Utah Governor Spencer Cox is expected to signed SB 152, which was passed by both the House and Senate as of March 13, 2023.  With this bill, Utah would join California in passing legislation designed to protect children from online harms.  However, unlike the California Age-Appropriate Design Code, the Utah law will provide a private right of action with statutory damages—potentially leading to a flood of litigation.

Under the Utah law, beginning on March 1, 2024, social media companies must verify the age of existing or new Utah account holders.  Social media company is defined to mean any person or entity that provides a social media platform with at least 5 million account holders worldwide.  Utahns under the age of 18 will need parental consent to open an account.  Parents must also be provided with their own credentials for minors, which will allow the parents to view all posts of the minor, messages sent by the minor, and responses received by the minor.  Social media companies must also limit minor’s access during night time hours unless the parent changes their permissions. 

Notably, the Utah law will provide a private right of action with statutory damages of $2,500 per each incident of violation, plus attorneys’ fees.  Accordingly, social media companies can expect class action litigation similar to what we have seen with other privacy laws containing similar enforcement rights.

The Utah law will almost certainly be challenged in courts.  For example, tech industry groups told Governor Cox in a letter that they believe the law will violate the First Amendment and lead to frivolous lawsuits.  In any event, regardless of whether the Utah law stands, it is likely a harbinger of other state law focused on protecting children from online harms.