Utah Ushers in New Age of U.S. State Regulations on Social Media Companies; Passes Law Requiring Parental Consent

Authors: Lucas Schaetzel

U.S. states are moving to regulate social media as social media laws take shape—such as Utah’s which requires prior parental consent for those under the age of 18—in addition to state laws that more broadly regulate data protection.

On March 24th, Utah’s governor signed two new state laws that act to create broad controls that social media companies need to enact and requirements they need to meet in operating their platforms—such as being required to obtain a parent or legal guardian’s prior consent before anyone under the age of 18 joins a social media site.

Both laws take effect March 1, 2024.

The Social Media Regulation Amendment is the most far reaching. Not only does the Social Media Regulation Amendment require express consent from parents for users under the age of 18, but it also requires social media companies to (1) verify the age of existing and new Utah account holders; and (2) verify that existing Utah account holders have provide the requites consent if they are under the age of 18. This is just a sample of the far reaching aspects of the Social Media Regulation Amendment.

The second bill, the Social Media Usage Amendments, creates enforcement and regulatory structures regarding social media companies. Importantly, the Social Media Usage Amendments create a private right of action by which Utah residents can collect damages from social media companies for harm incurred by a user under the age of 18.

This is not the first instance in a new wave of social media regulation. In the EU, the Digital Markets Act, which will be enforced beginning in July 2023, regulates anti-competitive behavior and unfair and deceptive practices. Additionally, in California, the Age-Appropriate Design Code Act goes into effect July 1, 2024 and requires business and websites / applications designed or targeting those 18 years old or younger to configure certain privacy settings by default and engage in regular data privacy impact assessments.

Scope and Applicability

Both laws will govern and regulate the activities of “social media companies” that is subject to a two-prong definition: (i) the entity provides a social media platform that has at least 5,000,000 account holders worldwide; and (ii) the entity is an interactive computer service.

First, a “social media platform” includes those online forums that companies make available to individuals who can create accounts and: (i) create a profile, (ii) upload posts; (iii) view the posts of other account holders; and (iv) interact with other account holders or uses. There are numerous exceptions to what constitutes a “social media platform”, including, for example, direct text messaging services and forums, applications that allow for photo and video to be sent directly between devices, email services, e-commerce, interactive gaming websites, and cloud service providers.

Second, an “interactive computer service” means an information service, information system, or information access software provider. It includes a web service, web system, a website, a web application, or a web portal.

The first prong of the definition will be where most of the analysis will occur as most entities operating in the online world likely fall within the second prong. However, both prongs must be met for an entity to be subject to the new Utah laws.

Social Media Regulation Amendments

The most impactful requirement under the Social Media Regulation Amendments is that all social media companies will need to obtain prior express consent from parents or legal guardians before any Utah user under the age of 18 is allowed to sign up or continue using their account. However, there are also other broad and potentially onerous requirements.

Social media companies must also take on the following restrictions and obligations for any account held by a Utah resident under the age of 18: (1) prohibited from allowing direct messaging between any account not link to the minor’s account through “friending”; (2) prohibited from showing the minor’s account search results for any use not link to the minor’s account through friending; (3) prohibited from displaying any advertising in the minor’s account; (4) prohibited from collecting or using any personal information from any posts, messages, or other content or usage activities of the minor’s account other than that information which is necessary to comply with law; and (5) prohibited from using targeted or suggested groups, services, products, posts or accounts to the minor’s account.

The foregoing requirements essentially bar social media companies falling within the scope of these two new Utah laws from engaging in activity that has become commonplace amongst social media companies. The Utah laws cut off those activities—such as advertising and suggested groups, friends, etc.—for accounts link to Utah users under the age of 18.

Related to the parental and legal guardian consent, social media companies will also be required to provide to parents or legal guardians who grant consent for Utah users under the age of 18, access to that minor’s account.

Social Media Usage Amendments

The Social Media Usage Amendments focus on granting broad government enforcement powers to the state and allowing Utah residents to take legal action against social media companies themselves through a private right of action.

Specifically, under the Social Media Usage Amendment, social media companies are prohibited from using any practice, design, or feature on their social media platform that the social media company knows, or should have reasonably known, would cause a Utah user under the age of 18 to have an addiction to the social media platform.

With the law not yet in effect and no regulations made to further specify the “addition prohibition” it is unclear how this requirement and prohibition will be enforced.

Any social media company found to be in violation of the above will be subject to: (1) a fine of $250,000 for each practice, design, or feature shown to have caused addition; and (2) a fine of up to $2,500 per Utah user under the age of 18 who is shown to have been exposed to any such designs or features found to have cased addition.

Social media companies can establish affirmative defenses if they (1) maintain a program of at least quarterly audits of the platform’s practices, designs, and features to detect those that might have potential to cause, or contribute to, addition; and (2) correct, within 30 days of a completed audit, any component of the platform shown to present material risk of violating the requirements.

The Social Media Usage Amendments also create a private right of action. Beginning in March 2024, any Utah resident can file a claim against a social media company to recover damages incurred by a Utah user under the age of 18 for any “addition, financial, physical, or emotional harm suffered as a consequence of using or having an account on the social media company’s” platform.

Takeaways

States are not sitting idly by as the federal government fails to seriously consider further data protection or technology regulations. And Utah is an excellent example.

In 2022, Utah became the fourth state in the U.S. to pass a comprehensive state protection law (there are now six, with Iowa passing such a law in recent weeks). But Utah did not stop there as the new amendments discussed above represent further legislating in the technology and information space.

Expect more states to follow in 2023 and beyond.

As federal legislation on data protection and social media companies stagnates and U.S. states take the reins, the Benesch Data Protection and Privacy team is committed to staying at the forefront of knowledge and experience to assist our clients in compliance efforts. We are available to assist you with any compliance needs.

Lucas Schaetzel at lschaetzel@beneschlaw.com or 312.212.4977.