Section 1. Section 13-2-1 is amended to read:13-2-1Effective 07/01/26Effective 01/01/27. Consumer protection division established -- Functions.(1)There is established within the Department of Commerce the Division of Consumer Protection.(2)The division shall administer and enforce the following:(a)Chapter 10a, Music Licensing Practices Act;(b)Chapter 11, Utah Consumer Sales Practices Act;(c)Chapter 15, Business Opportunity Disclosure Act;(d)Chapter 20, New Motor Vehicle Warranties Act;(e)Chapter 21, Credit Services Organizations Act;(f)Chapter 22, Charitable Solicitations Act;(g)Chapter 23, Health Spa Services Protection Act;(h)Chapter 25a, Telephone and Facsimile Solicitation Act;(i)Chapter 26, Telephone Fraud Prevention Act;(j)Chapter 28, Prize Notices Regulation Act;(k)Chapter 32a, Pawnshop, Secondhand Merchandise, and Catalytic Converter Transaction Information Act;(l)Chapter 34, Utah Postsecondary School and State Authorization Act;(m)Chapter 41, Price Controls During Emergencies Act;(n)Chapter 42, Uniform Debt-Management Services Act;(o)Chapter 49, Immigration Consultants Registration Act;(p)Chapter 51, Transportation Network Company Registration Act;(q)Chapter 52, Residential Solar Energy Consumer Protection Act;(r)Chapter 53, Residential, Vocational orand Life Skills Program Act;(s)Chapter 54, Ticket Website Sales Act;(t)Chapter 56, Ticket Transferability Act;(u)Chapter 57, Maintenance Funding Practices Act;(v)Chapter 61, Utah Consumer Privacy Act;(w)Chapter 64, Vehicle Value Protection Agreement Act;(x)Chapter 65, Utah Commercial Email Act;(y)Chapter 67, Online Dating Safety Act; (z)Chapter 68, Lawyer Referral Consultants Registration Act;(aa)Chapter 70, Automatic Renewal Contracts Act;(bb)Chapter 71, Utah Minor Protection in Social Media Act;(cc)Chapter 72a, Artificial Intelligence Applications Relating to Mental Health;(dd)Chapter 72c, Digital Content Provenance Standards Act;(dd)(ee)Chapter 78, Earned Wage Access Services Act; and(ee)(ff)Chapter 81, Utah Digital Choice Act.(3)In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the division may make rules to establish:(a)a public list that identifies a person that:(i)violates a chapter described in Subsection (2);(ii)without proper legal justification, fails to comply with an order, subpoena, judgment, or other legal process issued by:(A)the division; or(B)a court of competent jurisdiction; or(iii)breaches a settlement agreement, stipulation, assurance of voluntary compliance, or similar instrument signed by the person and the division; and(b)a process by which a person may be removed from the list the division establishes as described in Subsection (3)(a).

Section 2. Section 13-72b-101 is enacted to read:72b. Digital Voyeurism Prevention Act 1. General Provisions13-72b-101Effective 01/01/27. Definitions.As used in this chapter:(1)"Artificial intelligence technology" means the same as that term is defined in Section 13-72-101.(2)"Consent" means express permission, freely and voluntarily given by an identifiable individual, with full knowledge of the nature and purpose of the generation of an intimate image depicting the individual, where the consent:(a)is specific to the particular intimate image being generated;(b)is obtained before the generation of the intimate image; and(c)may be revoked at any time.(3)"Counterfeit intimate image" means a "digital forgery" as that term is defined in the Take It Down Act.(4)"Covered platform" means the same as that term is defined in Section 3 of the Take It Down Act, Public Law 119-12, 139 Stat. 59, codified at 47 U.S.C. 230 note.(5)(a)"Distribute" means to sell, exhibit, display, publish, provide, give, provide access to, or otherwise transfer a counterfeit intimate image, with or without consideration.(b)"Distribute" includes the generation of a counterfeit intimate image by a generation service and the subsequent provision of that counterfeit intimate image to the user.(6)"Generate" means to create, produce, compose, materially edit, or facilitate the creation of an intimate image through the use of artificial intelligence technology.(7)"Generation service" means a person that operates, maintains, or provides an interactive computer service that:(a)enables users to generate intimate images;(b)processes user image generation requests through servers, computer systems, or computing resources controlled by the service operator rather than solely on the user's local device; and(c)distributes generated intimate images to users through the service.(8)"Identifiable individual" means an individual who is recognizable as an actual human individual by the human individual's face, likeness, or other distinguishing characteristic, including a unique physical feature or other recognizable attribute.(9)"Interactive computer service" means the same as that term is defined in 47 U.S.C. Sec. 230(f)(2).(10)"Intimate image" means an "intimate visual depiction" as those terms are defined in the Take It Down Act.(11)"Reasonable expectation of privacy" means an individual's expectation that:(a)the individual's body will not be viewed, recorded, or depicted in an intimate image without the individual's knowledge and consent; and(b)an intimate image of the individual will not be generated, created, distributed, or manipulated without the individual's knowledge and consent.(12)"Sexually explicit conduct" means the same as that term is defined in 18 U.S.C. Sec. 2256(2)(A).(13)"Take It Down Act" means the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act, Public Law 119-12, codified at 47 U.S.C. Sec. 230 note.

Section 3. Section 13-72b-201 is enacted to read:2. Generation Services13-72b-201Effective 01/01/27. Unlawful distribution of non-consensual counterfeit intimate images.(1)The distribution of a counterfeit intimate image by a generation service without the consent of the identifiable individual depicted in the image is a violation of the individual's reasonable expectation of privacy.(2)A generation service may not distribute a counterfeit intimate image without first obtaining consent from the identifiable individual depicted in the counterfeit intimate image.(3)To obtain consent sufficient to meet the requirements of Subsection (2), a generation service shall implement and maintain a consent system that:(a)requires the identifiable individual depicted in the counterfeit intimate image to affirmatively provide consent before the counterfeit intimate image is distributed;(b)assures the identity of the individual providing consent with reasonable accuracy; and(c)maintains a record of the consent for a period of not less than seven years.(4)A generation service may not require an individual to disclose personally identifiable information beyond what is reasonably necessary to assure the individual's identity and obtain valid consent.

Section 4. Section 13-72b-202 is enacted to read:13-72b-202Effective 01/01/27. Civil liability for generation services.(1)A person, or the heirs of a deceased person, who has been injured by a violation recognized in Section 13-72b-201 may bring a civil action against the generation service that committed the violation.(2)If in an action described in Subsection (1) the court finds the defendant is violating or has violated any provision of Section 13-72b-201, the court shall:(a)enjoin the defendant from continuing the violation; and(b)order the defendant to remove or destroy any counterfeit intimate image distributed in violation of Section 13-72b-201 and all copies of the counterfeit intimate image within the defendant's possession or control.(3)It is not necessary that actual damages to the plaintiff be alleged or proved in an action under this section.(4)A plaintiff in an action under this section is entitled to recover:(a)actual damages sustained, if any, including damages for emotional distress;(b)punitive damages, if the violation is found to be willful, reckless, or malicious; and(c)reasonable attorney fees and costs.(5)Each distribution of a counterfeit intimate image depicting an identifiable individual without consent constitutes a separate violation.(6)The statute of limitations for a civil action under this section is the later of:(a)three years from the date the plaintiff discovered or reasonably should have discovered the violation; or(b)10 years from the date of the violation.

Section 5. Section 13-72b-203 is enacted to read:13-72b-203Effective 01/01/27. Safe harbor for generation services.(1)A generation service is not liable under Section 13-72b-202 if the generation service demonstrates that:(a)the generation service does not hold itself out as providing services for creating counterfeit intimate images;(b)the generation service has implemented and maintains a written policy that:(i)prohibits the generation and distribution of non-consensual counterfeit intimate images;(ii)includes reasonable safeguards designed to prevent the creation of counterfeit intimate images; and(iii)includes procedures for responding to reports of violations;(c)the generation service acted in accordance with the policy described in Subsection (1)(b) with respect to the alleged violation;(d)the generation service published the policy described in Subsection (1)(b) in a clear and conspicuous location accessible to the public on the generation service's website or primary user interface;(e)the generation service published a general description of the reasonable safeguards described in Subsection (1)(b)(ii), which may describe technical measures in general terms without disclosing proprietary implementation details that could be exploited to circumvent the safeguards;(f)the generation service implemented and maintained a consent system that complies with Subsection 13-72b-201(3); and(g)upon receiving notice that a counterfeit intimate image was created or distributed without consent, the generation service took prompt action to prevent further distribution.(2)A generation service qualifies for the safe harbor under Subsection (1) even if a non-consensual counterfeit intimate image was distributed through the service if the generation service demonstrates that:(a)the generation service had no actual knowledge that the image was created or distributed without consent before receiving notice;(b)the generation service's consent system was operating as designed;(c)the generation service reasonably relied on information provided through the consent system; and(d)upon discovering the violation, the generation service took prompt action to prevent further distribution.(3)A generation service that has implemented and maintains a written policy and reasonable technical safeguards that categorically prevent the generation of intimate images by the service is not required to comply with the consent requirements in Subsections (1)(b), (1)(c), (1)(e), (1)(f), (2)(b), and (2)(c) to qualify for safe harbor protection under this section.(4)In determining whether a generation service qualifies for safe harbor protection under this section, the court shall, among other relevant factors, consider whether the generation service's safeguards and policies:(a)are consistent with widely accepted industry standards;(b)are regularly updated to address emerging technologies and methods for creating counterfeit intimate images;(c)include technical measures to detect and prevent the generation of counterfeit intimate images; and(d)include reasonable measures to ensure that users are not attempting to circumvent the safeguards.(5)A generation service may assert the safe harbor protections under this section by motion before trial and is not required to proceed to trial to establish eligibility for the safe harbor.

Section 6. Section 13-72b-204 is enacted to read:13-72b-204Effective 01/01/27. Heightened pleading standard for actions against generation services.(1)In any action brought under Section 13-72b-202 against a generation service, the complaint shall plead with particularity facts establishing that the generation service does not qualify for safe harbor protection under Section 13-72b-203.(2)To meet the pleading requirements of Subsection (1), the plaintiff shall include specific factual allegations, including dates, communications, and other evidence, demonstrating that the generation service does not qualify for safe harbor protection under Section 13-72b-203, including facts showing one or more of the following:(a)that the generation service holds itself out as providing services for creating counterfeit intimate images;(b)that the generation service failed to implement a written policy that:(i)prohibits the generation and distribution of non-consensual counterfeit intimate images;(ii)includes reasonable safeguards designed to prevent the creation of counterfeit intimate images; and(iii)includes procedures for responding to reports of violations;(c)that the generation service distributed a counterfeit intimate image depicting the plaintiff without requesting or obtaining the plaintiff's consent;(d)that the generation service had actual knowledge that a counterfeit intimate image was created or distributed without consent and failed to take prompt action to prevent further distribution; or(e)that the generation service intentionally designed the service to facilitate the creation of non-consensual counterfeit intimate images.(3)General or conclusory allegations that a generation service violated this part are insufficient to state a claim.(4)If a complaint fails to meet the pleading requirements of this section, the court shall dismiss the action without prejudice.(5)A generation service may bring a motion to dismiss under this section before filing an answer or other responsive pleading.(6)If the court grants a motion to dismiss under this section and the plaintiff files an amended complaint that again fails to meet the pleading requirements of this section, the court shall:(a)dismiss the action with prejudice; and(b)award the generation service reasonable attorney fees and costs incurred in bringing the motion to dismiss the amended complaint.

Section 7. Section 13-72b-205 is enacted to read:13-72b-205Effective 01/01/27. Transparency and reporting requirements.(1)A generation service shall take reasonable measures to inform users that:(a)distribution of non-consensual counterfeit intimate images is prohibited;(b)violations of this part may result in civil liability; and(c)the service provides procedures for reporting violations.(2)A generation service shall clearly and conspicuously provide to users procedures for reporting violations to the generation service.(3)A generation service shall publish in a clear and conspicuous location on the generation service's website or primary user interface:(a)the written policy required by Subsection 13-72b-203(1)(b); and(b)a general description of the safeguards implemented to prevent the generation of non-consensual counterfeit intimate images, which may describe technical measures in general terms without disclosing proprietary implementation details that could be exploited to circumvent the safeguards.

Section 8. Section 13-72b-301 is enacted to read:3. Covered Platforms13-72b-301Effective 01/01/27. Unlawful distribution of non-consensual counterfeit intimate images on platforms.(1)A covered platform may not knowingly allow the distribution of a counterfeit intimate image without consent from the identifiable individual depicted in the counterfeit intimate image.(2)A covered platform knowingly allows the distribution of a counterfeit intimate image without consent if the covered platform:(a)receives notice under Section 13-72b-302 that a counterfeit intimate image has been distributed without consent; and(b)fails to comply with the takedown requirements in Section 13-72b-302.

Section 9. Section 13-72b-302 is enacted to read:13-72b-302Effective 01/01/27. Duty to remove -- Notice and takedown requirements.(1)A covered platform shall establish and implement notice and removal procedures that comply with the requirements established in Section 3(a) of the Take It Down Act.(2)The requirements described in Subsection (1) include:(a)establishing a mechanism for an individual depicted in a counterfeit intimate image to notify the covered platform that the image has been published on the covered platform without the individual's consent;(b)providing clear and conspicuous notice of the mechanism described in Subsection (2)(a);(c)upon receiving notice that meets the requirements established in the Take It Down Act, removing the reported counterfeit intimate image within 48 hours after receiving the notice; and(d)making reasonable efforts to identify and remove any identical copy of the counterfeit intimate image.(3)A covered platform that complies in good faith with the notice and takedown procedures required by this section is not liable under this chapter for actions taken in accordance with this section before receiving notice.

Section 10. Section 13-72b-303 is enacted to read:13-72b-303Effective 01/01/27. Civil liability for covered platforms.(1)A person, or the heirs of a deceased person, who has been injured by a violation of Section 13-72b-301 may bring a civil action against the covered platform that committed the violation.(2)If in an action described in Subsection (1) the court finds the defendant is violating or has violated any provision of Section 13-72b-301, the court shall:(a)enjoin the defendant from continued violation; and(b)order the defendant to remove or destroy any counterfeit intimate image distributed in violation of Section 13-72b-301 and all copies of the counterfeit intimate image within the defendant's possession or control.(3)It is not necessary that actual damages to the plaintiff be alleged or proved in an action under this section.(4)A plaintiff in an action under this section is entitled to recover:(a)actual damages sustained, if any, including damages for emotional distress;(b)punitive damages, if the violation is found to be willful, reckless, or malicious; and(c)reasonable attorney fees and costs.(5)Each failure to comply with the notice and takedown requirements established in Section 13-72b-302 after receiving notice of a counterfeit intimate image constitutes a separate violation of this chapter.(6)The statute of limitations for a civil action under this section is the later of:(a)three years from the date the plaintiff discovered or reasonably should have discovered the violation; or(b)10 years from the date of the violation.

Section 11. Section 13-72b-304 is enacted to read:13-72b-304Effective 01/01/27. Safe harbor for covered platforms.(1)A covered platform is not liable under Section 13-72b-303 if the covered platform demonstrates that:(a)the covered platform implemented and maintained notice and removal procedures that comply with Section 13-72b-302; and(b)the covered platform acted in good faith in responding to notices of non-consensual counterfeit intimate images.(2)A covered platform qualifies for safe harbor protection under this section even if a non-consensual counterfeit intimate image appeared on the platform if the covered platform demonstrates that:(a)the covered platform had no actual knowledge of the image before receiving notice under Section 13-72b-302; and(b)upon receiving notice, the covered platform complied with the takedown requirements in Section 13-72b-302.(3)In determining whether a covered platform acted in good faith in responding to a notice of a non-consensual counterfeit intimate image, the court shall consider:(a)the size and resources of the covered platform;(b)the volume of content distributed on the platform;(c)the effectiveness of the platform's proactive measures; and(d)whether the platform's measures are consistent with widely accepted industry standards.(4)A covered platform may establish the safe harbor protections under this section by motion to dismiss or motion for summary judgment.(5)If a court determines that a covered platform has established safe harbor protection under this section on a motion to dismiss or motion for summary judgment, the court shall:(a)dismiss the action or grant summary judgment in favor of the covered platform; and(b)award the covered platform reasonable attorney fees and costs.

Section 12. Section 13-72b-305 is enacted to read:13-72b-305Effective 01/01/27. Heightened pleading standard for actions against covered platforms.(1)In any action brought under Section 13-72b-303 against a covered platform, the complaint shall plead with particularity facts establishing that the covered platform does not qualify for safe harbor protection under Section 13-72b-304.(2)To meet the pleading requirements of Subsection (1), the plaintiff shall include specific factual allegations demonstrating that the covered platform does not qualify for safe harbor protection under Section 13-72b-304, including facts showing one or more of the following:(a)that the covered platform failed to implement notice and removal procedures that comply with Section 13-72b-302;(b)that the covered platform failed to act in good faith in responding to notices of non-consensual counterfeit intimate images;(c)if the plaintiff provided notice under Section 13-72b-302:(i)the specific date and method by which notice was provided;(ii)the content of the notice provided;(iii)the covered platform's response or failure to respond; and(iv)facts establishing that the covered platform failed to comply with the takedown requirements in Section 13-72b-302; or(d)if the plaintiff did not provide notice under Section 13-72b-302:(i)facts establishing that the covered platform had actual knowledge of the non-consensual counterfeit intimate image before the plaintiff provided notice; and(ii)facts establishing that the covered platform failed to take reasonable steps to remove the image within 48 hours after obtaining actual knowledge.(3)General or conclusory allegations that a covered platform violated this part are insufficient to state a claim.(4)If a complaint fails to meet the pleading requirements of this section, the court shall dismiss the action without prejudice.(5)A covered platform may bring a motion to dismiss under this section before filing an answer or other responsive pleading.(6)If the court grants a motion to dismiss under this section and the plaintiff files an amended complaint that again fails to meet the pleading requirements of this section, the court shall:(a)dismiss the action with prejudice; and(b)award the covered platform reasonable attorney fees and costs incurred in bringing the motion to dismiss the amended complaint.

Section 13. Section 13-72b-306 is enacted to read:13-72b-306Effective 01/01/27. Relationship to federal law.(1)This part does not expand or modify the notice and takedown requirements established in the Take It Down Act.(2)This part does not alter, modify, or limit Section 230 of the Communications Decency Act, 47 U.S.C. Sec. 230, and may not be construed to impose liability on a covered platform for acting as the publisher or speaker of information provided by another information content provider.

Section 14. Section 13-72b-401 is enacted to read:4. Severability13-72b-401Effective 01/01/27. Severability.(1)If any provision of this chapter or the application of any provision to any person or circumstance is held invalid by a final decision of a court of competent jurisdiction, the remainder of this chapter shall be given effect without the invalid provision or application.(2)The provisions of this chapter are severable.

Section 15. Section 13-72c-101 is enacted to read:72c. Digital Content Provenance Standards Act1. General Provisions13-72c-101Effective 01/01/27. Definitions.As used in this chapter:(1)"Artificial intelligence" means a machine-based system that makes predictions, recommendations, or decisions influencing real or virtual environments.(2)"Capture device" means a device that can record photographs, audio, or video content, including a video camera, a still photography camera, a mobile phone with a built-in camera or microphone, or a voice recorder.(3)(a) "Capture device manufacturer" means a person who produces a capture device for sale in the state.(b)"Capture device manufacturer" does not include a person exclusively engaged in the assembly of a capture device.(4)"Compliant system provenance data" means system provenance data that is compliant with widely adopted specifications of an established standards-setting body.(5)(a)"Covered provider" means a person that creates, codes, or otherwise produces a generative artificial intelligence system that:(i)has over 1,000,000 monthly visitors or users; and(ii)is publicly accessible within the geographic boundaries of the state.(b)"Covered provider" does not include a person that creates, codes, or otherwise produces a generative artificial intelligence system that is used exclusively for the person's internal business operations and is not made publicly accessible.(6)"Digital signature" means a cryptography-based method that identifies the user or entity that attests to the information provided in the signed section.(7)"Generative artificial intelligence system" means an artificial intelligence system that can generate derived synthetic content, including text, images, video, or audio, that emulates the structure and characteristics of the system's training data.(8)(a)"Large online platform" means a public-facing social media platform, mass messaging platform, or stand-alone search engine that distributes content to users who did not create or collaborate in creating the content and that exceeded 2,000,000 unique monthly users during the preceding 12 months.(b)"Large online platform" does not include:(i)a broadband internet access service, as defined in 47 C.F.R. Sec. 8.1(b); or(ii)a telecommunications service, as defined in 47 U.S.C. Sec. 153.(9)"Latent" means present but not manifest.(10)"Manifest" means easily perceived, understood, or recognized by a natural person.(11)"Mass messaging platform" means a direct messaging platform that allows users to distribute content to more than 100 users simultaneously.(12)"Metadata" means structural or descriptive information about data.(13)"Personal information" means the same as that term is defined in Section 13-61-101.(14)"Provenance data" means data that is embedded into digital content, or that is included in the digital content's metadata, for the purpose of verifying the digital content's authenticity, origin, or history of modification.(15)"System provenance data" means provenance data that is not reasonably capable of being associated with a particular user and that contains:(a)information regarding the type of device, system, or service that was used to generate a piece of digital content; or(b)information related to content authenticity.(16)"User" means a Utah resident who accesses, interacts with, or uses an interactive computer service, platform, generation service, generative artificial intelligence system, or capture device.(17)"User interface" means the method by which an individual interacts with, controls, or receives information from a computer, software application, website, or electronic device.

Section 16. Section 13-72c-201 is enacted to read:2. Content Provenance Standards and Requirements13-72c-201Effective 01/01/27. Requirements for large online platforms.(1)A large online platform shall:(a)detect whether compliant system provenance data is embedded into or attached to content distributed on the large online platform;(b)provide a user interface to disclose the availability of system provenance data; and(c)allow a user to inspect all available compliant system provenance data in an easily accessible manner:(i)directly through the large online platform's user interface described in Subsection (1)(b);(ii)by allowing the user to download the content's compliant system provenance data; or(iii)by providing a link to the content's system provenance data displayed on an internet website or in another application provided either by the large online platform or a third party.(2)A large online platform may not, to the extent technically feasible, knowingly strip any system provenance data or digital signature that is compliant with widely adopted specifications adopted by an established standards-setting body from content uploaded or distributed on the large online platform.

Section 17. Section 13-72c-202 is enacted to read:13-72c-202Effective 01/01/27. Requirements for capture devices.(1)A capture device manufacturer shall include a latent disclosure in content captured by the capture device that conveys:(a)(i)the name of the capture device manufacturer; or(ii)digital signatures sufficient to prove whether the content was created using a type of capture device; and(b)the time and date of the content's creation or alteration.(2)A capture device manufacturer may provide a user with the option to disable the latent disclosure on a capture device required in Subsection (1).(3)A capture device manufacturer shall comply with this section only to the extent technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body.(4)This section applies to any capture device a capture device manufacturer produces for sale in the state on or after January 1, 2028.

Section 18. Section 13-72c-203 is enacted to read:13-72c-203Effective 01/01/27. User disclosures.A covered provider shall include a latent disclosure in image, video, or audio content, or content that is any combination of image, video, or audio, created or substantially modified by the covered provider's generative artificial intelligence system that meets the following criteria:(1)to the extent that it is technically feasible and reasonable, the disclosure conveys the following information, either directly or through a link to a permanent internet website:(a)the time and date of the content's creation or alteration; and(b)either:(i)the name of the capture device manufacturer; or(ii)digital signatures sufficient to prove whether the content was created or substantially altered using a generative artificial intelligence system; and(2)the disclosure is consistent with widely accepted industry standards.

Section 19. Section 13-72c-301 is enacted to read:3. Enforcement13-72c-301Effective 01/01/27. Enforcement -- Civil liability.(1)The Division of Consumer Protection shall administer and enforce the provisions of Part 2, Content Provenance Standards and Requirements in accordance with Chapter 2, Division of Consumer Protection.(2)In addition to the division's enforcement powers under Chapter 2, Division of Consumer Protection:(a)the division director may impose an administrative fine of up to $2,500 for each violation of this chapter; and(b)the division may bring an action in a court of competent jurisdiction to enforce a provision of this chapter.(3)In a court action by the division to enforce a provision of this chapter, the court may:(a)declare that an act or practice violates a provision of this chapter;(b)issue an injunction for a violation of this chapter;(c)order disgorgement of money received in violation of this chapter;(d)order payment of disgorged money to an injured purchaser or consumer;(e)impose a fine of up to $2,500 for each violation of this chapter; or(f)award other relief that the court determines reasonable and necessary.(4)If a court awards judgment or injunctive relief to the division, the court shall award the division:(a)reasonable attorney fees;(b)court costs; and(c)investigative fees.(5)A court may impose a civil penalty of no more than $5,000 for each violation of an administrative or court order issued for a violation of this chapter.(6)The attorney general may bring a civil action on behalf of the division to collect a civil penalty imposed under this section.(7)The division shall deposit all fines and civil penalties collected under this section into the Consumer Protection Education and Training Fund created in Section 13-2-8.(8)Nothing in this chapter shall displace any other available remedies or rights authorized under the laws of this state or the United States.

Section 20. Section 63A-16-215 is enacted to read:63A-16-215Effective 01/01/27. Government websites and applications.(1)The chief information officer shall make rules, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, establishing standards for digital content on a webpage of a state agency that the public can access to facilitate a transaction or obtain a service if the chief information officer determines there is a substantial risk that fraudulent or misleading media could cause harm to a resident of the state interacting with the state agency.(2)The standards required by Subsection (1) shall require a digitally accessible provenance record containing provenance information for digital content captured, created, or edited that includes:(a)the identification of:(i)the type of software or tool used; or(ii)the specific tool used;(b)the date of creation;(c)a content identifier; and(d)the previous content identifiers, if applicable.(3)This section does not apply to digital content created before January 1, 2027.

Section 21. Effective Date.This bill takes effect on January 1, 2027.