Utah's Minor Protection in Social Media Act: Age Assurance, Default Settings and the NetChoice Injunction

The 2023 Acts and Their Repeal

Utah's first attempt came in the 2023 General Session. SB 152, Social Media Regulation Amendments, and HB 311, Social Media Usage Amendments, were both signed on March 23, 2023 and took effect May 3, 2023, as chapters 498 and 477 of that session. Together they built the Utah Social Media Regulation Act at chapter 63 of Title 13.

That act never operated as written. According to the September 2024 memorandum decision in the case that followed, NetChoice and a separate group of plaintiffs led by Hannah Paisley Zoulek sued over the 2023 law in December 2023 and January 2024, the court stayed both cases while the 2024 Legislature met, and the Legislature then repealed the 2023 law and partially replaced it. The repeal is in the enrolled text of HB 464, which lists sections 13-63-101 through 13-63-701 under its repealer, effective May 1, 2024.

Two 2024 bills replaced it. SB 194, Social Media Regulation Amendments, sponsored by Senator Michael K. McKell with Representative Jordan D. Teuscher, passed the Senate 21 to 1, passed the House as a second substitute 61 to 11, won Senate concurrence 26 to 0, and was signed March 13, 2024. Its enrolled text enacted chapter 71 effective October 1, 2024. HB 464, Social Media Amendments, sponsored by Representative Teuscher with Senator Kirk A. Cullimore, passed the House 68 to 3 and the Senate 24 to 0, and the House concurred 63 to 6; it was signed the same day. A coordination clause in SB 194 aligned HB 464's definitions with chapter 71.

Age Assurance Under the 2024 Act

Chapter 71's coverage rests on its definitions in section 13-71-101. A social media service is a public website or application that displays content primarily generated by account holders rather than the company, lets an individual register and create a profile visible to the public or a chosen set of users, connects account holders so they can interact socially, gives each a list of connections, and lets account holders post content others can see. Email, cloud storage, and document viewing, sharing or collaboration services are excluded. A minor is an individual under 18 who has not been emancipated or married, and a Utah account holder is an account holder who is a Utah resident.

Section 13-71-201 requires a social media company to implement an age assurance system to determine whether a current or prospective Utah account holder is a minor. The definition sets the bar: measures reasonably calculated to identify minors "with an accuracy rate of at least 95%." An account holder the system identifies as a minor becomes subject to sections 13-71-202 and 13-71-203. The company provides an appeal process in which an account holder submits documentary evidence of age range, and decides within 30 days. Personal information gathered within the age assurance system is segregated and may be used only for the six purposes listed in section 13-71-204(4).

Section 13-71-302 directs the Division of Consumer Protection to make rules establishing processes by which a company may assure age and obtain verifiable parental consent, and criteria for judging whether an age assurance system is 95% accurate. A company whose system complies with those rules is not subject to enforcement under section 13-71-201, and consent obtained through a compliant mechanism counts as verifiable parental consent.

Default Privacy Settings for Minor Accounts

Section 13-71-202 lists what a social media company does for every Utah minor account holder. The defaults are set to "prioritize maximum privacy," and the section spells them out:

• Account visibility limited to connected accounts, which the chapter defines as accounts directly connected to the minor or one step removed from a direct connection
• Sharing of content limited to connected accounts, and direct messaging limited to connected accounts
• Data collection and sale restricted to what is required for the core functioning of the service
• Search engine indexing of minor profiles disabled
• A downloadable file with all information associated with the account

The same section requires reasonable security measures, including encryption, for minors' personal information; a notice describing what is collected and how it may be used or disclosed; and, on the minor's request, deletion of personal information and removal of material the minor made public, subject to retention required by section 13-61-203 or other law. Subsection (5) requires disabling three engagement features for minor accounts: autoplay that plays content continuously without user interaction, scroll or pagination that loads more content for as long as the user scrolls, and push notifications prompting repeated engagement.

Parental Consent and Supervisory Tools

The chapter's parental role is narrower than its title might suggest. Section 13-71-204 bars a company from letting a Utah minor change a default privacy setting without first obtaining verifiable parental consent, which the definitions describe as advance notice to the parent of the service's information practices followed by confirmation that the parent received it. The section also presumes that a company's terms of service for a minor include an assurance of confidentiality for the minor's personal information. Verifiable parental consent overcomes the presumption, and it does not apply to uses necessary to run or analyze the service, enable network communications, personalize by age and location, display a chosen username, obtain age assurance information, or comply with law.

Section 13-71-203 takes a different approach to oversight. The company offers supervisory tools that the minor account holder may decide to activate, and that let an individual the minor selects set daily time limits across devices, schedule mandatory breaks, view total and average daily time, connected accounts, blocked accounts and privacy, content sensitivity and messaging settings, and receive a notification when the minor changes one of those settings. The statute does not require that the selected individual be a parent.

The Private Right of Action

Chapter 71 creates no private claim. Section 13-71-301 assigns enforcement of part 2 to the Division: administrative fines of up to $2,500 per violation, court actions for declaratory relief, injunctions, disgorgement, civil penalties of up to $2,500 per violation and actual damages to an injured consumer, and penalties of up to $5,000 per violation of an administrative or court order. The Attorney General acts as the Division's counsel. The codified history notes record a 2026 amendment to the section, chapter 95 of that year's General Session.

The private action came from HB 464 and sits in a different title, Utah Code §§ 78B-3-1101 through 1106, effective October 1, 2024. Section 78B-3-1103 lets a Utah minor account holder or parent sue a social media company for an adverse mental health outcome arising in whole or part from the minor's excessive use of an algorithmically curated social media service. Section 78B-3-1101 defines an adverse mental health outcome as a condition diagnosable by a licensed provider, including depression, anxiety, suicidal thoughts or behaviors and self-harm, and defines excessive use as use that substantially interferes with the minor's academics, sleep, in-person relationships, mental health or physical health.

• A plaintiff gets a rebuttable presumption that the outcome was caused by excessive use, and that the excessive use was caused by the service's curation algorithm and engagement-driven design
• A plaintiff who proves an adverse outcome recovers attorney fees and the greater of $10,000 per adverse mental health outcome incidence or actual damages
• No liability rests on the content of user posts or on declining to restrict or modify posts based solely on their content
• Section 78B-3-1104 shifts the presumption to the company if it limits a minor to three hours in 24 hours across devices, blocks access from 10:30 p.m. to 6:30 a.m., requires parental consent to use the service, and disables engagement-driven design elements
• Section 78B-3-1105 voids any waiver of these rights, notwithstanding a contract or choice-of-law provision

As codified on le.utah.gov, section 78B-3-1103(4) cross-references "Section 78B-11-1104" and section 78B-3-1104 refers to "Subsection 78B-11-1103(3)," citations that do not match the part's own section numbers.

NetChoice v. Reyes and the Act's Current Status

After the 2024 session, NetChoice, a trade association whose members include Google, Meta, Snap, Pinterest, Nextdoor, X and Dreamwidth, amended its complaint to challenge chapter 71 in NetChoice, LLC v. Reyes, No. 2:23-cv-00911 (D. Utah), against the Attorney General and the Division director. On July 22, 2024, Chief Judge Robert J. Shelby dismissed NetChoice's Section 230 count, holding that Section 230 does not preempt the chapter's prohibitions on autoplay, seamless pagination and notifications for minors' accounts.

On September 10, 2024, three weeks before the effective date, the court granted NetChoice's motion for a preliminary injunction. The memorandum decision held that the definition of social media service, by singling out services that let users "interact socially," draws content-based distinctions, so strict scrutiny applies. It found the State had not shown that existing parental controls were inadequate, so the Act was not shown to be the least restrictive means; that the Act was likely underinclusive because minors could still spend unlimited time on social media and encounter the same features elsewhere; and that it was likely overinclusive because it reached services like Dreamwidth that do not market to minors or use the targeted features. The court noted the State conceded that every challenged provision except age assurance was subject to heightened scrutiny.

The order enjoins the defendants and those acting under them "from enforcing any part of the Utah Minor Protection in Social Media Act, Utah Code §§ 13-71-101 to 401, pending final disposition." The Zoulek plaintiffs' motion was denied for lack of standing and their First Amendment counts dismissed without prejudice. By its terms the injunction covers chapter 71; it does not address the HB 464 private action in Title 78B.

The State filed a notice of appeal on October 10, 2024, and on October 18 the district court stayed further proceedings pending the Tenth Circuit's decision in No. 24-4100. The appeal is now captioned NetChoice v. Brown after Derek E. Brown succeeded Sean Reyes as Attorney General. The appellate docket records argument on November 20, 2025 before Judges Holmes, Kelly and Moritz, followed by supplemental-authority letters; the latest, NetChoice's December 31, 2025 response, addressed the Eleventh Circuit's stay ruling on Florida's law. No Tenth Circuit decision appeared in the entries retrieved for this article, and the preliminary injunction remains the last operative ruling on chapter 71.

Frequently Asked Questions