In Brief

On Thursday March 23, Utah Governor Spencer Cox signed two bills — S.B. 152 and H.B. 311 (collectively, the “Utah Social Media Regulation Act”) —that impose new requirements and limitations on children’s use of social media platforms.

Background

Together, both S.B. 152 and H.B. 311 enact the Utah Social Media Regulation Act, which is set to go into effect on March 1, 2024.

Once in effect, S.B. 152 will require social media platforms to verify the age of any Utah residents using the platform. For Utah users under the age of 18, S.B. 152 requires parental consent to open an account and maintain an existing account. However, the legislation does not specify how a user’s age is to be verified and consent is to be obtained: these questions will be determined by subsequent rulemaking. Parental consent would also be required for minors wishing to access their social media accounts between the hours of 10:30pm and 6:30am, and parents of minors must be granted access to their children’s accounts. In addition, social media platforms will be banned from displaying advertising to minors’ accounts and from displaying targeted or suggested groups, services, products, posts, accounts, or users to the accounts of children users. Lastly, platforms will be prohibited from collecting information from the posts, content, messages, text or usage activities of minor accounts, except as necessary to comply with state or federal law. Organizations in breach of S.B. 152’s provisions may be held liable for up to $2,500 per violation. The act establishes both regulatory enforcement and a private right of action.

Social media platforms with under-age users in Utah will also be subject to H.B. 311. This legislation prohibits designs, features, and practices on social media applications that cause social media addiction among minors. What kinds of practices would be considered addiction-inducing is not addressed by the statute. Companies in breach of H.B. 311 may be liable up to $250,000 for each addiction-causing practice, design, or feature, as well as an additional $2,500 for each Utah minor account holder exposed to addictive features. Private enforcement of H.B. 311 is also available, and the statute creates a rebuttable presumption that harm occurred in respect of users under 16 years old.

Utah is the first state to pass legislation limiting minors’ use of social media. Similar bills are pending in Arkansas, where a proposed law would require minors to have parental permission to use a social media platform, and New Jersey, where a recently-introduced bill would require social media sites to conduct audits to assess whether their features cause or are likely to cause addiction in underage users. And California has passed a law, which will take effect in the summer of 2024, that places restrictions on how social media companies use information related to child users and requires assessments of the physical and mental health consequences to minors.

What’s Next

Organizations offering social media platforms should continue to monitor developments to these pieces of legislation as they unfold, including subsequent rulemaking actions. In the meantime, they should establish lines of communication between their legal, compliance, engineering and product teams to ensure they are in a position to implement measures required by new legislation. Should you have questions about this or other data privacy issues, reach out to any of the Baker McKenzie attorneys below.

Author

Elizabeth Roper is a partner in Baker McKenzie's North America Litigation and Global Dispute Resolution Practice. She is based in the New York office. Prior to joining the firm, Liz served in the Manhattan District Attorney's Office as Bureau Chief of the Cybercrime and Identity Theft Bureau (CITB). In this role, Liz directed the investigation and prosecution of all types of cybercrime impacting Manhattan, including sophisticated cyber-enabled financial crime such as identity theft, payment card fraud, and money laundering; network intrusions, hacking, ransomware, and "middleman" attacks; intellectual property theft; "dark web" trafficking of contraband; and the theft and illicit use of cryptocurrencies.

Author

Cyrus Vance Jr. is a partner in Baker McKenzie's North America Litigation and Government Enforcement Practice as well as the Firm's Global Compliance and Investigations Practice. He is based in New York and serves as Global Chair of the Cybersecurity Practice.

Author

Mariana Oliver is an associate based in Baker McKenzie's Intellectual Property & Technology Group based in Chicago.

Author

Avi Toltzis is a Knowledge Lawyer in Baker McKenzie's Chicago office.