Publishes adult content, in Utah

Utah Code 13-44-201 · Read the law's page

• This binds any person who conducts business in Utah and maintains personal information collected or maintained in the regular course of business.
• Implement and maintain reasonable procedures to prevent the unlawful use or disclosure of that personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by the method the section specifies.
• There is no private right of action for a violation of this section; only the Utah Attorney General may enforce this chapter.

Utah Code 78B-4-701 to 78B-4-704 · Read the law's page

• This is a defense available to any person sued in Utah on a claim arising from a breach of system security; it creates no independent duty to adopt a cybersecurity program, and under section 78B-4-704 may not be construed to create a private cause of action, including a class action, for failing to comply with it.
• To claim the defense against a claim of failing to implement reasonable information security controls, failing to appropriately respond to a breach, or failing to appropriately notify an affected individual, have in place at the time of the breach a written cybersecurity program designed to protect the type of personal information at issue and scaled to your size, complexity, activities, and the sensitivity of the information you hold.
• Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.
• Update the program to a revised framework within one year of the revision's publication, and to an amended regulation within a reasonable time weighed against the risk to personal information and the cost and effort of compliance.
• The defense is unavailable if you had actual notice of a threat or hazard to the information's security and did not act in a reasonable amount of time to take known remedial efforts before it resulted in the breach; a risk assessment to improve security is not itself actual notice.

Utah Code Ann. sections 78B-3-1001 to 78B-3-1008 (Title 78B, ch. 3, pt. 10), as amended by 2026 Utah Laws (S.B. 73) · Read the law's page

• Verify that Utah visitors are 18 or older using a digitized identification card, an independent third party age verification service, or a commercially reasonable method relying on transactional data.
• Treat a visitor actually located in Utah as accessing the site from Utah, and so subject to age verification, even when the visitor connects through a VPN.
• Pay a 2 percent excise tax on your covered content revenue from October 1, 2026.

Utah Code 13-72b-101 et seq. · Read the law's page

• Do not distribute a counterfeit intimate image of an identifiable individual without first obtaining that individual's affirmative consent, if you operate a generation service
• Verify the identity of the person giving consent and keep a record of the consent for at least seven years
• Give users a clear way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, if you operate a covered platform
• This chapter takes effect 1 January 2027, so it is a duty to prepare for rather than one owed today