Operates a social platform, in Utah

Utah Code 13-44-201 · Read the law's page

• This binds any person who conducts business in Utah and maintains personal information collected or maintained in the regular course of business.
• Implement and maintain reasonable procedures to prevent the unlawful use or disclosure of that personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by the method the section specifies.
• There is no private right of action for a violation of this section; only the Utah Attorney General may enforce this chapter.

Utah Code 78B-4-701 to 78B-4-704 · Read the law's page

• This is a defense available to any person sued in Utah on a claim arising from a breach of system security; it creates no independent duty to adopt a cybersecurity program, and under section 78B-4-704 may not be construed to create a private cause of action, including a class action, for failing to comply with it.
• To claim the defense against a claim of failing to implement reasonable information security controls, failing to appropriately respond to a breach, or failing to appropriately notify an affected individual, have in place at the time of the breach a written cybersecurity program designed to protect the type of personal information at issue and scaled to your size, complexity, activities, and the sensitivity of the information you hold.
• Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.
• Update the program to a revised framework within one year of the revision's publication, and to an amended regulation within a reasonable time weighed against the risk to personal information and the cost and effort of compliance.
• The defense is unavailable if you had actual notice of a threat or hazard to the information's security and did not act in a reasonable amount of time to take known remedial efforts before it resulted in the breach; a risk assessment to improve security is not itself actual notice.

Utah Code Ann. sections 13-71-101 to 13-71-401 · Read the law's page

• If you are a social media company operating in Utah, implement an age assurance system for Utah account holders.
• Apply default protections for known minors.
• Let verified parents supervise a minor's account.

Utah Code 13-72b-101 et seq. · Read the law's page

• Do not distribute a counterfeit intimate image of an identifiable individual without first obtaining that individual's affirmative consent, if you operate a generation service
• Verify the identity of the person giving consent and keep a record of the consent for at least seven years
• Give users a clear way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, if you operate a covered platform
• This chapter takes effect 1 January 2027, so it is a duty to prepare for rather than one owed today

Utah Code 13-72c-101 et seq. · Read the law's page

• Detect whether compliant system provenance data is embedded in content you distribute, give users a way to see and download it, and do not knowingly strip it where technically feasible, if you operate a large online platform with over 2,000,000 unique monthly users
• Include a latent disclosure in image, video, or audio content your generative AI system creates or substantially modifies, if your system has over 1,000,000 monthly visitors or users and is publicly accessible in the state
• Include a latent disclosure identifying your device or proving whether content was AI-created or altered, if you manufacture capture devices for sale in the state, starting 1 January 2028
• This chapter takes effect 1 January 2027, so it is a duty to prepare for rather than one owed today