Relevant Law
App Store Accountability Act, SB 142, UCA § 13-75-101 et seq., as amended by HB 498
Effective date:
May 7, 2025
March 18, 2026
(App store and Developer requirements take effect May 6, 2026 May 6, 2027)
Age in Scope
- Child: younger than 13
- Younger teenager: 13-15
- Older teenager: 16-18
- Adult: > 18
Companies in Scope
App store provider: a person that owns, operates, or controls an app store that allows users in the state to download apps onto a mobile device.
Developer: a person that owns or controls an app made available through an app store in the state.
Age Verification Method
- Commercially available methods that are reasonably designed to ensure accuracy; or
- (NEW) For a minor, this includes an affirmative age attestation by a parent together with other age information collected as part of the account creation or use
App Store Obligations
At the time an individual creates an account with the app store provider:
- Request age information
- Verify the individual’s age category
- Require minor user accounts to be affiliated with a parent account
- Obtain verifiable parental consent from the affiliated parent account before allowing the minor to download an app, purchase an app, or make an in-app purchase.
- (NEW) For pre-installed applications, provide the age category in response to request from Developer and take reasonable steps to facilitate parental consent for use of the app
- (NEW) Comply with developer’s request to prevent minor accounts from downloading or purchasing the app
After receiving notice of a significant change from a developer, notify users or, for a minor, the affiliated parent account and obtain renewed verifiable parental consent.
App stores must also provide to developers information relating to the age category of users, the status of verified parental consent where applicable, and notify developers when parental consent is revoked.
App stores must protect personal age verification data by limiting collection to what is necessary, and transmitting the data using industry standard encryption protocols.
Developer Obligations
Developers must:
- Verify through the app store’s data sharing methods the age category of the user and, if applicable, whether verified parental consent has been obtained.
- Notify the app store of significant changes to the app.
- Use age category data obtained from the app store to enforce age-related restrictions, ensure compliance with applicable laws, and implement safety-related features.
- Request age verification data or parental consent at the time the user downloads or purchases an app, when implementing a significant change to the app, or when complying with applicable laws, (NEW) and when user launches a pre-installed app for the first time.
- A developer may request age verification data: no more than once during each 12-month period to verify accuracy of the data or continues account use within the verified age category; or when there is reasonable suspicion of account misuse or transfer; or at the time a user creates a new account with the developer.
- When implementing safety-related features, the developer must use the lowest age category indicated by age verification data or data independently collected by the developer.
Enforcements & Penalties
Minors, or parents of minors, can bring private actions if an app store provider or a developer seeks to enforce a contract against a minor when no verifiable consent has been obtained, if there has been a knowing misrepresentation in information provided to obtain parental consent, or age category data is shared unlawfully.
Penalties: the greater of actual damages or $1,000 per violation, plus attorneys fees and costs
Safe harbor for developers if they rely in good faith on personal age category data and parental consent provided by the app store and have otherwise complied with requirements of the law.
(NEW) Amendment removed provision that violation of the Act constitutes a deceptive trade practice. Statute appears to be enforceable only through private right of action.
Relevant Law
Social Media Regulation Amendments,
SB 194, UT Code § 13-71-101 to -401
Effective date:
October 1, 2024
Preliminary injunction issued:
September 11, 2024
Age in Scope
Minor < 18
Companies in Scope
Social Media Service means a site or app that (i) displays content primarily generated by account holders; (ii) permits an individual to register an account and create a profile that is visible to other; (iii) connects account holders to allow users to interact socially; (iv) makes available to each account holder a list or lists of other account holders with whom the account holder shares a connection with on the system; and (v) allows account holders to post content viewable by other users.
Key Exceptions
Social Media Services does not include (i) email; (ii) cloud storage; (iii) document viewing, sharing or collaboration services.
Age Verification Mechanism
Age assurance system (measures reasonably calculated to enable a social media company to identify whether an account holder is a minor with an accuracy rate of at least 95%).
Key Requirements
- Verifiable parental consent for minor account holders
- Default privacy settings (including to restrict visibility of minor account, restrict data collection and sale, disable search indexing, restrict direct messaging capabilities)
- Disable features that prolong user engagement (autoplay, endless scroll, push notifications)
- Provide optional supervisory tools the minor may elect to activate (time of day and length of time restrictions, mandatory breaks, view activity metrics, notifications)
Enforcement & Penalties
- Enforced by Attorney General
- May impose administrative fine of $2,500/violation
- Court may order injunction, disgorgement, civil penalties of $2,500/violation, actual damages, other relief
- Safe harbor for Social Media Services that implement age assurance and VPC systems established by Regulations
Relevant Law
Social Media Amendments,
HB 464, UT Code § 78B-3-1101 to 1106
Effective date:
October 1, 2024
Note: Repealed and replaced the Social Media Regulation Act, UT Code 13-63-601 et seq.
Age in Scope
Minor < 18
Companies in Scope
Algorithmically curated Social Media Services that drive user engagement primarily through the use of (i) a curation algorithm; and (ii) engagement driven design elements, including autoplay features, endless scroll, push notifications.
Key Exceptions
Social Media Services does not include (i) email; (ii) cloud storage; (iii) document viewing, sharing or collaboration services.
Age Verification Mechanism
Age gate or age assurance implied.
Key Requirements
Optional, but necessary to establish affirmative defense:
- 3-hour time limit
- Time of day restrictions (10:30 pm – 6:30 am)
- Parental consent for minor to use SMS
- Disable engagement driven design elements (autoplay, endless scroll, push notifications)
Enforcement & Penalties
- Only enforceable through private right of action
- Parent may bring cause of action for adverse mental health outcome arising from minor’s excessive use of algorithmically curated social media service
- Plaintiff entitled to rebuttable presumption that minor’s adverse mental health outcome was caused by SMS (may be reversed if SMS complies with voluntary protections of statute)
- Court may award $10,000 for each adverse mental health outcome or actual damages
Relevant Law
Utah Consumer Privacy Act,
Utah Code Ann. § 13-61-101 et seq.
Effective date:
December 31, 2023
Child / Teen Scope
Children < 13 (or as defined by COPPA)
Age Verification
- Age gate not specified
- Parental consent verification consistent with COPPA
Key Requirements
Sensitive Data does not include PI collected from a known child younger than 13.
Risk Assessment
None
Other
No specified penalty change if violation involves a child.
Relevant Law
HB 438
Companies & Materials in Scope
The law targets AI systems marketed primarily for companionship or designed to simulate feelings, memories, or personal opinions.
Safe Harbor Exclusion: There is a specific “safe harbor” for chatbots that are not designed to facilitate emotional engagement or simulate sustained relationships.
Exclusions
Generally excludes systems used strictly for business operations, routine appointment reminders, or functional customer service that does not attempt to mimic human connection.
Age Verification Mechanism
Mandates that companion chatbot operators implement an age assurance process to accurately identify if a user is a minor (under 18).
Other Notable Requirements
Frequent Disclosures: Operators must disclose that the bot is artificial and not human. For continuous use, some versions of the bill require these reminders as often as every hour.
Crisis Protocols: Systems must be designed to prohibit responses encouraging self-harm or suicidal ideation. If such topics are detected, the bot must provide referrals to crisis providers or a suicide hotline.
Mandatory Breaks: Bots must remind minor users to take breaks.
Ad Transparency: All advertisements must be clearly labeled, and embedding product placements into conversational answers without notice is prohibited.
Data Restrictions: Operators are prohibited from selling or sharing the personal data of minors without affirmative parental consent.
Annual Reporting: Operators must submit annual safety and crisis referral reports to the Utah Office of Artificial Intelligence Policy
Enforcement & Penalties
- Administrative Fines: Up to $2,500 per violation.
- Civil Penalties: If an operator violates an existing administrative or court order, they can face penalties of up to $50,000 per violation.
Relevant Law
Online Pornography Viewing Age Requirements – SB287,
Utah Code Ann. §§ 78B-3-1001-1002
Effective date:
May 3, 2023
Companies & Material in Scope
Any commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the Internet from a website that contains a substantial portion (33.3%) of such material.
“Material harmful to minors” is any material that: is designed to appeal to, or is designed to pander to, the prurient interest; consists of descriptions of actual, simulated, or animated display or depiction of [listed examples] in a manner patently offensive; and taken as a whole lacks serious literary, artistic, political, or scientific value.
Exclusions
Bona fide news or public interest broadcast, internet service providers, search engines, or cloud service providers.
Age Verification Mechanism
“Reasonable age verification methods” means using any of the following methods:
- use of a digitized information card as defined in this section;
- verification through an independent, third-party age verification service that compares the personal information entered by the individual who is seeking access to the material that is available from a commercially available database, or aggregate of databases, that is regularly used by government agencies and businesses for the purpose of age and identity verification; or
- any commercially reasonable method that relies on public or private transactional data (i.e., records from mortgage, education, and employment entities) to verify the age of the person.
Other Notable Requirements
A commercial entity or third party that performs the required age verification shall not retain any identifying information of the individual after access has been granted to the material.
Enforcement & Penalties
Private right of action: Liable to an individual for damages (including court costs and reasonable attorney fees as ordered by the court) resulting from:
- A minor accessing the material; and/or
- Retaining the identifying information.
U.S. Online Safety Law Tracker
U.S. states are passing legislation to protect children’s online safety at a rapid pace, from novel legislation aimed at protecting minors on social media, gaming platforms and other online services, to providing teens additional consent rights and data protections, and protecting minors from harmful content. Below is a state-by-state law tracker to help businesses stay informed and navigate the evolving online safety legislative landscape. The tracker provides a bird’s-eye view of the various state online safety, privacy and harmful content laws that have passed, along with their effective dates, scope, key requirements, penalties and more. We will update the tracker periodically to reflect new legislation and key changes to existing laws.
Click on individual states to explore.
Last updated October 16, 2026
Information is only shown for states with defined laws to-date.
Please note that these laws are in flux and subject to change; additional details in the statutes, other sources of interpretation, and local laws in cities and counties may also apply.
Visit the Online Safety Law Center
We help clients navigate the risks of child and student data collection and use by designing age-appropriate features and tools to ensure user safety and manage legal and reputational concerns.