This spring, Utah legislators gave parents new legal tools to control use of social media by children and teens, including introducing a private right of action with statutory damages.To comply, social media companies will need to fundamentally redesign their systems by March 1, 2024, unless they fit within one of the laws’ exceptions.Tech-savvy kids will surely attempt to defeat or work around the new restrictions.

Utah Governor Spencer Cox signed into law two sweeping bills designed to restrict minors’ usage of social media in Utah on March 23, 2023. Senate Bill 1521 and House Bill 3112 are the first laws of their kind in the United States. The Utah Social Media Regulation Act, SB 152, requires certain social media companies to, among other things, verify the age of all current and future users, limit the hours of access for minors, and obtain parental or guardian consent when users under the age of 18 seek to open an account or use an existing account on their platforms. Failures can expose companies to regulatory enforcement and lawsuits by users seeking statutory damages. Concurrently, Utah HB 311 prohibits social media companies from using any practice, design, or feature on the company's social media platform that causes a Utah minor account holder to have an addiction to the social media platform.3 Following Utah’s enactment of its new laws, Arkansas followed suit with its Social Media Safety Act, signed by Arkansas’ governor on April 11, 2023, which also requires age verification of social media users, requires parental consent for use by minors, and enables a private right of action with statutory damages.4

Background

Lawmakers have long sought to protect children online. Since the passage of the Children’s Online Privacy Protection Act (“COPPA”) in 1998, the Federal Trade Commission (“FTC”) and state attorneys general have brought multimillion dollar actions against the likes of Google and YouTube5 for illegally collecting personal information from children without their parents’ consent. Most recently, the FTC finalized an order requiring Epic Games, the maker of the video game Fortnite6 (which has been popular among teens and preteens), to pay $245 million for tricking players into making unwanted purchases by using “dark patterns.” The FTC alleged in the case that Epic’s confusing and counterintuitive design made it easy for children to make one-click, in-game purchases without requiring any parental consent.

Nevertheless, the new Utah bills are the first state laws aimed at specifically regulating minors’ access to social media platforms (although they conceptually overlap somewhat with California’s Age-Appropriate Design Code). Utah lawmakers say that the bills are required to combat the negative effects of social media on youth mental health.7 To comply, social media companies will likely need to make sweeping changes to the operations of, access to, and advertising on their respective platforms if they seek to remain operational within the state. 

Scope

Utah SB 152 and HB 311 apply to “Social Media Companies,” which are defined as a person or entity that:

  1. provides a social media platform that has at least 5,000,000 account holders worldwide; and
  2. is an interactive computer service.8

A “Social Media Platform” under the new law is defined as an online forum that a Social Media Company makes available for an account holder to:

  1. create a profile;
  2. upload posts;
  3. view the posts of other account holders; and
  4. interact with other account holders or users.9

Certain online services, websites, and applications such as email providers, e-commerce, and streaming services, among others, that meet defined exceptions are excluded from the bills.10 Even if initially excluded, companies will want to regularly re-evaluate whether they are within scope if minor users begin to use their platforms for new purposes.

Requirements

To comply with SB 152 and HB 311, which can be enforced on March 1, 2024, Social Media Companies will be required to:

  • Verify the age of all existing or new Utah social media account holders using a government-issued ID card and, if the existing or new account holder is a minor, confirm that the minor has consent of a parent or guardian;
  • Grant parents or guardians access to view all posts made and messages sent to and from their child’s social media account;
  • Hide minors’ accounts from public search results and only allow minors to receive messages from accounts with which they are linked “through friending”;11
  • Prohibit the display of advertising as well as “targeted or suggested groups, services, products, posts, accounts, or users”12 in the minor’s account;
  • Stop collecting or using any personal information from the posts, content, messages, text, or usage activities of the minor’s account other than information that is necessary to comply with, state or federal law (such as birth date and the parent or guardian's name);
  • Prohibit minors from accessing their social media account during the hours of 10:30 p.m. to 6:30 a.m., unless granted by a parent or guardian;
  • Permit parents and guardians to limit the number of hours per day the minor may use the account; and
  • Discontinue the use of any practice, design, or feature that the social media company knows, or should reasonably know, causes Utah minor account holders to have an addiction to the social media platform.

The Utah Division of Consumer Protection is tasked with drafting rules on age verification, identification, parental consent, and other aspects of the new law.

Penalties

SB 152 contains a private right of action through which a Utah resident may file suit against a Social Media Company for violations as of March 1, 2024. If a court finds that a violation has occurred, plaintiffs may receive:

  1. an award of reasonable attorney fees and court costs; and
  2. an amount equal to the greater of $2,500 per each incident of violation; or if the court determines that the harm is a direct consequence of the violation actual damages for financial, physical, and emotional harm incurred by the person bringing the action.

HB 311 provides for additional civil penalties of:

  1. $250,000 for each practice, design, or feature shown to have caused social media addiction in minors; and
  2. $2,500 for each Utah minor account holder who is shown to have been exposed to the practice, design, or feature found to have caused the addiction or actual damages, whichever is greater. For Utah minors under the age of 16 seeking recovery of damages, the law introduces a rebuttable presumption that the alleged harm occurred and that the harm was caused “as a consequence of using or having an account on the social media company’s social media platform.”

The Utah Division of Consumer Protection will also enforce the new laws and may impose administrative fines of $2,500 per violation or bring cases in Utah courts against companies that violate the new laws.

With the technological development burdens of the new legal requirements, the loss of advertising revenue based on use by minors, and the potential statutory damage exposure, some social media companies may decide to ban use by those under 18 in Utah. However, even if they do so, they will still need to verify user age and will need to wait for regulations from the Utah Division of Consumer Protection on how to do so.