Utah

HB 276 (2026 General Session) creates new Chapter 72b, the Digital Voyeurism Prevention Act, effective 1 January 2027. A generation service, a person operating an interactive computer service that lets users generate intimate images using artificial intelligence technology, may not distribute a counterfeit intimate image of an identifiable individual without first obtaining that individual's affirmative, identity-verified consent, and must keep a record of the consent for at least seven years.

An injured individual may bring a civil action for an injunction, actual and punitive damages, and attorney fees, without needing to plead or prove actual damages. A generation service that maintains and follows a qualifying consent system and written policy, and responds promptly once it learns of a violation, has a safe harbor from that civil liability.

A covered platform must give users a way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, and a platform that follows those notice-and-takedown procedures in good faith is not liable for anything posted before it received notice.

SB 256 (2026 General Session), effective 6 May 2026, enacts Utah Code 45-2-3.5 to provide that it is not a defense to a libel or slander claim that the communication was created through generative artificial intelligence, computer animation, digital manipulation, or another technological means, or that it uses simulated content rather than an actual recording.

A new Section 45-2-14 requires written notice to the publisher before filing such an action and limits recovery to actual damages if the publisher removes the content within 10 days of notice.

The bill also amends Title 45 Chapter 3, the Abuse of Personal Identity Act, so that every individual's exclusive right to consent to use of their personal identity includes a replication right reaching an AI-generated, computer-animated, or digitally manipulated simulation of their likeness or voice; a person whose identity is abused, including through unauthorized distribution of or trafficking in identity-replication tools, may sue for injunctive relief, damages, exemplary damages, and attorney fees. The chapter does not impose liability on an interactive computer service for content provided by another person.

SB 319 (2026 General Session) amends Utah Code 31A-22-650, effective 1 January 2027, to require a health insurer to disclose to the Insurance Department, to each network health care provider, and to each enrollee whether the insurer uses artificial intelligence in reviewing a preauthorization request, and to post that fact and its preauthorization statistics on its website.

An adverse preauthorization determination on clinical or medical necessity must be made using independent medical judgment and may not rely solely on a recommendation from any other source. The same bill sets a minimum authorization validity period of at least 12 months for a drug, device, or covered service treating a chronic or long-term care condition (shorter only for an experimental drug or on specified grounds). It separately sets a minimum authorization validity period of at least six months for an outpatient covered service.

HB 276 (2026 General Session), enacted as Chapter 352, Laws of Utah 2026, creates new Chapter 72c, the Digital Content Provenance Standards Act, effective 1 January 2027.

A large online platform (a public-facing social media, mass-messaging, or standalone search-engine service that exceeded 2,000,000 unique monthly users in the preceding 12 months) must detect compliant system provenance data in distributed content, give users a way to see it, and not knowingly strip it where technically feasible.

A covered provider (a person whose generative AI system has over 1,000,000 monthly visitors or users and is publicly accessible in the state) must include a latent disclosure in image, video, or audio content its system creates or substantially modifies. A capture device manufacturer must separately include a latent disclosure in captured content, for a device it produces for sale in the state on or after 1 January 2028.

The Division of Consumer Protection enforces the chapter, with an administrative fine of up to $2,500 per violation and equivalent court remedies.

A supplier of a mental health chatbot, an AI system that simulates the kind of confidential conversation a licensed mental health therapist would have and that the supplier represents or a reasonable person would believe can provide therapy, must cause the chatbot to clearly and conspicuously disclose it is artificial intelligence and not human.

The disclosure must occur before the user can access the chatbot's features, at the start of any interaction after seven days of non-use, and any time the user asks whether AI is being used. This duty is proactive and recurring, materially stronger than the general Chapter 77 duty, and unamended since enactment even though adjoining definitions and enforcement sections were touched in the 2026 session.

A supplier using generative AI to interact with an individual in a consumer transaction must disclose that the individual is interacting with generative AI, but only if the individual makes a clear and unambiguous request.

An individual in a state-regulated occupation must proactively and prominently disclose generative AI use, verbally or in writing as applicable, but only where the interaction meets the statute's high-risk definition (collection of sensitive health, financial, or biometric information, or advice relied on for significant decisions).

This duty was enacted by SB 226 (2025), which repealed a broader duty SB 149 (2024) had placed at the former Utah Code 13-2-12 inside the original Artificial Intelligence Policy Act. The 2026 session claimed Chapters 75 and 76 for the Franchise Protection Act and the App Store Accountability Act, so the compiled code now carries this same duty, unchanged in text and in its 7 May 2025 effective date, at Chapter 77, Utah Code 13-77-103 to 13-77-104.

SB 332 (2025) separately extended the sunset of the Artificial Intelligence Policy Act itself, Chapter 72, to 1 July 2027 without touching this disclosure duty. A safe harbor at 13-77-104 excuses a supplier whose generative AI clearly and conspicuously discloses its non-human nature throughout the interaction.

The Governor signed Senate Bill 34 of the 2021 General Session on March 16, 2021, and the chapter took effect on May 5, 2021 as chapter 200 of the Laws of Utah 2021. Except as the chapter allows, a government entity may not use a facial recognition system on an image database. A government entity may not use a facial recognition system for a civil immigration violation.

Only a law enforcement agency may make a request for a government entity to conduct a facial recognition comparison using a facial recognition system. A trained employee completes a request only if it includes a case identification number and, for an investigation of a crime, is supported by a statement of the specific crime and a factual narrative.

A trained employee may comply only with requests made to investigate a felony, a violent crime or a threat to human life, or to identify an individual who is deceased, incapacitated or at risk and unable to provide his or her identity. To make a comparison, a trained employee must use a secure system that compares only facial biometric data and make an independent visual comparison of any possible match.

The employee must then seek a second opinion and report a result to the requesting law enforcement agency through an encrypted method, returning only a result that all trained employees agree is a probable match. The chapter defines the department as the Department of Public Safety. The department is the only government entity in the state authorized to use a facial recognition system to conduct a facial recognition comparison on an image database that it maintains or that is shared with it.

When capturing an image of an individual who interacts with it, a government entity must notify the individual that the image may be used in conjunction with facial recognition technology.

At least 30 days before a government entity other than the department begins using a facial recognition system on its image database, it must publish notice and a description of the database on its website, allow written public comment for 15 days, consider timely comments and post notice of its final decision. Data relating to a facial recognition comparison may not be used or shared for any purpose other than a purpose described in the chapter.

Upon request, a government entity must release statistical information regarding facial recognition comparisons. Between August 1 and October 15 each year, a government entity that uses a facial recognition system to conduct a comparison must report to the Government Operations Interim Committee the types of crime for which the department received a request, the number of requests for each type, the number of probable matches provided and the image source of each match.

When submitting a case to a prosecutor, a law enforcement agency must disclose in writing whether a facial recognition system was used in the investigation and, if so, how the comparison was used. A government entity includes an individual acting as an agent of a government entity or acting on behalf of one.

Section 406 first took effect on May 1, 2024. After determining the scope of a data breach, and restoring the reasonable integrity of the affected system if necessary, a governmental entity must cause a data breach notice to be sent without unreasonable delay to each affected individual or legal guardian.

No notice to an affected individual is required if the personal data involved would be a public record and the entity prominently posts notice of the data breach on the homepage of its government website. The entity or its contractor must delay notice at the request of a law enforcement agency that determines notification may impede a criminal investigation.

The notice must include a description of the data breach, the individual's personal data that was or may have been accessed, the steps taken to mitigate the impact, and recommendations on protecting against identity theft and other financial losses.

Notice must go by email, if reasonably available and allowed by law, or by mail, and also by text message or telephone message with a summary and instructions for the full notice where the individual's contact information is reasonably available and the method is allowed by law.

If a breach affects more than 500 individuals and the entity cannot obtain an individual's contact information, it must also give notice in a manner reasonably calculated to reach the individual, such as a press release, social media posting or newspaper notice.

Requires a person, a term Utah's general Title 68 definitions make broad enough to include a governmental subdivision or agency as well as a private business, who conducts business in Utah and maintains a resident's personal information (a name combined with an unencrypted Social Security number, driver license or state ID number, or financial account or card number with its access code) to implement reasonable procedures against unlawful use or disclosure and to destroy records no longer needed.

On a breach, the person must investigate in good faith and notify each affected Utah resident without unreasonable delay; a breach affecting 500 or more residents also triggers notice to the Attorney General and the Utah Cyber Center, added by a 2024 amendment, and one affecting 1,000 or more also triggers notice to nationwide consumer reporting agencies. Only a financial institution or its affiliate is exempt; unlike UCPA, no governmental-entity exemption appears anywhere in this chapter.

The Government Data Privacy Act took effect on May 1, 2024. A governmental entity must obtain and process only the minimum amount of personal data reasonably necessary to efficiently achieve a specified purpose. It must initiate a data privacy program before December 31, 2025.

For any processing activity implemented before May 7, 2025, it must identify any non-compliant activity and prepare a strategy for bringing it into compliance, as soon as reasonably practicable and no later than July 1, 2027. It may not establish, maintain or use undisclosed or covert surveillance of individuals unless permitted by law, may not sell personal data unless expressly required by law, and may not share personal data unless permitted by law.

Beginning July 1, 2027, a state agency must make a complete and accurate privacy annotation for each record series containing personal data that it collects, maintains or uses, and after that date may not collect, maintain or use the personal data in a record series without one. An employee who has access to personal data, or who supervises an employee who does, must complete data privacy training within 30 days after beginning employment and at least once in each calendar year.

On or before December 31 of each year, the chief administrative officer of each governmental entity must prepare a privacy program report. The report must be shared with the Office of Data Privacy on or before December 31 each year and retained for no less than five years. A governmental entity that collects personal data must retain and dispose of it in accordance with a documented record retention schedule.

The State Auditor must give an entity a chance to cure a substantiated violation within 30 days. After a referral, the Attorney General may file an action in district court to enjoin an entity that is not a state agency from violating the chapter or to require it to comply.

House Bill 444 of the 2025 General Session enacted section 401.4, and the Governor signed it on March 27, 2025. A contractor that processes or has access to personal data as a part of its duties under a contract with a governmental entity is subject to the requirements of the Government Data Privacy Act to the same extent as the governmental entity, for that personal data.

A contractor is a person who has entered into a contract with a governmental entity and may process personal data under it, and includes the contractor's employees, agents and subcontractors. A contract entered into or renewed between a contractor and a governmental entity after July 1, 2027 must contain specific language requiring the contractor to comply with the chapter for the personal data it processes or accesses, to the same extent as the governmental entity.

A contractor is not subject to the data privacy training program requirements of section 401.2. These requirements are in addition to any other requirements or liability for the contractor's violation of other laws protecting privacy rights or government records.

Utah's omnibus consumer-data-privacy statute, enacted as S.B. 227 (Chapter 462, 2022 General Session). Applies only to a controller or processor doing business in or targeting Utah consumers with 25 million dollars or more in annual revenue and either 100,000 or more consumers processed a year, or 25,000 or more consumers processed while deriving over half of revenue from data sales.

Exempts government entities and their contractors, tribes, higher-education institutions, nonprofits, Health Insurance Portability and Accountability Act (HIPAA)-covered entities, and several other sectoral categories. Gives consumers access, deletion, correction, portability, and opt-out rights exercisable against the controller within 45 days, extendable once by 45 more days. The Attorney General has exclusive enforcement authority with a mandatory 30-day cure period, and the Act bars any private right of action.

Effective 1 January 2028. Bars a medical facility or genomic research facility from using a genetic sequencer or sequencing software that is a final product of, or distributed by, a foreign adversary, its state-owned enterprise, or a person domiciled there.

Bars storing genetic-sequencing data within the territory of a foreign adversary, and bars remote access to stored sequencing data from within a foreign adversary absent written department approval, with an exemption for open, public-domain data and for certain clinical-trial data.

Requires a sworn compliance statement to the Attorney General and the state health department every 10 years, though that reporting duty does not apply to an entity already covered by the Genetic Information Privacy Act. The Attorney General has sole enforcement authority; fines of 10,000 dollars per violation become enforceable 1 May 2028.

Section 403 first took effect on May 1, 2024. A governmental entity that collects personal data must provide a procedure by which an individual or legal guardian may request an amendment or correction of personal data furnished to the entity and of information concerning an identifiable individual in a record it maintains, as allowed by law. The procedure does not obligate the governmental entity to make the requested amendment or correction.

Section 502, which took effect on May 6, 2026, requires an individual who makes a data privacy complaint to submit it first to the chief administrative officer of the governmental entity, who must attempt to resolve it. If the chief administrative officer cannot resolve the complaint, the individual or the governmental entity may request mediation with the data privacy ombudsperson.

An employee of a governmental entity may submit a confidential and anonymous data privacy complaint directly to the attorney general and is entitled to the protections of the Utah Protection of Public Employees Act.

Enacted as a new Part 5 of UCPA by the 2026 General Session (Chapter 193), requires a motor vehicle manufacturer selling or leasing vehicles in Utah to provide, for model year 2030 and later vehicles, in-vehicle privacy controls letting a consumer view the categories of personal data the vehicle's data collection system collects and shares, opt out of sale or targeted-advertising processing, and delete readily accessible data, defined conjunctively as data the consumer directly input through the in-vehicle interface and that is stored locally on the vehicle.

Exempts data processed solely for vehicle safety, operation, or legal compliance, and data collected only for internal product improvement.

A patient or a patient's personal representative may inspect or receive a copy of the patient's records from a health care provider when that provider is governed by the federal Standards for Privacy of Individually Identifiable Health Information. When a health care provider is not governed by those standards, a patient or a patient's personal representative may inspect or receive a copy of the patient's records unless access to the records is restricted by law or judicial order.

A health care provider who provides a paper or electronic copy of a patient's records to the patient or the patient's personal representative shall provide the copy within the deadlines required by the federal Administrative Simplification rule and may charge a reasonable cost-based fee that includes only the cost of copying and postage.

A health care provider or its third-party service that provides a copy of a patient's records to a patient's attorney, legal representative, or other authorized third party shall provide the copy within 30 days after receipt of notice, may charge no more than the rates the section sets, and must waive 50% of the fee if the records are not postmarked or made available electronically within 30 days and provide them free of charge if not within 60 days.

A health care provider or third-party service that fails to fulfill a request for payment and balance information within 30 days shall pay as a penalty $50 and an additional $150 if it fails to fulfill the request within 60 days, applied to the patient's balance or paid to the patient. A health care provider that contracts with a third-party service to fulfill medical record requests shall file a statement with the Division of Professional Licensing.

The section was last amended by Chapter 277, 2025 General Session. The section's history note names only the act that last amended it, and no source that states the day on which the section came into force has been located.

The rule governs a licensee's treatment of an individual's nonpublic personal health information and nonpublic personal financial information, and applies to a licensee who obtains nonpublic personal financial information or nonpublic personal health information regarding a customer or consumer of a product or service primarily for a personal, family, or household purpose.

A licensee must provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a customer no later than when the licensee establishes a customer relationship, and to a consumer before it discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party other than as the rule authorizes.

A licensee must provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than once in a 12 consecutive month period during the continuation of the customer relationship.

A licensee may not, directly or through any affiliate, disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it provides the consumer an initial notice, an opt out notice and a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out.

A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer before the disclosure, except for the insurance functions the rule lists. A licensee may not discriminate against a consumer or customer because the consumer or customer opted out from the disclosure of their nonpublic personal financial information or did not authorize the disclosure of their nonpublic personal health information.

The rule does not apply to a licensee with information about a person who obtains a product or service for a business, commercial, or agricultural purpose, to a financial institution, to a securities broker or dealer, or to a credit union that engages in an activity that does not require a license from the commissioner.

If a licensee complies with all requirements of the Health Insurance Portability and Accountability Act other than its effective date provision, the licensee is not subject to Sections R590-206-18 through R590-206-22. The rule's current text is effective November 21, 2023.

Section 402 first took effect on May 1, 2024, as a duty to provide a personal data request notice. A governmental entity must provide a privacy notice to an individual, or the legal guardian of an individual, from whom it requests or collects personal data. If the personal data would be classified as a public record, the notice is limited to a statement that the individual's personal data may be available to the public.

Otherwise the notice must describe all intended purposes and uses of the personal data, the consequences for refusing to provide it, the classes of persons and governmental entities with whom it is shared or to whom it is sold, and the record series in which it is included.

The entity must post the notice in a prominent place where it collects the data, include it in any document or form used to collect the data, or include in that document or form a conspicuous link or QR code to an electronic version. It may only use personal data furnished by an individual for the purposes identified in the privacy notice provided to that individual.

Section 402.5, which took effect on March 27, 2025, requires a government website to include notice to a user of the identity of the responsible governmental entity, how to contact it, and how a user may seek access to, request correction of, and file a complaint about the user's personal data or user data.

A government website that collects user data must also state in the notice the website tracking technology used, the user data collected, the intended purposes and uses, the classes of persons and governmental entities with whom the user data is shared or to whom it is sold, and the record series that include it. The notice must be posted prominently on the homepage of the government website, or the homepage must carry a link to a separate webpage containing it. A governmental entity may not collect user data on a government website unless it has complied with these requirements.

A commercial entity must give a person a notice if it enters into a consumer transaction with that person, obtains nonpublic personal information concerning the person as a result of the transaction, intends to or wants the ability to disclose the information to a third party for compensation, and the compensation is the primary consideration for, and directly related to, the disclosure.

The notice must be given before the earlier of the point at which the person is requested to provide the information or the commercial entity otherwise obtains it, and must read substantially as follows: "We may choose to disclose nonpublic personal information about you, the consumer, to a third party for compensation."

The notice may be oral if the consumer transaction itself is entirely conducted orally, or in writing if written in dark bold, and must be sufficiently conspicuous that a reasonable person would perceive it before providing the information.

A commercial entity is a person that maintains a physical office in the state and in the ordinary course transacts business at the physical office with consumers located in the state, and does not include a governmental entity or an entity providing services on behalf of one.

The chapter does not apply to a commercial entity subject to a federal law or regulation that governs the disclosure of nonpublic information to a third party or to a covered entity as defined in the federal health privacy rules, and notice is not required where the disclosure is related to the third party providing services, property or another thing of value to the commercial entity and the compensation is received in consideration of that transaction.

A commercial entity may not disclose nonpublic personal information that it obtained on or after January 1, 2004 as a result of a consumer transaction if it fails to give the required notice. As a person's only remedy, the person may bring an individual action, not a class action, and a commercial entity that violates the chapter is liable for $500 for each time it fails to provide the notice and court costs, in an action brought within one year from the day of the consumer transaction. The chapter was enacted by Chapter 97, 2003 General Session, and was last amended by Chapter 542, 2025 General Session.

Binds a direct-to-consumer genetic testing company, an entity that offers genetic testing products or services to consumers or that collects, uses, or analyzes genetic data a consumer provides. Requires a public privacy notice and the consumer's initial express consent to collect, use, or disclose genetic data, plus separate express consent to transfer or disclose the data beyond the company's vendors, to use it beyond the primary testing purpose, or to retain a biological sample after testing.

Requires valid legal process for law-enforcement disclosure absent express written consent, a comprehensive security program, and a process for a consumer to access their genetic data, delete their account and data, and have their biological sample destroyed. Bars disclosure to health, life, or long-term-care insurers or to the consumer's employer without written consent. Originally enacted in 2021 (Chapter 361), renumbered and amended into its current Part 1 structure in 2023 (Chapter 327).

Except as Subsection (2) provides, an employer may not in connection with a hiring, promotion, retention, or other related decision access or otherwise take into consideration private genetic information about an individual, request or require an individual to consent to a release for the purpose of accessing private genetic information about the individual, request or require an individual or the individual's blood relative to submit to a genetic test or a genetic procedure, or inquire into or otherwise take into consideration the fact that an individual or the individual's blood relative has taken or refused to take a genetic test or has undergone or refused to undergo a genetic procedure.

An employer may seek an order compelling the disclosure of private genetic information held by an individual or third party in connection with an employment-related judicial or administrative proceeding in which the individual has placed his health at issue, or an employment-related decision in which the employer has a reasonable basis to believe that the individual's health condition poses a real and unjustifiable safety risk requiring the change or denial of an assignment.

An order compelling the disclosure of private genetic information may only be entered upon a finding that other ways of obtaining the private information are not available or would not be effective and that there is a compelling need for the private genetic information which substantially outweighs the potential harm to the privacy interests of the individual.

Private genetic information is information about an identifiable individual that is derived from the presence, absence, alteration, or mutation of an inherited gene or genes, or the presence or absence of a specific DNA marker or markers, and that has been obtained from a genetic test or analysis of the individual's DNA, from a genetic test or analysis of the DNA of a blood relative of the individual, or from a genetic procedure.

An individual whose legal rights arising under the part have been violated after June 30, 2003, may recover damages and be granted equitable relief in a civil action. An employer who violates the legal rights of an individual arising from the part is liable for each separate violation for actual damages sustained, $100,000 if the violation is the result of an intentional and willful act or punitive damages if the violation is the result of a malicious act, and reasonable attorneys' fees.

The attorney general may bring an action to restrain or enjoin a violation, and the court may, after June 30, 2003, require the payment of a civil fine of not more than $25,000 for each separate intentional violation and reasonable costs of investigation and litigation. The part was renumbered and amended by Chapter 327, 2023 General Session.

Except as Subsection (2) provides, an insurer offering health care insurance may not in connection with the offer or renewal of an insurance product or in the determination of premiums, coverage, renewal, cancellation, or any other underwriting decision that pertains directly to the individual or any group of which the individual is a member that purchases insurance jointly, access or otherwise take into consideration private genetic information about an asymptomatic individual, request or require an asymptomatic individual to consent to a release for the purpose of accessing it, request or require an asymptomatic individual or the individual's blood relative to submit to a genetic test, or inquire into or otherwise take into consideration the fact that an asymptomatic individual or the individual's blood relative has taken or refused to take a genetic test.

An insurer offering health care insurance may not request or require an individual or the individual's blood relative to submit to a genetic procedure, and may not inquire into the results of a genetic procedure that an individual or the individual's blood relative undergoes. An insurer may request information regarding the necessity of a genetic test, but not the results of the test, if a claim for payment for the test has been made against an individual's health insurance policy.

An insurer may only store information obtained under Subsection (2) in accordance with the Health Insurance Portability and Accountability Act of 1996, and may only use or otherwise disclose it in connection with a proceeding to determine the obligation of an insurer to pay for a genetic test or health care services, making a reasonable effort to limit disclosure to the minimum necessary to carry out the purposes of the disclosure.

Nothing in the section may be construed as restricting the ability of an insurer to use information other than private genetic information to take into account the health status of an individual, group, or population in determining premiums or making other underwriting decisions.

Information maintained by an insurer about an individual under the section may be redisclosed to protect the interests of the insurer in detecting, prosecuting, or taking legal action against criminal activity, fraud, material misrepresentations, and material omissions, to enable business decisions to be made about the purchase, transfer, merger, reinsurance, or sale of all or part of the insurer's business, and to the commissioner of insurance upon formal request.

Any insurance company who violates the legal rights of an individual arising from the part is liable for each separate violation for actual damages sustained, $100,000 if the violation is the result of an intentional and willful act or punitive damages if the violation is the result of a malicious act, and reasonable attorneys' fees.

The attorney general may bring an action to restrain or enjoin a violation, and the court may, after June 30, 2003, require the payment of a civil fine of not more than $25,000 for each separate intentional violation. The section was renumbered and amended by Chapter 327, 2023 General Session.

A third-party contractor must use personally identifiable student data received under a contract with an education entity strictly to provide the contracted product or service within the negotiated contract terms. The contractor may not sell student data, may not collect, use, or share it inconsistently with the contract, and may not use it for targeted advertising.

Since July 1, 2026, a contract with a third-party contractor must describe the education entity's statutory duty to terminate the contract after a privacy violation and prohibit any fee or financial liability for the termination. Within 30 days after discovering a contractor's unauthorized use of student data in violation of state or federal privacy law, the education entity or government agency must give the contractor notice of the violation and of the duty to terminate.

No sooner than 30 days after that notice, the entity must terminate the contract if the contractor does not remedy the violation and establish processes to prevent it from recurring. A contractor may not impose a fee, seek damages, or assert any financial liability against an entity that terminates the contract on that ground. The Governor signed HB 55 on February 27, 2026. It amended the section as chapter 18 of the 2026 General Session. The amended section is effective July 1, 2026.

An insurer or its subcontractors, including a pharmacy benefit manager, may not publicly display or publicly post in any manner an individual's Social Security number, or print an individual's Social Security number on any card required for the individual to access products or services provided or covered by the insurer.

For the section, "insurer" means the insurers governed by Part 6 of Chapter 22 as described in Section 31A-22-600, including a health maintenance organization and a third-party administrator that is subject to the title, and a health, dental, medical, Medicare supplement, or conversion program offered under the Public Employees' Benefit and Insurance Program Act.

The section does not prevent the collection, use, or release of a Social Security number as required by state or federal law, the use of a Social Security number for internal verification or administrative purposes, or the release of a Social Security number to a health care provider for claims administration purposes, or as part of the verification, eligibility, or payment process.

An insurer that complies with a federal law requiring the United States Department of Health and Human Services to establish a national unique patient health identifier program is considered in compliance with the section. An insurer was required to comply with the section by July 1, 2004, and could obtain an extension, which the commissioner was to grant for a period not to exceed March 1, 2005 if the explanation provided was reasonable. The section was last amended by Chapter 297, 2011 General Session.

An insurer not subject to Section 31A-22-634 may not publicly display or publicly post in any manner an individual's Social Security number, or print an individual's Social Security number on any card required for the individual to access products or services provided or covered by the insurer. "Publicly display or publicly post" means to intentionally communicate or otherwise make available to the general public.

The section does not prevent the collection, use, or release of a Social Security number as required by state or federal law, the use of a Social Security number for internal verification or administrative purposes, or the release of a Social Security number for claims administration purposes or as part of the verification, eligibility, or payment process.

An insurer was required to comply with the section by July 1, 2005, and could obtain an extension, which the commissioner was to grant for a period not to exceed March 1, 2006 if the explanation provided was reasonable. The section was enacted by Chapter 2, 2004 General Session.

Defines biometric data as data generated by automatic measurement of an individual's unique biological characteristics, naming fingerprint, voiceprint, retina, iris, or any other unique biological pattern used to identify a specific individual, but excludes any physical or digital photograph, video or audio recording, or data generated from one.

Sensitive data means personal data that reveals an individual's racial or ethnic origin, religious beliefs, sexual orientation, or citizenship or immigration status, or information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional; the processing of genetic personal data or biometric data, if the processing is for the purpose of identifying a specific individual; and specific geolocation data.

A controller may not process sensitive data without first giving clear notice and an opportunity to opt out, an opt-out rather than opt-in model.

Section 76-6-703(2)(a) reaches a person who, without authorization or in excess of the actor's authorization, accesses or attempts to access computer technology if the access results in the alteration, damage, destruction, copying, transmission, discovery, or disclosure of computer technology. Computer technology, as defined in Section 76-6-702(7), includes computer data.

Section 76-6-703(2)(b) reaches an actor who, after accessing computer technology that the actor is authorized to access, knowingly takes or attempts to take unauthorized or unlawful action that results in the same consequences. Section 76-6-702(2) defines authorization as having the express or implied consent or permission of the owner to access a computer, computer system, or computer network in a manner not exceeding the consent or permission.

Under Section 76-6-703(3)(c)(v), a violation is a third degree felony if in gaining access the actor breaches or breaks through a security system. The current text of Section 76-6-703 took effect on May 3, 2023.

Section 76-6-703.7(2)(a) provides that an actor commits unlawful computer access if the actor intentionally or knowingly, and without authorization, gains or attempts to gain access to a computer, computer network, computer property, or computer system. Section 76-6-703.7(2)(b) limits the offense to circumstances that do not constitute an offense under section 76-6-703, 76-6-703.3, 76-6-703.5, or 76-12-205. The offense has no result, security-measure or harm element.

A violation is a class B misdemeanor. Section 76-6-703.7(1) applies the terms defined in section 76-6-702. Section 76-6-702(2) defines authorization as having the express or implied consent or permission of the owner, or of the person authorized by the owner to give consent or permission to access a computer, computer system, or computer network in a manner not exceeding the consent or permission. An earlier version of section 76-6-703 carried the same offense in subsection (3)(a).

The Utah Code publishes section 76-6-703.7 in a version effective May 3, 2023 and superseded May 7, 2025. The current text was amended by Chapter 173 of the 2025 General Session.

Section 13-61-101(29) defines publicly available information as information that a person lawfully obtains from a record of a governmental entity, reasonably believes a consumer or widely distributed media has lawfully made available to the general public, or, if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.

Biometric data under Section 13-61-101(6) means data generated by automatic measurements of an individual's unique biological characteristics. It does not include a physical or digital photograph, a video or audio recording, or data generated from either. Processing genetic or biometric data for the purpose of identifying a specific individual is sensitive data under Section 13-61-101(32)(a)(ii).

Section 13-11-4 provides that a supplier that engages in a deceptive act or practice in connection with a consumer transaction violates the Utah Consumer Sales Practices Act, whether the deceptive act or practice occurs before, during, or after the transaction.

Rule R590-216-4 requires a licensee to implement a comprehensive written information security program including administrative, technical, and physical safeguards to protect customer information. The safeguards must be appropriate to the size and complexity of the licensee and the nature and scope of its activities.

Rule R590-216-5 requires the program to ensure the security and confidentiality of customer information, to protect against any anticipated threat or hazard to the security or integrity of the information, and to protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.

The rule applies to a licensee of the department that obtains any nonpublic information from a customer, including nonpublic personal financial information or nonpublic personal health information. A licensee does not include a purchasing group, a manufacturer or seller warranty provider or manufacturer or seller service contract provider exempted by Section R590-206-2, or an unauthorized insurer regarding the excess line business conducted pursuant to Section 31A-15-103.

The methods of development and implementation in Section R590-216-6 are examples, and a licensee may adopt other actions or procedures to implement the program. The rule's purpose is to establish standards to assist a licensee in developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information under the Gramm-Leach-Bliley Act. The rule page gives June 9, 2023 as the date of the rule's last change. No day on which the rule first took effect has been located, so no effective date is recorded.

A supplier of a community water system serving a population of 3,300 or greater must complete an emergency response plan by December 31, 2026, and by July 1 annually thereafter. A supplier of a community water system serving a population less than 3,300 must complete an emergency response plan by July 1, 2027, and annually thereafter. The plan must include a requirement to support and regularly update software used in a control system.

The plan must include a requirement to provide annual cybersecurity training to an employee who has regular access to an operational technology or control system. The plan must include a requirement to complete an internal assessment of the system's security vulnerabilities and implement corrective controls. A supplier must report to the division on or before July 1 of each year whether it has completed an emergency response plan.

The Cybersecurity Affirmative Defense Act, Utah Code 78B-4-701 to 78B-4-704, enacted by Chapter 40 of the 2021 General Session and effective May 5, 2021, gives a person sued in a Utah court on a claim arising from a breach of system security three affirmative defenses where a qualifying written cybersecurity program was in place at the time of the breach: a defense to a claim that the person failed to implement reasonable information security controls, a defense to a claim that the person failed to appropriately respond to the breach, and a defense to a claim that the person failed to appropriately notify an affected individual.

A qualifying program must be designed to protect the type of personal information obtained in the breach, be of a scale and scope appropriate to the person's size, complexity and activities and the sensitivity of the information, and either operate as a reasonable security program with a designated coordinator, detection and response procedures, employee training, and periodic risk assessment and adjustment, or reasonably conform to a named industry framework: National Institute of Standards and Technology (NIST) Special Publication 800-171; NIST Special Publications 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the Center for Internet Security Critical Security Controls; the ISO/IEC 27000 family; the Health Insurance Portability and Accountability Act (HIPAA) Security Rule or Gramm-Leach-Bliley Title V regulations, for personal information those regimes already cover; or the PCI Data Security Standard, for payment card information.

A person loses the defense if it had actual notice of a threat or hazard to the information's security and did not act in a reasonable time to remediate it before the breach resulted; a risk assessment alone is not actual notice.

The Act imposes no duty to adopt a program and, by its own terms, may not be construed to create a private cause of action, including a class action, for a person's failure to comply with it: it is a defendant's shield, never a plaintiff's remedy, and Utah Code 13-44-201, researched separately below, is the reasonable-procedures duty the shield answers.

Utah Code 13-44-201, part of the Protection of Personal Information Act, requires any person who conducts business in the state and maintains personal information, reaching a governmental entity conducting business as well as a private business, the same broad reading of 'person' this jurisdiction's privacy-topic row already applies to the Act's breach-notification duty, to implement and maintain reasonable procedures to prevent the unlawful use or disclosure of personal information collected or maintained in the regular course of business, and to destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by a method the section specifies.

The section states no further content for what 'reasonable' requires beyond that general standard, and, like the rest of the chapter, creates no private right of action: only the Attorney General may enforce it. The chapter's own breach-notification duty, requiring notice to an affected Utah resident and, for a large breach, to the Attorney General and the Utah Cyber Center, is this jurisdiction's privacy-topic row rather than repeated here. The section was enacted by Laws of Utah 2006, chapter 343. That chapter took effect on January 1, 2007.

A governmental entity that identifies a data breach affecting 500 or more individuals must notify the Cyber Center and the attorney general. A governmental entity must also notify the Cyber Center when it identifies unauthorized access, acquisition, disclosure, loss of access or destruction of data that compromises the security, confidentiality, availability or integrity of its computer systems or information.

The notification must be made without unreasonable delay and no later than five days from the discovery of the data breach. A governmental entity with a data breach affecting fewer than 500 individuals must create an internal incident report and give the Cyber Center an annual report logging those incidents. The section was last amended by Chapter 202 of the 2026 General Session.

A supplier of a community water system must report a security breach to the Utah Cyber Center no later than two hours after the supplier discovers it. A security breach is an incident that threatens the security of a community water system with the potential to impact the quality or quantity of delivered water.

A security breach includes a breach of an operational technology or control system and an unauthorized attempt to delete, disable, destroy or override data, an application, a device or a computer network. The Utah Cyber Center must notify the division of a reported security breach not later than one day after receiving the report from the supplier. The section was enacted by Chapter 16 of the 2026 General Session.

Makes a commercial entity that publishes material harmful to minors on a website where more than one third of total material is harmful to minors civilly liable if it fails to verify that Utah visitors are 18 or older using a digitized identification card, an independent third party age verification service, or a commercially reasonable method relying on transactional data.

SB 73 (2026) added Division of Consumer Protection enforcement effective May 6, 2026, a rule treating a user as accessing the site from Utah even through a virtual private network (VPN), and a 2 percent excise tax on covered content revenue effective October 1, 2026 that funds youth mental health programs and enforcement.

Requires app store providers to verify a user's age category, link a minor's account to a parent account, and obtain parental consent before a minor can download or purchase an app, including preinstalled apps. The original Act was signed March 26, 2025 with a May 6, 2026 compliance deadline.

A 2026 amendment (HB 498, signed March 18, 2026) removed Attorney General enforcement, limited enforcement to a private right of action with damages of the greater of actual damages or $1,000 per violation, extended coverage to preinstalled apps, and delayed the compliance deadline one year to May 6, 2027.