Utah

HB 276 (2026 General Session) creates new Chapter 72b, the Digital Voyeurism Prevention Act, effective 1 January 2027. A generation service, a person operating an interactive computer service that lets users generate intimate images using artificial intelligence technology, may not distribute a counterfeit intimate image of an identifiable individual without first obtaining that individual's affirmative, identity-verified consent, and must keep a record of the consent for at least seven years.

An injured individual may bring a civil action for an injunction, actual and punitive damages, and attorney fees, without needing to plead or prove actual damages. A generation service that maintains and follows a qualifying consent system and written policy, and responds promptly once it learns of a violation, has a safe harbor from that civil liability.

A covered platform must give users a way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, and a platform that follows those notice-and-takedown procedures in good faith is not liable for anything posted before it received notice.

SB 256 (2026 General Session), effective 6 May 2026, enacts Utah Code 45-2-3.5 to provide that it is not a defense to a libel or slander claim that the communication was created through generative artificial intelligence, computer animation, digital manipulation, or another technological means, or that it uses simulated content rather than an actual recording.

A new Section 45-2-14 requires written notice to the publisher before filing such an action and limits recovery to actual damages if the publisher removes the content within 10 days of notice.

The bill also amends Title 45 Chapter 3, the Abuse of Personal Identity Act, so that every individual's exclusive right to consent to use of their personal identity includes a replication right reaching an AI-generated, computer-animated, or digitally manipulated simulation of their likeness or voice; a person whose identity is abused, including through unauthorized distribution of or trafficking in identity-replication tools, may sue for injunctive relief, damages, exemplary damages, and attorney fees. The chapter does not impose liability on an interactive computer service for content provided by another person.

SB 319 (2026 General Session) amends Utah Code 31A-22-650, effective 1 January 2027, to require a health insurer to disclose to the Insurance Department, to each network health care provider, and to each enrollee whether the insurer uses artificial intelligence in reviewing a preauthorization request, and to post that fact and its preauthorization statistics on its website.

An adverse preauthorization determination on clinical or medical necessity must be made using independent medical judgment and may not rely solely on a recommendation from any other source. The same bill sets a minimum authorization validity period of at least 12 months for a drug, device, or covered service treating a chronic or long-term care condition (shorter only for an experimental drug or on specified grounds). It separately sets a minimum authorization validity period of at least six months for an outpatient covered service.

HB 276 (2026 General Session), enacted as Chapter 352, Laws of Utah 2026, creates new Chapter 72c, the Digital Content Provenance Standards Act, effective 1 January 2027.

A large online platform (a public-facing social media, mass-messaging, or standalone search-engine service that exceeded 2,000,000 unique monthly users in the preceding 12 months) must detect compliant system provenance data in distributed content, give users a way to see it, and not knowingly strip it where technically feasible.

A covered provider (a person whose generative AI system has over 1,000,000 monthly visitors or users and is publicly accessible in the state) must include a latent disclosure in image, video, or audio content its system creates or substantially modifies. A capture device manufacturer must separately include a latent disclosure in captured content, for a device it produces for sale in the state on or after 1 January 2028.

The Division of Consumer Protection enforces the chapter, with an administrative fine of up to $2,500 per violation and equivalent court remedies.

A supplier of a mental health chatbot, an AI system that simulates the kind of confidential conversation a licensed mental health therapist would have and that the supplier represents or a reasonable person would believe can provide therapy, must cause the chatbot to clearly and conspicuously disclose it is artificial intelligence and not human.

The disclosure must occur before the user can access the chatbot's features, at the start of any interaction after seven days of non-use, and any time the user asks whether AI is being used. This duty is proactive and recurring, materially stronger than the general Chapter 77 duty, and unamended since enactment even though adjoining definitions and enforcement sections were touched in the 2026 session.

A supplier using generative AI to interact with an individual in a consumer transaction must disclose that the individual is interacting with generative AI, but only if the individual makes a clear and unambiguous request.

An individual in a state-regulated occupation must proactively and prominently disclose generative AI use, verbally or in writing as applicable, but only where the interaction meets the statute's high-risk definition (collection of sensitive health, financial, or biometric information, or advice relied on for significant decisions).

This duty was enacted by SB 226 (2025), which repealed a broader duty SB 149 (2024) had placed at the former Utah Code 13-2-12 inside the original Artificial Intelligence Policy Act. The 2026 session claimed Chapters 75 and 76 for the Franchise Protection Act and the App Store Accountability Act, so the compiled code now carries this same duty, unchanged in text and in its 7 May 2025 effective date, at Chapter 77, Utah Code 13-77-103 to 13-77-104.

SB 332 (2025) separately extended the sunset of the Artificial Intelligence Policy Act itself, Chapter 72, to 1 July 2027 without touching this disclosure duty. A safe harbor at 13-77-104 excuses a supplier whose generative AI clearly and conspicuously discloses its non-human nature throughout the interaction.

Requires a person, a term Utah's general Title 68 definitions make broad enough to include a governmental subdivision or agency as well as a private business, who conducts business in Utah and maintains a resident's personal information (a name combined with an unencrypted Social Security number, driver license or state ID number, or financial account or card number with its access code) to implement reasonable procedures against unlawful use or disclosure and to destroy records no longer needed.

On a breach, the person must investigate in good faith and notify each affected Utah resident without unreasonable delay; a breach affecting 500 or more residents also triggers notice to the Attorney General and the Utah Cyber Center, added by a 2024 amendment, and one affecting 1,000 or more also triggers notice to nationwide consumer reporting agencies. Only a financial institution or its affiliate is exempt; unlike UCPA, no governmental-entity exemption appears anywhere in this chapter.

Utah's omnibus consumer-data-privacy statute, enacted as S.B. 227 (Chapter 462, 2022 General Session). Applies only to a controller or processor doing business in or targeting Utah consumers with 25 million dollars or more in annual revenue and either 100,000 or more consumers processed a year, or 25,000 or more consumers processed while deriving over half of revenue from data sales.

Exempts government entities and their contractors, tribes, higher-education institutions, nonprofits, Health Insurance Portability and Accountability Act (HIPAA)-covered entities, and several other sectoral categories. Gives consumers access, deletion, correction, portability, and opt-out rights exercisable against the controller within 45 days, extendable once by 45 more days. The Attorney General has exclusive enforcement authority with a mandatory 30-day cure period, and the Act bars any private right of action.

Not yet in effect. Once effective, bars a medical facility or genomic research facility from using a genetic sequencer or sequencing software that is a final product of, or distributed by, a foreign adversary, its state-owned enterprise, or a person domiciled there.

Bars storing genetic-sequencing data within the territory of a foreign adversary, and bars remote access to stored sequencing data from within a foreign adversary absent written department approval, with an exemption for open, public-domain data and for certain clinical-trial data.

Requires a sworn compliance statement to the Attorney General and the state health department every 10 years, though that reporting duty does not apply to an entity already covered by the Genetic Information Privacy Act. The Attorney General has sole enforcement authority; fines of 10,000 dollars per violation become enforceable 1 May 2028.

Enacted as a new Part 5 of UCPA by the 2026 General Session (Chapter 193), requires a motor vehicle manufacturer selling or leasing vehicles in Utah to provide, for model year 2030 and later vehicles, in-vehicle privacy controls letting a consumer view the categories of personal data the vehicle's data collection system collects and shares, opt out of sale or targeted-advertising processing, and delete readily accessible data, defined conjunctively as data the consumer directly input through the in-vehicle interface and that is stored locally on the vehicle.

Exempts data processed solely for vehicle safety, operation, or legal compliance, and data collected only for internal product improvement. Not yet in force.

Binds a direct-to-consumer genetic testing company, an entity that offers genetic testing products or services to consumers or that collects, uses, or analyzes genetic data a consumer provides. Requires a public privacy notice and the consumer's initial express consent to collect, use, or disclose genetic data, plus separate express consent to transfer or disclose the data beyond the company's vendors, to use it beyond the primary testing purpose, or to retain a biological sample after testing.

Requires valid legal process for law-enforcement disclosure absent express written consent, a comprehensive security program, and a process for a consumer to access their genetic data, delete their account and data, and have their biological sample destroyed. Bars disclosure to health, life, or long-term-care insurers or to the consumer's employer without written consent. Originally enacted in 2021 (Chapter 361), renumbered and amended into its current Part 1 structure in 2023 (Chapter 327).

Defines biometric data as data generated by automatic measurement of an individual's unique biological characteristics, naming fingerprint, voiceprint, retina, iris, or any other unique biological pattern used to identify a specific individual, but excludes any physical or digital photograph, video or audio recording, or data generated from one.

Biometric and genetic data become sensitive data, alongside racial or ethnic origin, religious belief, sexual orientation, citizenship or immigration status, certain medical information, and specific geolocation, only when processed for the purpose of identifying a specific individual. A controller may not process sensitive data without first giving clear notice and an opportunity to opt out, an opt-out rather than opt-in model.

Section 76-6-703(2)(a) reaches a person who, without authorization or in excess of authorization, accesses or attempts to access computer technology where that access results in the alteration, damage, destruction, copying, transmission, discovery, or disclosure of computer technology, and computer technology expressly includes computer data, so unauthorized copying of scraped data falls within the statute's plain text once without or exceeding authorization is shown.

Section 76-6-702(2) defines authorization as the express or implied consent or permission of the owner to access a computer in a manner not exceeding that consent, and this express recognition of implied consent textually supports treating ordinary access to a public, unrestricted page as impliedly authorized absent a revocation event, though no Utah court has confirmed this reading.

Both provisions were confirmed against Utah's own official code site; Section 76-6-703 carries an effective date of May 3, 2023 on its own page.

Section 13-61-101(29) defines publicly available information with three prongs: information a person lawfully obtains from a governmental record, information a consumer or widely distributed media has lawfully made available to the general public, or information obtained from a person the consumer disclosed it to without restricting the audience, a near match to California's CCPA test and broader than Colorado's two-prong version.

Personal data scraped from a source that is neither a government record nor something the consumer themselves put out, such as a data broker or re-hosted directory, is not publicly available under this Act.

Biometric data under Section 13-61-101(6) means data from automatic measurement of an individual's unique biological characteristics used to identify a specific individual, and expressly excludes a physical or digital photograph, a video or audio recording, and data generated from either, the same structural exclusion Colorado uses.

Processing genetic or biometric data for the purpose of identifying a specific individual is sensitive data under Section 13-61-101(32)(a)(ii), triggering opt-in consent. Enforcement is Attorney-General-exclusive with a 30-day cure period and no private right of action; the Act took effect December 31, 2023.

Section 13-11-4 reaches only a deceptive act or practice by a supplier in connection with a consumer transaction, narrower in scope than California's UCL or Colorado's Consumer Protection Act, which are not limited to a transaction between the defendant and the plaintiff.

A scraper is unlikely to be a supplier transacting with the scraped site's operator as a consumer, so this statute likely does not reach scraping or misappropriation claims at all, a genuine narrowing relative to California specifically even though it largely restates the federal FTC Act's own transaction-oriented baseline.

This is flagged as a low-confidence, inclusive raise rather than a confirmed reach: no Utah case has tested it against a scraping fact pattern, and the statute's own text points the other way.

The Cybersecurity Affirmative Defense Act, Utah Code 78B-4-701 to 78B-4-704, enacted by Chapter 40 of the 2021 General Session and effective May 5, 2021, gives a person sued in a Utah court on a claim arising from a breach of system security three affirmative defenses where a qualifying written cybersecurity program was in place at the time of the breach: a defense to a claim that the person failed to implement reasonable information security controls, a defense to a claim that the person failed to appropriately respond to the breach, and a defense to a claim that the person failed to appropriately notify an affected individual.

A qualifying program must be designed to protect the type of personal information obtained in the breach, be of a scale and scope appropriate to the person's size, complexity and activities and the sensitivity of the information, and either operate as a reasonable security program with a designated coordinator, detection and response procedures, employee training, and periodic risk assessment and adjustment, or reasonably conform to a named industry framework: NIST Special Publication 800-171; NIST Special Publications 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the Center for Internet Security Critical Security Controls; the ISO/IEC 27000 family; the Health Insurance Portability and Accountability Act (HIPAA) Security Rule or Gramm-Leach-Bliley Title V regulations, for personal information those regimes already cover; or the PCI Data Security Standard, for payment card information.

A person loses the defense if it had actual notice of a threat or hazard to the information's security and did not act in a reasonable time to remediate it before the breach resulted; a risk assessment alone is not actual notice.

The Act imposes no duty to adopt a program and, by its own terms, may not be construed to create a private cause of action, including a class action, for a person's failure to comply with it: it is a defendant's shield, never a plaintiff's remedy, and Utah Code 13-44-201, researched separately below, is the reasonable-procedures duty the shield answers.

Utah Code 13-44-201, part of the Protection of Personal Information Act and effective May 14, 2019, requires any person who conducts business in the state and maintains personal information, reaching a governmental entity conducting business as well as a private business, the same broad reading of 'person' this jurisdiction's privacy-topic row already applies to the Act's breach-notification duty, to implement and maintain reasonable procedures to prevent the unlawful use or disclosure of personal information collected or maintained in the regular course of business, and to destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by a method the section specifies.

The section states no further content for what 'reasonable' requires beyond that general standard, and, like the rest of the chapter, creates no private right of action: only the Attorney General may enforce it. The chapter's own breach-notification duty, requiring notice to an affected Utah resident and, for a large breach, to the Attorney General and the Utah Cyber Center, is this jurisdiction's privacy-topic row rather than repeated here.

Makes a commercial entity that publishes material harmful to minors on a website where more than one third of total material is harmful to minors civilly liable if it fails to verify that Utah visitors are 18 or older using a digitized identification card, an independent third party age verification service, or a commercially reasonable method relying on transactional data.

SB 73 (2026) added Division of Consumer Protection enforcement effective May 6, 2026, a rule treating a user as accessing the site from Utah even through a VPN, and a 2 percent excise tax on covered content revenue effective October 1, 2026 that funds youth mental health programs and enforcement.

Requires app store providers to verify a user's age category, link a minor's account to a parent account, and obtain parental consent before a minor can download or purchase an app, including preinstalled apps. The original Act was signed March 26, 2025 with a May 6, 2026 compliance deadline.

A 2026 amendment (HB 498, signed March 18, 2026) removed Attorney General enforcement, limited enforcement to a private right of action with damages up to $1,000 per violation, extended coverage to preinstalled apps, and delayed the compliance deadline one year to May 6, 2027.