Rep. Norm Thurston — Voting Record

Bill

Number

H.B. 418 (2025GS)

Sponsor

Rep. Fiefia, Doug

Final action

Governor Signed 3/27/2025

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• defines terms;
• establishes legislative findings about social media data control and competition;
• amends consumer data rights related to social media data;
• requires social media companies to implement data interoperability interfaces;
• establishes requirements for data sharing between social media services;
• grants rulemaking and enforcement authority to the Division of Consumer Protection;
• provides for civil penalties; and
• includes a severability provision.

Every vote on this bill

Bill text

44
13-2-1
13-61-201
13-75-101
13-75-102
13-75-201
13-75-202
13-75-301
13-75-302
13-75-401
13-2-1
13-61-201
13-75-101
13-75-102
13-75-201
13-75-202
13-75-301
13-75-302
13-75-401
0
Data Sharing Amendments
2025 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Doug Fiefia
Senate Sponsor: Michael K. McKell
Cosponsor:
Ariel Defay
Jason E. Thompson
Paul A. Cutler
Jordan D. Teuscher
LONG TITLE
General Description:
This bill enacts provisions related to social media data portability and interoperability.
Highlighted Provisions:
This bill:
defines terms;
establishes legislative findings about social media data control and competition;
amends consumer data rights related to social media data;
requires social media companies to implement data interoperability interfaces;
establishes requirements for data sharing between social media services;
grants rulemaking and enforcement authority to the Division of Consumer Protection;
provides for civil penalties; and
includes a severability provision.
Money Appropriated in this Bill:
None
Other Special Clauses:
This bill provides a special effective date.
Utah Code Sections Affected:
AMENDS:
13-2-1
, 
Effective 
07/01/26
 as last amended by Laws of Utah 2024, Chapter 132
13-61-201
, 
Effective 
07/01/26
 as enacted by Laws of Utah 2022, Chapter 462
ENACTS:
13-75-101
, 
Effective 
07/01/26
 Utah Code Annotated 1953
13-75-102
, 
Effective 
07/01/26
 Utah Code Annotated 1953
13-75-201
, 
Effective 
07/01/26
 Utah Code Annotated 1953
13-75-202
, 
Effective 
07/01/26
 Utah Code Annotated 1953
13-75-301
, 
Effective 
05/07/25
 Utah Code Annotated 1953
13-75-302
, 
Effective 
07/01/26
 Utah Code Annotated 1953
13-75-401
, 
Effective 
07/01/26
 Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1, Section 
13-2-1
 is amended to read:
13-2-1
Effective 
07/01/26
. Consumer protection division established -- 
Functions.
(1)
There is established within the Department of Commerce the Division of Consumer 
Protection.
(2)
The division shall administer and enforce the following:
(a)
Chapter 10a, Music Licensing Practices Act;
(b)
Chapter 11, Utah Consumer Sales Practices Act;
(c)
Chapter 15, Business Opportunity Disclosure Act;
(d)
Chapter 20, New Motor Vehicle Warranties Act;
(e)
Chapter 21, Credit Services Organizations Act;
(f)
Chapter 22, Charitable Solicitations Act;
(g)
Chapter 23, Health Spa Services Protection Act;
(h)
Chapter 25a, Telephone and Facsimile Solicitation Act;
(i)
Chapter 26, Telephone Fraud Prevention Act;
(j)
Chapter 28, Prize Notices Regulation Act;
(k)
Chapter 32a, Pawnshop, Secondhand Merchandise, and Catalytic Converter 
Transaction Information Act;
(l)
Chapter 34, Utah Postsecondary School and State Authorization Act;
(m)
Chapter 41, Price Controls During Emergencies Act;
(n)
Chapter 42, Uniform Debt-Management Services Act;
(o)
Chapter 49, Immigration Consultants Registration Act;
(p)
Chapter 51, Transportation Network Company Registration Act;
(q)
Chapter 52, Residential Solar Energy Disclosure Act;
(r)
Chapter 53, Residential, Vocational and Life Skills Program Act;
(s)
Chapter 54, Ticket Website Sales Act;
(t)
Chapter 56, Ticket Transferability Act;
(u)
Chapter 57, Maintenance Funding Practices Act;
(v)
Chapter 61, Utah Consumer Privacy Act;
(w)
Chapter 63, Utah Social Media Regulation Act;
(x)
(w)
Chapter 64, Vehicle Value Protection Agreement Act;
(y)
(x)
Chapter 65, Utah Commercial Email Act;
(z)
(y)
Chapter 67, Online Dating Safety Act; 
(aa)
(z)
Chapter 68, Lawyer Referral Consultants Registration Act;
(bb)
(aa)
Chapter 70, Automatic Renewal Contracts Act;
 and
(cc)
(bb)
Chapter 71, Utah Minor Protection in Social Media Act
.
; and
(cc)
Chapter 75, Utah Digital Choice Act.
(3)
In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the 
division may make rules to establish:
(a)
a public list that identifies a person who:
(i)
violates a chapter described in Subsection (2);
(ii)
without proper legal justification, fails to comply with an order, subpoena, 
judgment, or other legal process issued by:
(A)
the division; or
(B)
a court of competent jurisdiction; or
(iii)
breaches a settlement agreement, stipulation, assurance of voluntary compliance, 
or similar instrument signed by the person and the division; and
(b)
a process by which a person may be removed from the list the division establishes as 
described in Subsection (3)(a).
Section 2, Section 
13-61-201
 is amended to read:
13-61-201
Effective 
07/01/26
. Consumer rights -- Access -- Deletion -- 
Portability -- Opt out of certain processing.
(1)
A consumer has the right to:
(a)
confirm whether a controller is processing the consumer's personal data; and
(b)
access the consumer's personal data.
(2)
A consumer has the right to delete the consumer's personal data that the consumer 
provided to the controller.
(3)
A consumer has the right to obtain a copy of the consumer's personal data, that the 
consumer previously provided to the controller, in a format that:
(a)
to the extent technically feasible, is portable;
(b)
to the extent practicable, is readily usable; and
(c)
allows the consumer to transmit the data to another controller without impediment, 
where the processing is carried out by automated means.
(4)
A consumer has the right to request that a controller correct inaccuracies in the 
consumer's personal data, taking into account the nature of the personal data and the 
purposes of the processing of the consumer's personal data.
(4)
(5)
A consumer has the right to opt out of the processing of the consumer's personal 
data for purposes of:
(a)
targeted advertising; or
(b)
the sale of personal data.
(5)
(6)
Nothing in this section requires a person to cause a breach of security system as 
defined in Section 
13-44-102
.
Section 3, Section 
13-75-101
 is enacted to read:
75. UTAH DIGITAL CHOICE ACT
1. General Provisions
13-75-101
Effective 
07/01/26
. Definitions.
As used in this chapter:
(1)
"Open protocol" means a publicly available technical standard that:
(a)
enables interoperability and data exchange between social media services by 
providing a common data infrastructure where multiple social media services can 
access, contribute to, and synchronize a user's personal data;
(b)
is free from:
(i)
licensing fees; and
(ii)
patent restrictions; and
(c)
governs how social media services communicate and exchange data with each other.
(2)
(a)
"Personal data" means the same as that term is defined in Section 
13-61-101
.
(b)
"Personal data" includes a user's social graph.
(3)
(a)
"Social graph" means data that represents a person's connections and interactions 
within a social media service.
(b)
"Social graph" includes:
(i)
the person's social connections with other users;
(ii)
content created by the person;
(iii)
the person's responses to other users' content, including comments, reactions, and 
shares;
(iv)
other users' responses to the person's content; and
(v)
metadata associated with the items described in Subsections (3)(b)(i) through (iv).
(c)
"Social graph" does not include another user's or an entity's content and responses 
that have been designated private by those users and entities, including private 
messages.
(4)
"Social media company" means an entity that owns or operates a social media service.
(5)
(a)
"Social media service" means a public website or application that:
(i)
displays content that is primarily generated by account holders and not by the 
social media company;
(ii)
permits an individual to register as an account holder and create a profile that is 
made visible to the general public or a set of other users defined by the account 
holder;
(iii)
connects account holders to allow users to interact socially with each other 
within the website or application; and
(iv)
allows account holders to post content viewable by other users.
(b)
"Social media service" does not include:
(i)
email;
(ii)
cloud storage; or
(iii)
document viewing, sharing, or collaboration services.
(6)
"User" means an individual located in the state who accesses or uses a social media 
service.
Section 4, Section 
13-75-102
 is enacted to read:
13-75-102
Effective 
07/01/26
. Legislative findings.
The Legislature finds that:
(1)
an individual has a right to control and move the individual's own personal data, 
including social interactions online;
(2)
companies have demonstrated a pattern of restricting the interoperability of content, 
preventing users from easily sharing posts and interactions across different platforms; 
and
(3)
the state should ensure that individuals have the right to access a complete personal data 
record from social media platforms.
Section 5, Section 
13-75-201
 is enacted to read:
2. Data Rights and Requirements
13-75-201
Effective 
07/01/26
. Data portability requirements.
If a consumer requests a copy of the consumer's personal data under Section 
13-61-201
, 
a social media service shall provide the personal data, including the user's social graph, in a 
format that:
(1)
is portable, to the extent technically feasible;
(2)
is readily usable, to the extent practicable; and
(3)
allows the consumer to transmit the data to another controller without impediment if the 
controller processes the data by automated means.
Section 6, Section 
13-75-202
 is enacted to read:
13-75-202
Effective 
07/01/26
. Data interoperability requirements.
(1)
A social media company shall implement a transparent, third-party-accessible 
interoperability interface or interfaces to allow users to choose to:
(a)
share a common set of the user's personal data between the social media services 
designated by the user; and
(b)
enable third parties to access content created by the user and to be notified when new 
or updated content is available, with the user's permission.
(2)
A social media company shall reasonably secure all personal data obtained through an 
interoperability interface.
(3)
To achieve interoperability under Subsection (1), a social media company shall:
(a)
utilize an open protocol;
(b)
facilitate and maintain interoperability and synchronous data sharing with other 
social media services through an interoperability interface, based on reasonable terms 
that do not discriminate between social media services;
(c)
establish reasonable and proportionate thresholds related to the frequency, nature, 
and volume of requests, beyond which the social media company may assess a 
reasonable fee for such access;
(d)
offer to other social media companies a functionally equivalent version of any 
internal interfaces created by the social media company for the social media 
company's own social media services; and
(e)
disclose to other social media companies complete, accurate, and regularly updated 
documentation describing access to the interoperability interface required under this 
section.
(4)
A social media company or third party shall safeguard the privacy and security of a 
user's personal data obtained from other social media services through the 
interoperability interface in accordance with the social media company's or third party's 
privacy notice and administrative, technical, and physical data security practices.
(5)
A social media company or third party may not share or receive a user's personal data 
through the interoperability interface except with the user's consent.
(6)
A social media company shall adopt an accessible, prominent, and persistent method for 
users to give consent for data sharing with other social media services or third parties 
through the interoperability interface.
(7)
A social media company is not required to:
(a)
provide access to:
(i)
inferences, analyses, or derived data that the social media company has generated 
internally about a user; or
(ii)
proprietary algorithms, ranking systems, or other internal operating mechanisms; 
or
(b)
transmit personal data that:
(i)
is stored or structured in a proprietary format; and
(ii)
meets both of the following criteria:
(A)
no open, industry-standard format is reasonably available; and
(B)
transmitting the data would disclose information described in Subsection (7)(a).
(8)
This chapter does not apply to an entity that is:
(a)
owned, controlled, operated, or maintained by a religious organization; and
(b)
exempt from property taxation under state law.
Section 7, Section 
13-75-301
 is enacted to read:
3. Administrative Provisions
13-75-301
Effective 
05/07/25
. Rulemaking authority -- Rebuttable 
presumptions.
(1)
The division may identify open protocols that the division has determined, after an 
assessment, meet the requirements of Section 
13-75-202
.
(2)
If a social media company uses an open protocol that the division identifies under 
Subsection (1), the social media company shall be entitled to a rebuttable presumption of 
providing access on reasonable terms that do not discriminate between social media 
services.
Section 8, Section 
13-75-302
 is enacted to read:
13-75-302
Effective 
07/01/26
. Enforcement.
(1)
The division shall administer and enforce this chapter, within existing budget 
allocations, in accordance with Chapter 2, Division of Consumer Protection.
(2)
The attorney general, upon request, shall give legal advice to, and act as counsel for, the 
division in the exercise of the division's responsibilities under this chapter.
(3)
(a)
In addition to the division's enforcement powers under Chapter 2, Division of 
Consumer Protection:
(i)
the division director may impose an administrative fine of up to $2,500 for each 
violation of this chapter; and
(ii)
the division may bring an action in court to enforce a provision of this chapter.
(b)
In a court action by the division to enforce a provision of this chapter, the court may:
(i)
declare that the act or practice violates a provision of this chapter;
(ii)
enjoin actions that violate this chapter;
(iii)
order disgorgement of any money received in violation of this chapter;
(iv)
order payment of disgorged money to an injured purchaser or consumer;
(v)
 impose a civil penalty of up to $2,500 for each violation of this chapter;
(vi)
award actual damages to an injured purchaser or consumer; and
(vii)
award any other relief that the court deems reasonable and necessary.
(c)
If a court grants judgment or injunctive relief to the division, the court shall award 
the division:
(i)
reasonable attorney fees;
(ii)
court costs; and
(iii)
investigative fees.
(d)
(i)
A person who violates an administrative or court order issued for a violation of 
this chapter is subject to a civil penalty of no more than $5,000 for each violation.
(ii)
A civil penalty authorized under this section may be imposed in any civil action 
brought by the division, or by the attorney general on behalf of the division.
Section 9, Section 
13-75-401
 is enacted to read:
4. Special Provisions
13-75-401
Effective 
07/01/26
. Severability.
(1)
If any provision of this chapter or the application of any provision to any person or 
circumstance is held invalid by a final decision of a court of competent jurisdiction, the 
remainder of this chapter shall be given effect without the invalid provision or 
application.
(2)
The provisions of this chapter are severable.
Section 10. 
Effective Date.
(1)
Except as provided in Subsection (2), this bill takes effect July 1, 2026.
(2)
The actions affecting Section 
13-75-301
 (Effective 05/07/25) take effect on May 7, 
2025.
3-11-25 3:29 PM