes | X | X |
Other |
||
“Minor” and “Child”/“Children” means <18yrs of age | X | X |
Private right of action | X |
Several other child-focused internet privacy laws were introduced in state legislatures during the first quarter of 2023, including most recently, Maryland’s proposed Age-Appropriate Design Code Act which the Maryland House passed on March 20th.
As regulations are promulgated by the Division to support the SMRA, the PW team will monitor to keep you in the loop. The SMRA may be challenged as an unconstitutional encroachment on free speech, as has the AADA. We will also keep you informed on these developments as well as other children’s privacy and content laws develop across the U.S.