United States: Utah Social Media Law May Set Tone For Child Safety Regs

On March 23, Shou Zi Chew — the CEO of the massively popular social media platform TikTok — testified before Congress.

The congressional hearing is one of the latest developments in the U.S. government's efforts to investigate social media platforms and those platforms' influence over the general public.

The federal government, however, is not the only legislative body taking aim at social media platforms.

On the same day as Chew's congressional hearing, Utah Gov. Spencer Cox signed into law two first-of-a-kind bills: S.B. 152 and H.B. 311. Both pieces of legislation form the Utah Social Media Regulation Act.

Among other provisions, the act:

• Requires social media companies to verify the age of Utah residents seeking to maintain or open a social media account and obtain the consent of a parent or guardian before a Utah resident under the age of 18 may do so;
• Requires that social media companies limit minors' access to certain features and functionality of their social media platforms;
• Prohibits social media companies from using features that cause a minor to have an addiction to the social media platform; and
• Authorizes a private right of action to collect attorney fees and damages arising from violations of the act.

Minors under the Utah Social Media Regulation Act are generally individuals residing in Utah that are under 18 years old. The new law takes effect March 1, 2024, giving social media companies less than one year to adjust to the new requirements.

Even more recently, Arkansas signed its Social Media Safety Act, or S.B. 396, into law on April 12.

That act and other pending bills across the U.S. address many of the same social media-related issues as the Utah Social Media Regulation Act.

Application

According to H.B. 311, the act applies to any company that: "(a) provides a social media platform that has at least 5,000,000 account holders worldwide; and (b) is an interactive computer service."

The statute's definition of "social media platform" is robust and includes any:

However, subject to certain additional requirements, the act specifically excludes a wide range of online services, including, in part: email, direct messaging, e-commerce, interactive or virtual gaming, cloud computing, and certain educational services used under the direction of educational institutions.

While smaller social media companies may not meet the threshold for regulation under the Utah Social Media Regulation Act, many larger social media companies will likely seek to assert that their platform falls into one of the stated exceptions to the definition of "social media platform" in order to avoid being subject to the statute's requirements.

Prohibitions and Requirements

The Utah Social Media Regulation Act enacts a broad range of new requirements applicable to covered social media companies. Below is a brief summary of the key requirements:

Age Verification and Parental Consent

The act prohibits a social media company from permitting a Utah minor to sign up for an account without a parent or guardian's consent.

That prohibition is coupled with the requirement that social media companies actively verify the ages of both their new and existing users.

If a Utah account holder fails to meet the verification requirements within 14 days of their attempt to access their account following March 1, 2024, social media companies are obligated to deny access to the relevant account until all verification requirements are satisfied.

As some civil rights organizations have already noted, one — possibly unintentional — effect of this requirement may be to deny undocumented immigrants residing in Utah access to social media platforms.

Restrictions on Features Offered to Minors

Covered social media companies must limit the features available to minors that have received consent to maintain or open an account on the relevant social media platforms.

According to S.B. 152, some of the restricted features include:

As these features are integral to many social media platforms, it is possible that social media companies may choose to simply prohibit Utah minors from accessing their platforms rather than comply with these requirements.

Data Collection

S.B. 152 also notes that as part of the general restrictions, the act permits the collection and use of personal information contained in any Utah minor's "posts, content, messages, text, or usage activities" only for limited compliance and verification purposes — more specifically, "to comply with, and to verify compliance with, state or federal law."

The statute provides that information that may fall within this permitted scope includes not only the minor's information but their "parent or guardian's name, a birth date, and any other information required to be submitted" under the Utah Social Media Regulation Act.

Parental Access

S.B. 152 also provides that social media companies must give a minor's parent or guardian "a password or other means ... to access the account, which shall allow the parent or guardian to view" the Utah minor's posts and all of their responses and messages sent via the applicable social media platform.

One can imagine that this feature alone might heavily curtail the use of social media platforms by minors.

Time-of-Day Restrictions

Social media companies must, by default, prevent Utah minors from accessing their accounts from 10:30 p.m. to 6:30 a.m., or another period set by a parent or guardian.

This regulation appears to extend beyond Utah's borders, as S.B. 152 states that the "[t]ime of day ... shall be calculated based on the Internet protocol address being used by the Utah minor account holder at the time of attempting access."

Parental access to a minor's accounts, however, is not subject to the time-of-day restrictions and cannot be similarly limited.

Addictive Practices, Features or Designs

Among the most thought-provoking prohibitions in H.B. 311 are the restrictions on social media companies' use of features that a "social media company knows, or which by the exercise of reasonable care should know, causes a Utah minor account holder to have an addiction to the social media platform."

Under the statute:

The statute does not provide examples of features that would cause an addiction, creating significant ambiguity for social media companies.

Enforcement/Penalties

The Utah Division of Consumer Protection is primarily tasked with the enforcement of the Utah Social Media Regulation Act and may audit the records of any social media company to determine compliance or investigate any complaint made under the statute.

Civil penalties for violations of the act range from "$250,000 for each practice, design, or feature shown to have caused addiction" to $2,500 for any violation of it, counting each minor as a separate violation.

Critically, however, the statute also creates a private right of action, allowing individuals to sue for violations of the act.

Successful plaintiffs are entitled to attorney fees and court costs and an amount equal to the greater of $2,500 per each incident of harm, or actual damages.

The act also contains a provision that shifts the burden of proof to the social media company to rebut the relevant claims if the private right of action concerns a minor under the age of 16.

Notably, it also bans any waivers of the protections granted under the statute, regardless of any choice of law provisions in any contracts.

The Utah Social Media Regulation Act provides a few paths for limiting these remedies. With respect to the age verification requirements and usage limitations, social media companies are afforded a 30-day cure period to remedy any violation of the statute following a notice from Utah's Division of Consumer Protection.

With respect to the addictive feature prohibition, social media companies can escape the civil penalties listed above if they institute and maintain a program for auditing their practices and remedying deficiencies as prescribed by the statute.

Key Takeaways

Monitor Rulemaking

S.B. 152 holds that the Utah Division of Consumer Protection will develop regulations that address, among other things:

• "[A]cceptable forms or methods of identification, which may not be limited to a valid identification card issued by a government entity";
• Requirements for verifying and confirming age and parental consent; and
• "[R]equirements for retaining, protecting, and securely disposing of any information obtained by a social media [company's]" compliance efforts.

As a result, social media companies should closely monitor any guidance or regulations promulgated by the state's Division of Consumer Protection and adapt their practices accordingly.

Conflicts With Privacy Laws

Most, if not all, social media platforms that may be subject to the Utah Social Media Regulation Act operate globally — and privacy obligations in other jurisdictions may conflict directly with the Utah Social Media Regulation Act.

Specifically, most global privacy laws — including the European Union's General Data Protection Regulation and even Utah's own Consumer Privacy Act — impose a duty of data minimization, requiring companies to process no more information than is strictly necessary to achieve the processing purpose.

The Utah Social Media Regulation Act verification regime may cause social media companies to collect personal information that they would not otherwise collect.

To avoid running afoul of conflicting privacy laws, social media companies may consider "geofencing" their platforms and requesting verification only from IP addresses in Utah, or even excluding Utah from their services entirely. Additionally, online privacy notices may need revisions stating that the platforms will only use a Utah minor's information for compliance and verification purposes.

Evaluate Exceptions

Many companies will likely seek to qualify for an exception to the definition of "social media platform" to avoid the compliance obligations imposed under the Utah Social Media Regulation Act.

Many of these exceptions, however, list a number of criteria that companies must satisfy in order to properly qualify.

For example, according to H.B. 311, to fit within the direct messaging exception, the direct messages must: (1) be "shared between the sender and the recipient"; (2) only be "visible to the sender and the recipient"; and (3) not be posted publicly.
be
Accordingly, social media companies should closely evaluate the features of their platforms in order to determine whether their platforms fit squarely within a listed exception.

Update Terms of Use/Service

Given the statute's prohibition on the waiver of protections under the act, social media companies likely will not be able to avoid application of the new requirements through a standard waiver or choice of law provision in their terms of use or service. As such, those terms will need to be updated to reflect the obligations imposed under the Utah Social Media Regulation Act, including with respect to age verification, parental consent and time-of-day restrictions.

Legal Challenges

The Utah Social Media Regulation Act became law only recently and is already facing some serious legal challenges.

Proponents of First Amendment protections have already declared the statute an unconstitutional infringement of the First Amendment's free speech protections.¹

Additionally, it is unclear whether the federal Communications Decency Act's Section 230 protections or the Children's Online Privacy Protection Act will preempt the statute.²

As such, social media companies will want to closely monitor any lawsuits that are likely to arise out of any attempt to enforce the Utah Social Media Regulation Act.

The Social Media Safety Act

Less than a month after Utah passed its Social Media Regulation Act, Arkansas passed its Social Media Safety Act.

The act is similar to Utah's, including with respect to age verification and parental consent requirements, a private right of action, and penalty amounts for violations of the law.

The act does not address the addictive practices or time frames for permitted access that are provided in the Utah Social Media Regulation Act, and uses a monetary threshold — as opposed to a threshold based on a number of users — for determining whether a social media company is subject to the law's requirements.

More specifically, only social media platforms that generate $100 million or more in annual gross revenue are subject to the act.

The Arkansas legislation also requires social media companies to use a third-party vendor to perform reasonable age verification, which goes into effect even before the Utah Social Media Regulation Act, on Sept. 1.

As a result, social media companies subject to the law will need to identify and enter into agreements with service providers to perform verification services, before the act's effective date, in order to comply with the requirements.

Other States

Although Arkansas and Utah are currently the only states with statutes imposing direct regulations on social media companies with respect to age verification and parental consent, other states are considering or have passed similar legislation.

For example, the California Age-Appropriate Design Code Act would compel online platforms to proactively assess the privacy and protection of children in the design of any digital product or service that they offer.

That statute is currently the subject of preemption and First Amendment litigation on grounds similar to those that could be used to challenge the Utah Social Media Regulation Act and the Social Media Safety Act.³

Likewise, Connecticut, New Jersey and Texas are also considering similar legislation intended to address minors' access to social media platforms. It is therefore incumbent on social media companies to stay informed of any new legislative and judicial developments in this area.

Footnotes

1. See NetChoice Disappointed to See Unconstitutional Utah Bills Endangering Online Privacy Signed Into Law.

2. See Utah's Teen Social Media Laws Brace for Suits Seeking to Ax Them.

3. See NetChoice v. Bonta, Case No.5:22-cv-8861 (NDCA December 14, 2022).

Originally published by Law360.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.