By requiring social media platforms to: 1) verify the age of all Utah users to determine if the existing or new account holder is a minor under 18, 2) obtain parental consent to create or maintain an account for a minor, 3) provide parental access to minors’ social media accounts, 4) limit hours of use, available features, and advertising to minors, and 5) avoid designing their platforms to be addictive to minors, Utah’s Social Media Regulation Act will seismically shift how individuals under the age of 18 (at least in Utah) can engage with social media platforms and how such platforms can offer their services.
Scope
The Utah Social Media Regulation Act goes beyond current federal and state laws designed to protect children by requiring parental consent for all users under 18, imposing certain feature restrictions for minors, and providing individuals with a private right of action to enforce such requirements. These requirements will set a new standard as the most restrictive set of comprehensive limitations on social media use by children. For comparison purposes, the Children’s Online Privacy Protection Act (“COPPA”) governs the collection of personal information from children under the age of 13, not 18. California’s Age Appropriate Design Code (“AADC”) (which will take effect July 1, 2024) applies to minors under 18, but it requires operators to allow minors aged 13-17, rather than parents, to make choices regarding their own privacy settings. Neither COPPA nor the AADC includes a private right of action.
Under the Utah law, the term “social media platforms” include, with some exceptions, online services with at least 5 million worldwide account holders that permit account holders to create a profile, upload posts, and view the posts of, and/or interact with, other account holders or users. The precise contours of which companies and platforms fit within the definition and enumerated exceptions are sure to be heavily debated.
Parental Consent and Access to Minors’ Accounts
Beginning March 1, 2024, parental consent will be required for Utah residents younger than 18 to have a social media account. This is the first law in the U.S. to require parental consent for users aged 13-17 to use an online service. This applies to both newly created accounts and existing accounts accessed after the law takes effect. To determine which users are under 18, social media companies must first verify the age of all users in Utah. The Division of Consumer Protection is tasked with establishing rules for the age and consent verification processes.
Unlike COPPA, which requires operators to allow parents to access the personal information of children under 13, and the California Consumer Privacy Act, which gives parents the right to request access to the personal information of their minor children, the Utah law requires social media platforms to give parents a password or other means to enable parents of minors through age 17 to access to their minor’s account to view the minor’s posts, messages, and replies.
Required Use Limitations Related to Minors Accounts on the Platform
The Utah law also restricts social media platforms’ collection and use of minor’s personal information and requires them to implement the following limitations for minors on the platform:
- Prohibit usage during certain hours – Minors cannot access their account between 10:30 p.m. and 6:30 a.m. though this time period can be modified or eliminated by a parent with access to the account. Parents must also be able to proactively set a maximum number of hours that the minor may use the account per day.
- Restrict messaging with non-connected accounts – Platforms cannot allow messaging between a minor’s account and an account they are not “friends” with.
- Exclusion from search results – Platforms cannot show a minor’s account in search results for any user that is not connected with that minor.
- No advertising – Platforms may not show any advertising in a minor’s account.
- No suggestions – Platforms may not provide targeted or suggested groups, services, products, posts, or accounts in a minor’s account.
Recently proposed federal legislation has included limitations on the display of targeted advertising to children under 13, but this is the first law in the US to ban all advertising to minors.
Enforcement
After written notice of a violation and a 30-day cure period, the Division of Consumer Protection can administer a fine of up to $2,500 in administrative penalties for each violation. In a court action by the Division of Consumer Protection, the court may issue injunctive relief, order disgorgement of money received in violation of the law, impose a civil penalty of up to $ 2,500 for each violation, award actual damages to an injured customer, and award any other relief the court deems reasonable and necessary.
The law also creates a private right of action (which is not subject to a cure period) allowing a successful claimant to recover attorney fees and the greater of (i) $2,500 per violation or (ii) actual damages for financial, physical, and emotional harm incurred.
Social Media Design Regulations
An accompanying law (also effective March 1, 2024) prohibits social media companies from using a practice, design, or feature that it knows, or should know, causes a minor to become addicted to the social media platform. “Addiction” is defined to include the use of the platform that indicates a user is substantially preoccupied, obsessed, or unable to reduce their use of the platform in a manner that causes physical, emotional, developmental, or material harm to the user.
Subject to a limited good-faith affirmative defense, the Division of Consumer Protection can administer a civil penalty of up to $250,000 for each practice, design, or feature to have caused addiction and up to $2,500 for each minor exposed to such practice, design, or feature. There is also a similar private right of action as the complementary law.
Aspects of these laws may be challenged on a variety of grounds, but it is unclear if businesses will get clarity on which aspects of these laws will survive before they have to begin engineering changes for compliance.
