Utah’s Social Media Regulation Act – Overview of Privacy & Business Impact

Enforcement & Private Right of Action

USMRA grants the Division of Consumer Protection (Division) auditing authority to enforce and ensure compliance. The Division also has the power to investigate any complaint and seek enforcement through an injunction, civil penalties, or to seek other relief through the judicial process.

Failure to comply with the Regulation Amendments could introduce fines of up to $2,500 per violation, and any actual damages suffered by users. Failure to comply with the Usage Amendments could result in a $250,000 fine for social media companies that use additive features and a penalty of up to $2,500 per child exposed to an addictive element. Companies can avoid fines by performing quarterly audits and addressing violations within 30 days.

The law also introduces a privacy right of action allowing persons (and not just parents) to sue companies directly. Where a violation of USMRA is found, companies may be liable up to $2,500 for each incident of the violation or actual damages for harms incurred by the individual bringing the action (whichever is greater). Notably, where a private action is pursued for addiction to social media, harm to minors under the age of sixteen will be presumed. In such cases, companies will bear the burden of rebutting such presumptions.

Uncertainty surrounding age-verification and consent requirements

For one, despite its stringent age-verification and consent requirements, the law does not address how these standards are to be implemented. This brings to light important questions like what level of age-verification will be sufficient? What forms of identification will be sufficient to prove the age of a user? What about proving identity as the parent of a minor? And how must companies develop age verification and consent tools such that they cannot be easily evaded by minors?

At the same time, USMRA does not seem to consider the impact on companies who do not target children, or even those who prohibit children from using their services. Presumably, these companies will still need to introduce age-verification and then deny minors from creating an account in the first place.

Relatedly, it remains unclear how these requirements will interplay with broader data minimization and security principles. This is particularly pertinent given that the age verification requirements of the law will require companies to collect identification information from all users (minors or otherwise). As a consequence, companies will be collecting massive amounts of relatively sensitive data in order to comply with the law.

Further, companies need to consider application of other laws in connection with these requirements, including age-gating requirements under COPPA and whether collection of full date of birth for age-gating may trigger application other laws such as state data breach laws.

Importantly, the USMRA does provide for a rulemaking process that will address many of these questions. In particular, the Division of Consumer Protection is tasked with creating an age verification process which must permit some form of verification other than requiring a valid identification card issued by the government.

However, it is not clear when these rules will surface. This places social media companies in a tough position as they look toward undefined requirements, a host of technical changes that need to be made to their platforms and a relatively tight deadline for compliance.

Ensuring the protection of at-risk minors

While the USMRA was founded on the idea of enhancing the protection of minors, opponents of the law have claimed the law violates First Amendment rights and constitute problematic and even dangerous invasion of a minors’ and families’ right to privacy and parental rights. Other critics have raised concerns that these laws will disproportionately impact at risk youth where social media may be functioning as a safe space or means of seeking help and support, especially for kids without adequate family support.

What Comes Next?

Given the new and sweeping nature of USMRA, the law is destined to face legal challenges and review by the courts, particularly on First Amendment grounds. These challenges are not only expected but considered inevitable by Governor Spencer Cox who told reporters that they have planned for such legal pushback since the law’s early stages. In parallel, Representative Jordan Teuscher, the sponsor for the Usage Amendments, has issued a call to action for social media companies – asking them to come to the table and work alongside lawmakers.

Companies should pay close attention to these developments as they may meaningfully limit or clarify the current requirements under USMRA.

Finally look to Texas, Ohio, Minnesota, Connecticut and Arkansas next as these five states have each introduced similar legislation that would require parental consent for minors to use social media.