Strengthening Protections for Utah Minors on Social Media

Executive summary

This proposal recommends four targeted insertions into Utah’s Social Media Regulation Act (Title 13, Chapter 71, Utah Code) to close known gaps in the protection of Utah minors while reinforcing the statute’s defensibility under federal constitutional scrutiny. The proposed text is drawn from provisions in other state laws that have withstood challenge, and is structured around three principles affirmed by recent federal jurisprudence in cases brought by NetChoice and similar trade associations: narrow tailoring, opt-in verifiable parental consentaligned with the federal Children’s Online Privacy Protection Act (COPPA), and a scope limited to known Utah minor account holders.

Each insertion below references the existing statutory framework so that adoption requires no structural reorganization of the Chapter. The amendments are designed to be additive, severable, and implementable through existing rulemaking authority delegated to the Division of Consumer Protection.

Statement of need

Title 13, Chapter 71 establishes the framework for protecting Utah minors who hold social media accounts, but the current statute does not directly address three of the most consequential commercial practices applied to minor users: the sale of their personal data, algorithmic targeted advertising, and the collection of precise geolocation information. Each of these practices has been the subject of federal enforcement actions, state attorney general investigations, and well-documented harms. Addressing them through narrowly drawn, consent-based restrictions strengthens the protective purpose of the Chapter without exposing it to the constitutional weaknesses identified by courts reviewing parallel statutes in other states.

Proposed amendments

1. Prohibition on selling minors’ personal data without consent

Add as new subsection (e) to § 13-71-202(2):

“(e) prohibit the sale of personal data collected from a Utah minor account holder unless the social media company has obtained verifiable parental consent in accordance with Section 13-71-203 for such sale; provided that the company shall not sell personal data if consent is withheld or revoked.”

This builds on existing restrictions, avoiding overbreadth while allowing revocation to reduce compelled-speech claims.

2. Prohibition on processing data for targeted advertising without consent

Add as new subsection (f) to § 13-71-202(2):

“(f) prohibit the processing of personal data collected from a Utah minor account holder for the purposes of targeted advertising unless the social media company has obtained verifiable parental consent in accordance with Section 13-71-203 specifically for such processing; provided that targeted advertising shall be disabled by default for Utah minor account holders.”

This targets commercial activity for potential intermediate scrutiny, with default disable as the least restrictive means.

3. Requirement for verifiable parental consent

Add as new subsection (4) to § 13-71-203:

“(4) A social media company shall obtain verifiable parental consent before engaging in any activity prohibited without consent under Section 13-71-202(2)(e) or (f), including the sale of personal data or processing for targeted advertising. The consent shall be specific to the activity, revocable at any time, and obtained through methods approved by the division that comply with the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. Sec. 6501 et seq.”

This expands the existing framework seamlessly, avoiding preemption and vagueness.

4. Restriction on collecting precise geolocation data

Add as new subsection (g) to § 13-71-202(2):

“(g) prohibit the collection of precise geolocation data from a Utah minor account holder unless: (i) such data is reasonably necessary to provide the core social media service; (ii) the collection is limited to the time and scope necessary; and (iii) the social media company has obtained verifiable parental consent in accordance with Section 13-71-203 and provides clear notice to the minor that such data is being collected.”

This includes necessity exceptions and notice for narrow tailoring.

Defensibility analysis

Each insertion has been drafted with reference to the litigation history of comparable state statutes. The consent-based, opt-in structure mirrors COPPA at the federal level, which substantially reduces preemption risk and aligns the state framework with a federal scheme courts have repeatedly upheld. The default-off treatment of targeted advertising, the revocability of consent, and the explicit limitation to known Utah minor account holdersdirectly address the narrow-tailoring, vagueness, and extraterritoriality concerns that have driven preliminary injunctions against broader statutes in other jurisdictions. The delegation of consent-method approval to the Division of Consumer Protection ensures that compliance mechanisms can evolve as COPPA guidance and FTC enforcement priorities change, without requiring legislative reopening of the Chapter.

Implementation and next steps

These amendments are offered for review by Utah legislators, legislative counsel, the Division of Consumer Protection, the Office of the Attorney General, and stakeholder organizations focused on child online safety. Defend Utah welcomes a formal working session with sponsors and policy staff to refine the statutory language, harmonize definitions with existing Chapter 71 terms, and confirm fiscal-note implications prior to introduction. Comments and proposed refinements may be directed to DefendUT.com@gmail.com.

This proposal is offered for legislative and policy consideration. It is not legal advice and does not constitute the official position of any state office or legislator.