| Old | New | Differences | |
|---|---|---|---|
| 1 | - | Enrolled Copy S.B. 142 | |
| 1 | + | 03-04 21:02 6th Sub. (Cherry) S.B. 142 | |
| 2 | + | Todd Weiler proposes the following substitute bill: | |
| 2 | 3 | 1 | |
| 3 | 4 | App Store Accountability Act | |
| 4 | 5 | 2025 GENERAL SESSION | |
| 5 | 6 | STATE OF UTAH | |
| 6 | 7 | Chief Sponsor: Todd Weiler | |
| 7 | 8 | House Sponsor: James A. Dunnigan | |
| 8 | 9 | 2 | |
| 9 | 10 | ||
| 10 | 11 | 3 | |
| 11 | 12 | LONG TITLE | |
| 12 | 13 | 4 | |
| 13 | 14 | General Description: | |
| 14 | 15 | 5 | |
| 15 | 16 | This bill enacts provisions governing app store operations and creates requirements for age | |
| 16 | 17 | 6 | |
| 17 | 18 | verification and parental consent. | |
| 18 | 19 | 7 | |
| 19 | 20 | Highlighted Provisions: | |
| 20 | 21 | 8 | |
| 21 | 22 | This bill: | |
| 22 | 23 | 9 | |
| 23 | 24 | ▸ defines terms; | |
| 24 | 25 | 10 | |
| 25 | 26 | ▸ requires app store providers to: | |
| 26 | 27 | 11 | |
| 27 | 28 | ● verify a user's age category; | |
| 28 | 29 | 12 | |
| 29 | 30 | ● obtain parental consent for minor accounts; | |
| 30 | 31 | 13 | |
| 31 | 32 | ● notify users and parents of significant changes; | |
| 32 | 33 | 14 | |
| 33 | 34 | ● share age category and consent data with developers; and | |
| 34 | 35 | 15 | |
| 35 | 36 | ● protect age verification data; | |
| 36 | 37 | 16 | |
| 37 | 38 | ▸ prohibits app store providers from: | |
| 38 | 39 | 17 | |
| 39 | 40 | ● enforcing contracts against minors without parental consent; and | |
| 40 | 41 | 18 | |
| 41 | 42 | ● misrepresenting parental content disclosures; | |
| 42 | 43 | 19 | |
| 43 | 44 | ▸ requires developers to: | |
| 44 | 45 | 20 | |
| 45 | 46 | ● verify age category and consent status through app stores; and | |
| 46 | 47 | 21 | |
| 47 | 48 | ● notify app stores of significant changes; | |
| 48 | 49 | 22 | |
| 49 | 50 | ▸ prohibits developers from: | |
| 50 | 51 | 23 | |
| 51 | 52 | ● enforcing contracts against minors without verified parental consent; and | |
| 52 | 53 | 24 | |
| 53 | 54 | ● misrepresenting parental content disclosures; | |
| 54 | 55 | 25 | |
| 55 | 56 | ▸ designates violations of certain provisions as deceptive trade practices; | |
| 56 | 57 | 26 | |
| 57 | 58 | ▸ requires the Division of Consumer Protection to establish standards for age verification | |
| 58 | 59 | 27 | |
| 59 | - | methods; | |
| 60 | + | methods; | |
| 60 | 61 | 28 | |
| 61 | 62 | ▸ creates a private right of action for parents of harmed minors; | |
| 63 | + | 6th Sub. S.B. 142 6th Sub. (Cherry) S.B. 142 03-04 21:02 | |
| 62 | 64 | 29 | |
| 63 | 65 | ▸ provides a safe harbor for compliant developers; and | |
| 64 | 66 | 30 | |
| 65 | 67 | ▸ includes a severability clause. | |
| 66 | 68 | 31 | |
| 67 | 69 | Money Appropriated in this Bill: | |
| 68 | 70 | 32 | |
| 69 | 71 | None | |
| 70 | 72 | 33 | |
| 71 | 73 | Other Special Clauses: | |
| 72 | 74 | 34 | |
| 73 | 75 | This bill provides a special effective date. | |
| 74 | 76 | 35 | |
| 75 | 77 | Utah Code Sections Affected: | |
| 76 | 78 | 36 | |
| 77 | 79 | ENACTS: | |
| 78 | 80 | 37 | |
| 79 | 81 | 13-75-101 (Effective 05/07/25), Utah Code Annotated 1953 | |
| 80 | 82 | 38 | |
| 81 | 83 | 13-75-201 (Effective 05/06/26), Utah Code Annotated 1953 | |
| 82 | 84 | 39 | |
| 83 | 85 | 13-75-202 (Effective 05/06/26), Utah Code Annotated 1953 | |
| 84 | 86 | 40 | |
| 85 | 87 | 13-75-301 (Effective 05/07/25), Utah Code Annotated 1953 | |
| 86 | 88 | 41 | |
| 87 | 89 | 13-75-401 (Effective 12/31/26), Utah Code Annotated 1953 | |
| 88 | 90 | 42 | |
| 89 | 91 | 13-75-402 (Effective 05/07/25), Utah Code Annotated 1953 | |
| 90 | 92 | 43 | |
| 91 | 93 | 13-75-403 (Effective 05/07/25), Utah Code Annotated 1953 | |
| 92 | 94 | 44 | |
| 93 | 95 | 13-75-404 (Effective 05/07/25), Utah Code Annotated 1953 | |
| 94 | 96 | 45 | |
| 95 | 97 | ||
| 96 | 98 | 46 | |
| 97 | 99 | Be it enacted by the Legislature of the state of Utah: | |
| 98 | 100 | 47 | |
| 99 | 101 | Section 1. Section 13-75-101 is enacted to read: | |
| 100 | 102 | 48 | |
| 101 | 103 | ||
| 102 | 104 | CHAPTER 75. APP STORE ACCOUNTABILITY ACT | |
| 103 | 105 | 49 | |
| 104 | 106 | ||
| 105 | 107 | Part 1. General Provisions | |
| 106 | 108 | 50 | |
| 107 | 109 | 13-75-101 (Effective 05/07/25). Definitions. | |
| 108 | 110 | 51 | |
| 109 | 111 | As used in this chapter: | |
| 110 | 112 | 52 | |
| 111 | 113 | (1) "Age category" means one of the following categories of individuals based on age: | |
| 112 | 114 | 53 | |
| 113 | 115 | (a) "child" which means an individual who is under 13 years old; | |
| 114 | 116 | 54 | |
| 115 | 117 | (b) "younger teenager" which means an individual who is at least 13 years old and under | |
| 116 | 118 | 55 | |
| 117 | 119 | 16 years old; | |
| 118 | 120 | 56 | |
| 119 | 121 | (c) "older teenager" which means an individual who is at least 16 years old and under 18 | |
| 120 | 122 | 57 | |
| 121 | 123 | years old; or | |
| 122 | 124 | 58 | |
| 123 | 125 | (d) "adult" which means an individual who is at least 18 years old. | |
| 124 | 126 | 59 | |
| 125 | 127 | (2) "Age category data" means information about a user's age category that is: | |
| 126 | 128 | 60 | |
| 127 | 129 | (a) collected by an app store provider; and | |
| 128 | - | - 2 - Enrolled Copy S.B. 142 | |
| 129 | 130 | 61 | |
| 130 | 131 | (b) shared with a developer. | |
| 132 | + | - 2 - 03-04 21:02 6th Sub. (Cherry) S.B. 142 | |
| 131 | 133 | 62 | |
| 132 | 134 | (3) "Age rating" means a classification that provides an assessment of the suitability of an | |
| 133 | 135 | 63 | |
| 134 | 136 | app's content for different age groups. | |
| 135 | 137 | 64 | |
| 136 | 138 | (4) "App" means a software application or electronic service that a user may run or direct | |
| 137 | 139 | 65 | |
| 138 | 140 | on a mobile device. | |
| 139 | 141 | 66 | |
| 140 | 142 | (5) "App store" means a publicly available website, software application, or electronic | |
| 141 | 143 | 67 | |
| 142 | - | service that allows users to download apps from third-party developers onto a mobile | |
| 144 | + | service that allows users to download apps from third-party developers Ĥ→ onto a | |
| 145 | + | 67a | |
| 146 | + | mobile device ←Ĥ . | |
| 143 | 147 | 68 | |
| 144 | - | ||
| 148 | + | (6) "App store provider" means a person that owns, operates, or controls an app store that | |
| 145 | 149 | 69 | |
| 146 | - | ||
| 150 | + | allows users in the state to download apps Ĥ→ onto a mobile device ←Ĥ . | |
| 147 | 151 | 70 | |
| 148 | - | ||
| 152 | + | (7) "Content description" means a description of the specific content elements that informed | |
| 149 | 153 | 71 | |
| 150 | - | ||
| 154 | + | an app's age rating. | |
| 151 | 155 | 72 | |
| 152 | - | an app | |
| 156 | + | (8) "Developer" means a person that owns or controls an app made available through an | |
| 153 | 157 | 73 | |
| 154 | - | ||
| 158 | + | app store in the state. | |
| 155 | 159 | 74 | |
| 156 | - | ||
| 160 | + | (9) "Division" means the Division of Consumer Protection, established in Section 13-2-1. | |
| 157 | 161 | 75 | |
| 158 | - | ( | |
| 162 | + | (10) "Knowingly" means to act with actual knowledge or to act with knowledge fairly | |
| 159 | 163 | 76 | |
| 160 | - | ||
| 164 | + | inferred based on objective circumstances. | |
| 161 | 165 | 77 | |
| 162 | - | ||
| 166 | + | (11) "Minor" means an individual under 18 years old. | |
| 163 | 167 | 78 | |
| 164 | - | ( | |
| 168 | + | (12) "Minor account" means an account with an app store provider that: | |
| 165 | 169 | 79 | |
| 166 | - | ( | |
| 170 | + | (a) is established by an individual who the app store provider has determined is under 18 | |
| 167 | 171 | 80 | |
| 168 | - | ||
| 172 | + | years old through the app store provider's age verification methods; and | |
| 169 | 173 | 81 | |
| 170 | - | ||
| 174 | + | (b) requires affiliation with a parent account. | |
| 171 | 175 | 82 | |
| 172 | - | (b) requires affiliation with a parent account. | |
| 176 | + | (13) "Mobile device" means a Ĥ→ [portable computing device] phone or general | |
| 177 | + | 82a | |
| 178 | + | purpose tablet ←Ĥ that: | |
| 173 | 179 | 83 | |
| 174 | - | ( | |
| 180 | + | (a) provides cellular or wireless connectivity; | |
| 175 | 181 | 84 | |
| 176 | - | ( | |
| 182 | + | (b) is capable of connecting to the Internet; | |
| 177 | 183 | 85 | |
| 178 | - | ( | |
| 184 | + | (c) runs a mobile operating system; and | |
| 179 | 185 | 86 | |
| 180 | - | ( | |
| 186 | + | (d) is capable of running apps through the mobile operating system. | |
| 181 | 187 | 87 | |
| 182 | - | ( | |
| 188 | + | (14) "Mobile operating system" means software that: | |
| 183 | 189 | 88 | |
| 184 | - | ( | |
| 190 | + | (a) manages mobile device hardware resources; | |
| 185 | 191 | 89 | |
| 186 | - | ( | |
| 192 | + | (b) provides common services for mobile device programs; | |
| 187 | 193 | 90 | |
| 188 | - | ( | |
| 194 | + | (c) controls memory allocation; and | |
| 189 | 195 | 91 | |
| 190 | - | ( | |
| 196 | + | (d) provides interfaces for applications to access device functionality. | |
| 191 | 197 | 92 | |
| 192 | - | ( | |
| 198 | + | (15) "Parent" means, with respect to a minor, any of the following individuals who have | |
| 193 | 199 | 93 | |
| 194 | - | (15) "Parent" means, with respect to a minor, any of the following individuals who have | |
| 200 | + | legal authority to make decisions on behalf of the minor: | |
| 201 | + | - 3 - 6th Sub. (Cherry) S.B. 142 03-04 21:02 | |
| 195 | 202 | 94 | |
| 196 | - | legal authority to make decisions on behalf of the minor: | |
| 197 | - | - 3 - S.B. 142 Enrolled Copy | |
| 203 | + | (a) an individual with a parent-child relationship under Section 78B-15-201; | |
| 198 | 204 | 95 | |
| 199 | - | ( | |
| 205 | + | (b) a legal guardian; or | |
| 200 | 206 | 96 | |
| 201 | - | ( | |
| 207 | + | (c) an individual with legal custody. | |
| 202 | 208 | 97 | |
| 203 | - | ( | |
| 209 | + | (16) "Parent account" means an account with an app store provider that: | |
| 204 | 210 | 98 | |
| 205 | - | ( | |
| 211 | + | (a) is verified to be established by an individual who the app store provider has | |
| 206 | 212 | 99 | |
| 207 | - | ||
| 213 | + | determined is at least 18 years old through the app store provider's age verification | |
| 208 | 214 | 100 | |
| 209 | - | ||
| 215 | + | methods; and | |
| 210 | 216 | 101 | |
| 211 | - | ||
| 217 | + | (b) may be affiliated with one or more minor accounts. | |
| 212 | 218 | 102 | |
| 213 | - | ( | |
| 219 | + | (17) "Parental consent disclosure" means the following information that an app store | |
| 214 | 220 | 103 | |
| 215 | - | ||
| 221 | + | provider is required to provide to a parent before obtaining parental consent: | |
| 216 | 222 | 104 | |
| 217 | - | provider | |
| 223 | + | (a) if the app store provider has an age rating for the app or in-app purchase, the app's or | |
| 218 | 224 | 105 | |
| 219 | - | ||
| 225 | + | in-app purchase's age rating; | |
| 220 | 226 | 106 | |
| 221 | - | in-app purchase | |
| 227 | + | (b) if the app store provider has a content description for the app or in-app purchase, the | |
| 222 | 228 | 107 | |
| 223 | - | ||
| 229 | + | app's or in-app purchase's content description; | |
| 224 | 230 | 108 | |
| 225 | - | ||
| 231 | + | (c) a description of: | |
| 226 | 232 | 109 | |
| 227 | - | ( | |
| 233 | + | (i) the personal data collected by the app from a user; and | |
| 228 | 234 | 110 | |
| 229 | - | ( | |
| 235 | + | (ii) the personal data shared by the app with a third party; and | |
| 230 | 236 | 111 | |
| 231 | - | ( | |
| 237 | + | (d) if personal data is collected by the app, the methods implemented by the developer to | |
| 232 | 238 | 112 | |
| 233 | - | ||
| 239 | + | protect the personal data. | |
| 234 | 240 | 113 | |
| 235 | - | ||
| 241 | + | (18) "Significant change" means a material modification to an app's terms of service or | |
| 236 | 242 | 114 | |
| 237 | - | ||
| 243 | + | privacy policy that: | |
| 238 | 244 | 115 | |
| 239 | - | ||
| 245 | + | (a) changes the categories of data collected, stored, or shared; | |
| 240 | 246 | 116 | |
| 241 | - | ( | |
| 247 | + | (b) alters the app's age rating or content descriptions; | |
| 242 | 248 | 117 | |
| 243 | - | ( | |
| 249 | + | (c) adds new monetization features, including: | |
| 244 | 250 | 118 | |
| 245 | - | ( | |
| 251 | + | (i) in-app purchases; or | |
| 246 | 252 | 119 | |
| 247 | - | ( | |
| 253 | + | (ii) advertisements; or | |
| 248 | 254 | 120 | |
| 249 | - | ( | |
| 255 | + | (d) materially changes the app's: | |
| 250 | 256 | 121 | |
| 251 | - | ( | |
| 257 | + | (i) functionality; or | |
| 252 | 258 | 122 | |
| 253 | - | ( | |
| 259 | + | (ii) user experience. | |
| 254 | 260 | 123 | |
| 255 | - | ( | |
| 261 | + | (19) "Verifiable parental consent" means authorization that: | |
| 256 | 262 | 124 | |
| 257 | - | ( | |
| 263 | + | (a) is provided by an individual who the app store provider has verified is an adult; | |
| 258 | 264 | 125 | |
| 259 | - | ( | |
| 265 | + | (b) is given after the app store provider has clearly and conspicuously provided the | |
| 260 | 266 | 126 | |
| 261 | - | ||
| 267 | + | parental consent disclosure to the individual; and | |
| 262 | 268 | 127 | |
| 263 | - | parental consent disclosure to the individual; and | |
| 269 | + | (c) requires the parent to make an affirmative choice to: | |
| 270 | + | - 4 - 03-04 21:02 6th Sub. (Cherry) S.B. 142 | |
| 264 | 271 | 128 | |
| 265 | - | (c) requires the parent to make an affirmative choice to: | |
| 266 | - | - 4 - Enrolled Copy S.B. 142 | |
| 272 | + | (i) grant consent; or | |
| 267 | 273 | 129 | |
| 268 | - | ( | |
| 274 | + | (ii) decline consent. | |
| 269 | 275 | 130 | |
| 270 | - | ||
| 276 | + | Section 2. Section 13-75-201 is enacted to read: | |
| 271 | 277 | 131 | |
| 272 | - | Section 2. Section 13-75-201 is enacted to read: | |
| 273 | - | 132 | |
| 274 | 278 | ||
| 275 | 279 | Part 2. App Store Provider and Developer Requirements | |
| 280 | + | 132 | |
| 281 | + | 13-75-201 (Effective 05/06/26). App store provider requirements. | |
| 276 | 282 | 133 | |
| 277 | - | ||
| 283 | + | (1) An app store provider shall: | |
| 278 | 284 | 134 | |
| 279 | - | ( | |
| 285 | + | (a) at the time an individual who is located in the state creates an account with the app | |
| 280 | 286 | 135 | |
| 281 | - | ||
| 287 | + | store provider: | |
| 282 | 288 | 136 | |
| 283 | - | ||
| 289 | + | (i) request age information from the individual; and | |
| 284 | 290 | 137 | |
| 285 | - | ( | |
| 291 | + | (ii) verify the individual's age category using: | |
| 286 | 292 | 138 | |
| 287 | - | ( | |
| 293 | + | (A) commercially available methods that are reasonably designed to ensure | |
| 288 | 294 | 139 | |
| 289 | - | ||
| 295 | + | accuracy; or | |
| 290 | 296 | 140 | |
| 291 | - | ||
| 297 | + | (B) an age verification method or process that complies with rules made by the | |
| 292 | 298 | 141 | |
| 293 | - | ||
| 299 | + | division under Section 13-75-301; | |
| 294 | 300 | 142 | |
| 295 | - | ||
| 301 | + | (b) if the age verification method or process described in Subsection (1)(a) determines | |
| 296 | 302 | 143 | |
| 297 | - | ||
| 303 | + | the individual is a minor: | |
| 298 | 304 | 144 | |
| 299 | - | the | |
| 305 | + | (i) require the account to be affiliated with a parent account; and | |
| 300 | 306 | 145 | |
| 301 | - | ( | |
| 307 | + | (ii) obtain verifiable parental consent from the holder of the affiliated parent account | |
| 302 | 308 | 146 | |
| 303 | - | ||
| 309 | + | before allowing the minor to: | |
| 304 | 310 | 147 | |
| 305 | - | ||
| 311 | + | (A) download an app; | |
| 306 | 312 | 148 | |
| 307 | - | ( | |
| 313 | + | (B) purchase an app; or | |
| 308 | 314 | 149 | |
| 309 | - | ( | |
| 315 | + | (C) make an in-app purchase; | |
| 310 | 316 | 150 | |
| 311 | - | (C) | |
| 317 | + | (c) after receiving notice of a significant change from a developer: | |
| 312 | 318 | 151 | |
| 313 | - | ( | |
| 319 | + | (i) notify the user of the significant change; and | |
| 314 | 320 | 152 | |
| 315 | - | ( | |
| 321 | + | (ii) for a minor account: | |
| 316 | 322 | 153 | |
| 317 | - | ( | |
| 323 | + | (A) notify the holder of the affiliated parent account; and | |
| 318 | 324 | 154 | |
| 319 | - | ( | |
| 325 | + | (B) obtain renewed verifiable parental consent; | |
| 320 | 326 | 155 | |
| 321 | - | ( | |
| 327 | + | (d) provide to a developer, in response to a request authorized under Section 13-75-202: | |
| 322 | 328 | 156 | |
| 323 | - | ( | |
| 329 | + | (i) age category data for a user located in the state; and | |
| 324 | 330 | 157 | |
| 325 | - | ( | |
| 331 | + | (ii) the status of verified parental consent for a minor located in the state; | |
| 326 | 332 | 158 | |
| 327 | - | ( | |
| 333 | + | (e) notify a developer when a parent revokes parental consent; and | |
| 328 | 334 | 159 | |
| 329 | - | ( | |
| 335 | + | (f) protect personal age verification data by: | |
| 330 | 336 | 160 | |
| 331 | - | ( | |
| 337 | + | (i) limiting collection and processing to data necessary for: | |
| 332 | 338 | 161 | |
| 333 | - | (i) limiting collection and processing to data necessary for: | |
| 339 | + | (A) verifying a user's age; | |
| 340 | + | - 5 - 6th Sub. (Cherry) S.B. 142 03-04 21:02 | |
| 334 | 341 | 162 | |
| 335 | - | (A) verifying a user's age; | |
| 336 | - | - 5 - S.B. 142 Enrolled Copy | |
| 342 | + | (B) obtaining parental consent; or | |
| 337 | 343 | 163 | |
| 338 | - | ( | |
| 344 | + | (C) maintaining compliance records; and | |
| 339 | 345 | 164 | |
| 340 | - | ( | |
| 346 | + | (ii) transmitting personal age verification data using industry-standard encryption | |
| 341 | 347 | 165 | |
| 342 | - | ||
| 348 | + | protocols that ensure: | |
| 343 | 349 | 166 | |
| 344 | - | ||
| 350 | + | (A) data integrity; and | |
| 345 | 351 | 167 | |
| 346 | - | ( | |
| 352 | + | (B) data confidentiality. | |
| 347 | 353 | 168 | |
| 348 | - | ( | |
| 354 | + | (2) An app store provider may not: | |
| 349 | 355 | 169 | |
| 350 | - | ( | |
| 356 | + | (a) enforce a contract or terms of service against a minor unless the app store provider | |
| 351 | 357 | 170 | |
| 352 | - | ||
| 358 | + | has obtained verifiable parental consent; | |
| 353 | 359 | 171 | |
| 354 | - | ||
| 360 | + | (b) knowingly misrepresent the information in the parental consent disclosure; or | |
| 355 | 361 | 172 | |
| 356 | - | ( | |
| 362 | + | (c) share personal age verification data except: | |
| 357 | 363 | 173 | |
| 358 | - | ( | |
| 364 | + | (i) between an app store provider and a developer as required by this chapter; or | |
| 359 | 365 | 174 | |
| 360 | - | ( | |
| 366 | + | (ii) as required by law. | |
| 361 | 367 | 175 | |
| 362 | - | ||
| 368 | + | Section 3. Section 13-75-202 is enacted to read: | |
| 363 | 369 | 176 | |
| 364 | - | ||
| 370 | + | 13-75-202 (Effective 05/06/26). Developer requirements. | |
| 365 | 371 | 177 | |
| 366 | - | ||
| 372 | + | (1) A developer shall: | |
| 367 | 373 | 178 | |
| 368 | - | ( | |
| 374 | + | (a) verify through the app store's data sharing methods: | |
| 369 | 375 | 179 | |
| 370 | - | ( | |
| 376 | + | (i) the age category of users located in the state; and | |
| 371 | 377 | 180 | |
| 372 | - | ( | |
| 378 | + | (ii) for a minor account, whether verifiable parental consent has been obtained; | |
| 373 | 379 | 181 | |
| 374 | - | ( | |
| 380 | + | (b) notify app store providers of a significant change to the app; | |
| 375 | 381 | 182 | |
| 376 | - | ( | |
| 382 | + | (c) use age category data received from an app store provider to: | |
| 377 | 383 | 183 | |
| 378 | - | ( | |
| 384 | + | (i) enforce any developer-created age-related restrictions; | |
| 379 | 385 | 184 | |
| 380 | - | ( | |
| 386 | + | (ii) ensure compliance with applicable laws and regulations; and | |
| 381 | 387 | 185 | |
| 382 | - | ( | |
| 388 | + | (iii) implement any developer-created safety-related features or defaults. | |
| 383 | 389 | 186 | |
| 384 | - | ( | |
| 390 | + | (d) request personal age verification data or parental consent: | |
| 385 | 391 | 187 | |
| 386 | - | ( | |
| 392 | + | (i) at the time a user: | |
| 387 | 393 | 188 | |
| 388 | - | ( | |
| 394 | + | (A) downloads an app; or | |
| 389 | 395 | 189 | |
| 390 | - | ( | |
| 396 | + | (B) purchases an app; | |
| 391 | 397 | 190 | |
| 392 | - | ( | |
| 398 | + | (ii) when implementing a significant change to the app; or | |
| 393 | 399 | 191 | |
| 394 | - | ( | |
| 400 | + | (iii) to comply with applicable laws or regulations. | |
| 395 | 401 | 192 | |
| 396 | - | ( | |
| 402 | + | (2) A developer may request personal age verification data or parental consent: | |
| 397 | 403 | 193 | |
| 398 | - | ( | |
| 404 | + | (a) no more than once during each 12-month period to verify: | |
| 399 | 405 | 194 | |
| 400 | - | ( | |
| 406 | + | (i) accuracy of user age verification data; or | |
| 401 | 407 | 195 | |
| 402 | - | (i) accuracy of user age verification data; or | |
| 408 | + | (ii) continued account use within the verified age category; | |
| 409 | + | - 6 - 03-04 21:02 6th Sub. (Cherry) S.B. 142 | |
| 403 | 410 | 196 | |
| 404 | - | (ii) continued account use within the verified age category; | |
| 405 | - | - 6 - Enrolled Copy S.B. 142 | |
| 411 | + | (b) when there is reasonable suspicion of: | |
| 406 | 412 | 197 | |
| 407 | - | ( | |
| 413 | + | (i) account transfer; or | |
| 408 | 414 | 198 | |
| 409 | - | ( | |
| 415 | + | (ii) misuse outside the verified age category; or | |
| 410 | 416 | 199 | |
| 411 | - | ( | |
| 417 | + | (c) at the time a user creates a new account with the developer. | |
| 412 | 418 | 200 | |
| 413 | - | ( | |
| 419 | + | (3) When implementing any developer-created safety-related features or defaults, a | |
| 414 | 420 | 201 | |
| 415 | - | ||
| 421 | + | developer shall use the lowest age category indicated by: | |
| 416 | 422 | 202 | |
| 417 | - | ||
| 423 | + | (a) age verification data provided by an app store provider; or | |
| 418 | 424 | 203 | |
| 419 | - | ( | |
| 425 | + | (b) age data independently collected by the developer. | |
| 420 | 426 | 204 | |
| 421 | - | ( | |
| 427 | + | (4) A developer may not: | |
| 422 | 428 | 205 | |
| 423 | - | ( | |
| 429 | + | (a) enforce a contract or terms of service against a minor unless the developer has | |
| 424 | 430 | 206 | |
| 425 | - | ||
| 431 | + | verified through the app store provider that verifiable parental consent has been | |
| 426 | 432 | 207 | |
| 427 | - | ||
| 433 | + | obtained; | |
| 428 | 434 | 208 | |
| 429 | - | ||
| 435 | + | (b) knowingly misrepresent any information in the parental consent disclosure; or | |
| 430 | 436 | 209 | |
| 431 | - | ( | |
| 437 | + | (c) share age category data with any person. | |
| 432 | 438 | 210 | |
| 433 | - | ||
| 439 | + | Section 4. Section 13-75-301 is enacted to read: | |
| 434 | 440 | 211 | |
| 435 | - | Section 4. Section 13-75-301 is enacted to read: | |
| 436 | - | 212 | |
| 437 | 441 | ||
| 438 | 442 | Part 3. Division Rulemaking | |
| 443 | + | 212 | |
| 444 | + | 13-75-301 (Effective 05/07/25). Division rulemaking. | |
| 439 | 445 | 213 | |
| 440 | - | ||
| 446 | + | In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the | |
| 441 | 447 | 214 | |
| 442 | - | ||
| 448 | + | division shall make rules establishing processes and means by which an app store provider | |
| 443 | 449 | 215 | |
| 444 | - | ||
| 450 | + | may verify whether an account holder is a minor in accordance with Subsection | |
| 445 | 451 | 216 | |
| 446 | - | ||
| 452 | + | 13-75-201(1)(a)(ii). | |
| 447 | 453 | 217 | |
| 448 | - | 13-75- | |
| 454 | + | Section 5. Section 13-75-401 is enacted to read: | |
| 449 | 455 | 218 | |
| 450 | - | Section 5. Section 13-75-401 is enacted to read: | |
| 451 | - | 219 | |
| 452 | 456 | ||
| 453 | 457 | Part 4. Enforcement and Safe Harbor | |
| 458 | + | 219 | |
| 459 | + | 13-75-401 (Effective 12/31/26). Enforcement. | |
| 454 | 460 | 220 | |
| 455 | - | 13-75- | |
| 461 | + | (1) A violation of Subsection 13-75-201(2)(b) or Subsection 13-75-202(4)(b) constitutes a | |
| 456 | 462 | 221 | |
| 457 | - | ||
| 463 | + | deceptive trade practice under Section 13-11a-3. | |
| 458 | 464 | 222 | |
| 459 | - | ||
| 465 | + | (2)(a) Only a minor, or the parent of that minor, who has been harmed by a violation of | |
| 460 | 466 | 223 | |
| 461 | - | (2) | |
| 467 | + | Subsection 13-75-201(2) may bring a civil action against an app store provider. | |
| 462 | 468 | 224 | |
| 463 | - | ||
| 469 | + | (b) Only a minor, or the parent of that minor, who has been harmed by a violation of | |
| 464 | 470 | 225 | |
| 465 | - | ( | |
| 471 | + | Subsection 13-75-202(4) may bring a civil action against a developer. | |
| 466 | 472 | 226 | |
| 467 | - | Subsection | |
| 473 | + | (3) In an action described in Subsection (2), the court shall award a prevailing parent: | |
| 468 | 474 | 227 | |
| 469 | - | ( | |
| 475 | + | (a) the greater of: | |
| 470 | 476 | 228 | |
| 471 | - | (a) the greater of: | |
| 477 | + | (i) actual damages; or | |
| 478 | + | - 7 - 6th Sub. (Cherry) S.B. 142 03-04 21:02 | |
| 472 | 479 | 229 | |
| 473 | - | (i) actual damages; or | |
| 474 | - | - 7 - S.B. 142 Enrolled Copy | |
| 480 | + | (ii) $1,000 for each violation; | |
| 475 | 481 | 230 | |
| 476 | - | ( | |
| 482 | + | (b) reasonable attorney fees; and | |
| 477 | 483 | 231 | |
| 478 | - | ( | |
| 484 | + | (c) litigation costs. | |
| 479 | 485 | 232 | |
| 480 | - | ||
| 486 | + | Section 6. Section 13-75-402 is enacted to read: | |
| 481 | 487 | 233 | |
| 482 | - | ||
| 488 | + | 13-75-402 (Effective 05/07/25). Safe harbor. | |
| 483 | 489 | 234 | |
| 484 | - | ||
| 490 | + | (1) A developer is not liable for a violation of this chapter if the developer demonstrates | |
| 485 | 491 | 235 | |
| 486 | - | ||
| 492 | + | that the developer: | |
| 487 | 493 | 236 | |
| 488 | - | ||
| 494 | + | (a) relied in good faith on: | |
| 489 | 495 | 237 | |
| 490 | - | ( | |
| 496 | + | (i) personal age verification data provided by an app store provider; and | |
| 491 | 497 | 238 | |
| 492 | - | ( | |
| 498 | + | (ii) notification from an app store provider that verifiable parental consent was | |
| 493 | 499 | 239 | |
| 494 | - | ||
| 500 | + | obtained if the personal age verification data indicates that the user is a minor; and | |
| 495 | 501 | 240 | |
| 496 | - | ||
| 502 | + | (b) complied with the requirements described in Section 13-75-202. | |
| 497 | 503 | 241 | |
| 498 | - | ( | |
| 504 | + | (2) For purposes of setting the age category of an app and providing content description | |
| 499 | 505 | 242 | |
| 500 | - | ||
| 506 | + | disclosures to an app store provider, a developer complies with Subsection | |
| 501 | 507 | 243 | |
| 502 | - | ||
| 508 | + | 13-75-202(4)(b) if the developer: | |
| 503 | 509 | 244 | |
| 504 | - | ||
| 510 | + | (a) uses widely adopted industry standards to determine: | |
| 505 | 511 | 245 | |
| 506 | - | ( | |
| 512 | + | (i) the app's age category; and | |
| 507 | 513 | 246 | |
| 508 | - | ( | |
| 514 | + | (ii) the content description disclosures; and | |
| 509 | 515 | 247 | |
| 510 | - | ( | |
| 516 | + | (b) applies those standards consistently and in good faith. | |
| 511 | 517 | 248 | |
| 512 | - | ( | |
| 518 | + | (3) The safe harbor described in this section: | |
| 513 | 519 | 249 | |
| 514 | - | ( | |
| 520 | + | (a) applies only to actions brought under this chapter; and | |
| 515 | 521 | 250 | |
| 516 | - | ( | |
| 522 | + | (b) does not limit a developer or app store provider's liability under any other applicable | |
| 517 | 523 | 251 | |
| 518 | - | ||
| 524 | + | law. | |
| 519 | 525 | 252 | |
| 520 | - | ||
| 526 | + | (4) Nothing in this chapter shall displace any other available remedies or rights authorized | |
| 521 | 527 | 253 | |
| 522 | - | ||
| 528 | + | under the laws of this state or the United States. | |
| 523 | 529 | 254 | |
| 524 | - | ||
| 530 | + | Section 7. Section 13-75-403 is enacted to read: | |
| 525 | 531 | 255 | |
| 526 | - | ||
| 532 | + | 13-75-403 (Effective 05/07/25). Severability. | |
| 527 | 533 | 256 | |
| 528 | - | ||
| 534 | + | (1) If any provision of this chapter or the application of any provision to any person or | |
| 529 | 535 | 257 | |
| 530 | - | ||
| 536 | + | circumstance is held invalid by a final decision of a court of competent jurisdiction, the | |
| 531 | 537 | 258 | |
| 532 | - | ||
| 538 | + | remainder of this chapter shall be given effect without the invalid provision or | |
| 533 | 539 | 259 | |
| 534 | - | ||
| 540 | + | application. | |
| 535 | 541 | 260 | |
| 536 | - | ||
| 542 | + | (2) The provisions of this chapter are severable. | |
| 537 | 543 | 261 | |
| 538 | - | ||
| 544 | + | Section 8. Section 13-75-404 is enacted to read: | |
| 539 | 545 | 262 | |
| 540 | - | Section 8. Section 13-75-404 is enacted to read: | |
| 546 | + | 13-75-404 (Effective 05/07/25). Application and limitations. | |
| 547 | + | - 8 - 03-04 21:02 6th Sub. (Cherry) S.B. 142 | |
| 541 | 548 | 263 | |
| 542 | - | 13-75-404 (Effective 05/07/25). Application and limitations. | |
| 543 | - | - 8 - Enrolled Copy S.B. 142 | |
| 549 | + | Nothing in this chapter shall be construed to: | |
| 544 | 550 | 264 | |
| 545 | - | ||
| 551 | + | (1) prevent an app store provider or developer from taking reasonable measures to: | |
| 546 | 552 | 265 | |
| 547 | - | ( | |
| 553 | + | (a) block, detect, or prevent distribution to minors of: | |
| 548 | 554 | 266 | |
| 549 | - | ( | |
| 555 | + | (i) unlawful material; | |
| 550 | 556 | 267 | |
| 551 | - | ( | |
| 557 | + | (ii) obscene material; or | |
| 552 | 558 | 268 | |
| 553 | - | ( | |
| 559 | + | (iii) other harmful material; | |
| 554 | 560 | 269 | |
| 555 | - | ( | |
| 561 | + | (b) block or filter spam; | |
| 556 | 562 | 270 | |
| 557 | - | ( | |
| 563 | + | (c) prevent criminal activity; or | |
| 558 | 564 | 271 | |
| 559 | - | ( | |
| 565 | + | (d) protect app store or app security; | |
| 560 | 566 | 272 | |
| 561 | - | ( | |
| 567 | + | (2) require an app store provider to disclose user information to a developer beyond: | |
| 562 | 568 | 273 | |
| 563 | - | ( | |
| 569 | + | (a) age category; or | |
| 564 | 570 | 274 | |
| 565 | - | ( | |
| 571 | + | (b) verification of parental consent status; | |
| 566 | 572 | 275 | |
| 567 | - | ( | |
| 573 | + | (3) allow an app store provider or developer to implement measures required by this | |
| 568 | 574 | 276 | |
| 569 | - | ||
| 575 | + | chapter in a manner that is: | |
| 570 | 576 | 277 | |
| 571 | - | ||
| 577 | + | (a) arbitrary; | |
| 572 | 578 | 278 | |
| 573 | - | ( | |
| 579 | + | (b) capricious; | |
| 574 | 580 | 279 | |
| 575 | - | ( | |
| 581 | + | (c) anticompetitive; or | |
| 576 | 582 | 280 | |
| 577 | - | ( | |
| 583 | + | (d) unlawful; | |
| 578 | 584 | 281 | |
| 579 | - | ( | |
| 585 | + | (4) require an app store provider or developer to obtain parental consent for an app that: | |
| 580 | 586 | 282 | |
| 581 | - | ( | |
| 587 | + | (a) provides direct access to emergency services, including: | |
| 582 | 588 | 283 | |
| 583 | - | ( | |
| 589 | + | (i) 911; | |
| 584 | 590 | 284 | |
| 585 | - | ( | |
| 591 | + | (ii) crisis hotlines; or | |
| 586 | 592 | 285 | |
| 587 | - | ( | |
| 593 | + | (iii) emergency assistance services legally available to minors; | |
| 588 | 594 | 286 | |
| 589 | - | ( | |
| 595 | + | (b) limits data collection to information necessary to provide emergency services in | |
| 590 | 596 | 287 | |
| 591 | - | ||
| 597 | + | compliance with 15 U.S.C. Sec. 6501 et seq., Children's Online Privacy Protection | |
| 592 | 598 | 288 | |
| 593 | - | ||
| 599 | + | Act; | |
| 594 | 600 | 289 | |
| 595 | - | ||
| 601 | + | (c) provides access without requiring: | |
| 596 | 602 | 290 | |
| 597 | - | ( | |
| 603 | + | (i) account creation; or | |
| 598 | 604 | 291 | |
| 599 | - | ( | |
| 605 | + | (ii) collection of unnecessary personal information; and | |
| 600 | 606 | 292 | |
| 601 | - | ( | |
| 607 | + | (d) is operated by or in partnership with: | |
| 602 | 608 | 293 | |
| 603 | - | ( | |
| 609 | + | (i) a government entity; | |
| 604 | 610 | 294 | |
| 605 | - | ( | |
| 611 | + | (ii) a nonprofit organization; or | |
| 606 | 612 | 295 | |
| 607 | - | ( | |
| 613 | + | (iii) an authorized emergency service provider; or | |
| 608 | 614 | 296 | |
| 609 | - | (iii) an authorized emergency service provider; or | |
| 615 | + | (5) require a developer to collect, retain, reidentify, or link any information beyond what is: | |
| 616 | + | - 9 - 6th Sub. (Cherry) S.B. 142 03-04 21:02 | |
| 610 | 617 | 297 | |
| 611 | - | (5) require a developer to collect, retain, reidentify, or link any information beyond what is: | |
| 612 | - | - 9 - S.B. 142 Enrolled Copy | |
| 618 | + | (a) necessary to verify age categories and parental consent status as required by this | |
| 613 | 619 | 298 | |
| 614 | - | ||
| 620 | + | chapter; and | |
| 615 | 621 | 299 | |
| 616 | - | ||
| 622 | + | (b) collected, retained, reidentified, or linked in the developer's ordinary course of | |
| 617 | 623 | 300 | |
| 618 | - | ||
| 624 | + | business. | |
| 619 | 625 | 301 | |
| 620 | - | ||
| 626 | + | Section 9. Effective Date. | |
| 621 | 627 | 302 | |
| 622 | - | ||
| 628 | + | (1) Except as provided in Subsections (2) and (3), this bill takes effect May 7, 2025. | |
| 623 | 629 | 303 | |
| 624 | - | ||
| 630 | + | (2) The actions affecting the following sections take effect on May 6, 2026: | |
| 625 | 631 | 304 | |
| 626 | - | ( | |
| 632 | + | (a) Section 13-75-201 (Effective 05/06/26); and | |
| 627 | 633 | 305 | |
| 628 | - | ( | |
| 634 | + | (b) Section 13-75-202 (Effective 05/06/26). | |
| 629 | 635 | 306 | |
| 630 | - | ( | |
| 636 | + | (3) The actions affecting Section 13-75-401 (Effective 12/31/26) take effect on December | |
| 631 | 637 | 307 | |
| 632 | - | (3) The actions affecting Section 13-75-401 (Effective 12/31/26) take effect on December | |
| 633 | - | 308 | |
| 634 | 638 | 31, 2026. | |
| 635 | 639 | - 10 - |