Section 1. Section 13-61-101 is amended to read:13-61-101Effective 08/01/26. Definitions.As used in this chapter:(1)"Account" means the Consumer Privacy Restricted Account established in Section 13-61-403.(2)"Affiliate" means an entity that:(a)controls, is controlled by, or is under common control with another entity; or(b)shares common branding with another entity.(3)"Aggregated data" means information that relates to a group or category of consumers:(a)from which individual consumer identities have been removed; and(b)that is not linked or reasonably linkable to any consumer.(4)"Air carrier" means the same as that term is defined in 49 U.S.C. Sec. 40102.(5)"Authenticate" means to use reasonable means to determine that a consumer's request to exercise the rights described in Section 13-61-201 is made by the consumer who is entitled to exercise those rights.(6)(a)"Biometric data" means data generated by automatic measurements of an individual's unique biological characteristics.(b)"Biometric data" includes data described in Subsection (6)(a) that are generated by automatic measurements of an individual's fingerprint, voiceprint, eye retinas, irises, or any other unique biological pattern or characteristic that is used to identify a specific individual.(c)"Biometric data" does not include:(i)a physical or digital photograph;(ii)a video or audio recording;(iii)data generated from an item described in Subsection (6)(c)(i) or (ii);(iv)information captured from a patient in a health care setting; or(v)information collected, used, or stored for treatment, payment, or health care operations as those terms are defined in 45 C.F.R. Parts 160, 162, and 164.(7)"Business associate" means the same as that term is defined in 45 C.F.R. Sec. 160.103.(8)"Child" means an individual younger than 13 years old.(9)"Companion chatbot operator" means the same as the term "operator" is defined in Section 63N-22b-101.(9)(10)"Consent" means an affirmative act by a consumer that unambiguously indicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer.(10)(11)(a)"Consumer" means an individual who is a resident of the state acting in an individual or household context.(b)"Consumer" does not include an individual acting in an employment or commercial context.(11)(12)"Control" or "controlled" as used in Subsection (2) means:(a)ownership of, or the power to vote, more than 50% of the outstanding shares of any class of voting securities of an entity;(b)control in any manner over the election of a majority of the directors or of the individuals exercising similar functions; or(c)the power to exercise controlling influence of the management of an entity.(12)(13)"Controller" means a person doing business in the state who determines the purposes for which and the means by which personal data are processed, regardless of whether the person makes the determination alone or with others.(13)(14)"Covered entity" means the same as that term is defined in 45 C.F.R. Sec. 160.103.(14)(15)(a)"Deidentified data" means data that:(i)cannot reasonably be linked to an identified individual or an identifiable individual; and(ii)are possessed by a controller who:(A)takes reasonable measures to ensure that a person cannot associate the data with an individual;(B)publicly commits to maintain and use the data only in deidentified form and not attempt to reidentify the data; and(C)contractually obligates any recipients of the data to comply with the requirements described in Subsections (14)(b)(i) and (ii)Subsections (15)(a)(ii)(A) and (B).(b)"Deidentified data" includes synthetic data.(15)(16)"Director" means the director of the Division of Consumer Protection.(16)(17)"Division" means the Division of Consumer Protection created in Section 13-2-1.(17)(18)"Governmental entity" means the same as that term is defined in Section 63G-2-103.(18)(19)"Health care facility" means the same as that term is defined in Section 26B-2-201.(19)(20)"Health care provider" means the same as that term is defined in Section 78B-3-403.(20)(21)"Identifiable individual" means an individual who can be readily identified, directly or indirectly.(21)(22)"Institution of higher education" means a public or private institution of higher education.(22)(23)"Local political subdivision" means the same as that term is defined in Section 11-14-102.(23)(24)"Nonprofit corporation" means:(a)the same as that term is defined in Section 16-6a-102; or(b)a foreign nonprofit corporation as defined in Section 16-6a-102.(24)(25)(a)"Personal data" means information that is linked or reasonably linkable to an identified individual or an identifiable individual.(b)"Personal data" does not include deidentified data, aggregated data, or publicly available information.(25)(26)"Process" means an operation or set of operations performed on personal data, including collection, use, storage, disclosure, analysis, deletion, or modification of personal data.(26)(27)"Processor" means a person who processes personal data on behalf of a controller.(27)(28)"Protected health information" means the same as that term is defined in 45 C.F.R. Sec. 160.103.(28)(29)"Pseudonymous data" means personal data that cannot be attributed to a specific individual without the use of additional information, if the additional information is:(a)kept separate from the consumer's personal data; and(b)subject to appropriate technical and organizational measures to ensure that the personal data are not attributable to an identified individual or an identifiable individual.(29)(30)"Publicly available information" means information that a person:(a)lawfully obtains from a record of a governmental entity;(b)reasonably believes a consumer or widely distributed media has lawfully made available to the general public; or(c)if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.(30)(31)"Right" means a consumer right described in Section 13-61-201.(31)(32)(a)"Sale," "sell," or "sold" means the exchange of personal data for monetary consideration by a controller to a third party.(b)"Sale," "sell," or "sold" does not include:(i)a controller's disclosure of personal data to a processor who processes the personal data on behalf of the controller;(ii)a controller's disclosure of personal data to an affiliate of the controller;(iii)considering the context in which the consumer provided the personal data to the controller, a controller's disclosure of personal data to a third party if the purpose is consistent with a consumer's reasonable expectations;(iv)the disclosure or transfer of personal data when a consumer directs a controller to:(A)disclose the personal data; or(B)interact with one or more third parties;(v)a consumer's disclosure of personal data to a third party for the purpose of providing a product or service requested by the consumer or a parent or legal guardian of a child;(vi)the disclosure of information that the consumer:(A)intentionally makes available to the general public via a channel of mass media; and(B)does not restrict to a specific audience; or(vii)a controller's transfer of personal data to a third party as an asset that is part of a proposed or actual merger, an acquisition, or a bankruptcy in which the third party assumes control of all or part of the controller's assets.(32)(33)(a)"Sensitive data" means:(i)personal data that reveals:(A)an individual's racial or ethnic origin;(B)an individual's religious beliefs;(C)an individual's sexual orientation;(D)an individual's citizenship or immigration status; or(E)information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional;(ii)the processing of genetic personal data or biometric data, if the processing is for the purpose of identifying a specific individual; or(iii)specific geolocation data.(b)"Sensitive data" does not include personal data that reveals an individual's:(i)racial or ethnic origin, if the personal data are processed by a video communication service; or(ii)if the personal data are processed by a person licensed to provide health care under Title 26B, Chapter 2, Part 2, Health Care Facility Licensing and Inspection, or Title 58, Occupations and Professions, information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional.(33)(34)(a)"Specific geolocation data" means information derived from technology, including global position system level latitude and longitude coordinates, that directly identifies an individual's specific location, accurate within a radius of 1,750 feet or less.(b)"Specific geolocation data" does not include:(i)the content of a communication; or(ii)any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.(34)(35)"Synthetic data" means data that has been generated by computer algorithms or statistical models and does not contain personal data.(35)(36)(a)"Targeted advertising" means displaying an advertisement to a consumer where the advertisement is selected based on personal data obtained from the consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests.(b)"Targeted advertising" does not include advertising:(i)based on a consumer's activities within a controller's website or online application or any affiliated website or online application;(ii)based on the context of a consumer's current search query or visit to a website or online application;(iii)directed to a consumer in response to the consumer's request for information, product, a service, or feedback; or(iv)processing personal data solely to measure or report advertising:(A)performance;(B)reach; or(C)frequency.(36)(37)"Third party" means a person other than:(a)the consumer, controller, or processor; or(b)an affiliate or contractor of the controller or the processor.(37)(38)"Trade secret" means information, including a formula, pattern, compilation, program, device, method, technique, or process, that:(a)derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from the information's disclosure or use; and(b)is the subject of efforts that are reasonable under the circumstances to maintain the information's secrecy.

Section 2. Section 13-61-102 is amended to read:13-61-102Effective 08/01/26. Applicability.(1)This chapter applies to:(a) any controller or processor who:(a)(i)(i)(A)conducts business in the state; or(ii)(B)produces a product or service that is targeted to consumers who are residents of the state;(b)(ii)has annual revenue of $25,000,000 or more; and(c)(iii)satisfies one or more of the following thresholds:(i)(A)during a calendar year, controls or processes personal data of 100,000 or more consumers; or(ii)(B)derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.; or(b)a companion chatbot operator.(2)This chapter does not apply to:(a)a governmental entity or a third party under contract with a governmental entity when the third party is acting on behalf of the governmental entity;(b)a tribe;(c)an institution of higher education;(d)a nonprofit corporation;(e)a covered entity;(f)a business associate;(g)information that meets the definition of:(i)protected health information for purposes of the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. Sec. 1320d et seq., and related regulations;(ii)patient identifying information for purposes of 42 C.F.R. Part 2;(iii)identifiable private information for purposes of the Federal Policy for the Protection of Human Subjects, 45 C.F.R. Part 46;(iv)identifiable private information or personal data collected as part of human subjects research pursuant toin accordance with or under the same standards as:(A)the good clinical practice guidelines issued by the International Council for Harmonisation; or(B)the Protection of Human Subjects under 21 C.F.R. Part 50 and Institutional Review Boards under 21 C.F.R. Part 56;(v)personal data used or shared in research conducted in accordance with one or more of the requirements described in Subsection (2)(g)(iv);(vi)information and documents created specifically for, and collected and maintained by, a committee but not a board or council listed in Section 26B-1-204;(vii)information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 U.S.C. Sec. 11101 et seq., and related regulations;(viii)patient safety work product for purposes of 42 C.F.R. Part 3; or(ix)information that is:(A)deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. Part 164; and(B)derived from any of the health care-related information listed in this Subsection (2)(g);(h)information originating from, and intermingled to be indistinguishable with, information under Subsection (2)(g) that is maintained by:(i)a health care facility or health care provider; or(ii)a program or a qualified service organization as defined in 42 C.F.R. Sec. 2.11;(i)information used only for public health activities and purposes as described in 45 C.F.R. Sec. 164.512;(j)(i)an activity by:(A)a consumer reporting agency, as defined in 15 U.S.C. Sec. 1681a;(B)a furnisher of information, as set forth in 15 U.S.C. Sec. 1681s-2, who provides information for use in a consumer report, as defined in 15 U.S.C. Sec. 1681a; or(C)a user of a consumer report, as set forth in 15 U.S.C. Sec. 1681b;(ii)subject to regulation under the federal Fair Credit Reporting Act, 15 U.S.C. Sec. 1681 et seq.; and(iii)involving the collection, maintenance, disclosure, sale, communication, or use of any personal data bearing on a consumer's:(A)credit worthiness;(B)credit standing;(C)credit capacity;(D)character;(E)general reputation;(F)personal characteristics; or(G)mode of living;(k)a financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. Sec. 6801 et seq., and related regulations;(l)personal data collected, processed, sold, or disclosed in accordance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. Sec. 2721 et seq.;(m)personal data regulated by the federal Family Education Rights and Privacy Act, 20 U.S.C. Sec. 1232g, and related regulations;(n)personal data collected, processed, sold, or disclosed in accordance with the federal Farm Credit Act of 1971, 12 U.S.C. Sec. 2001 et seq.;(o)data that are processed or maintained:(i)in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent the collection and use of the data are related to the individual's role;(ii)as the emergency contact information of an individual described in Subsection (2)(o)(i) and used for emergency contact purposes; or(iii)to administer benefits for another individual relating to an individual described in Subsection (2)(o)(i) and used for the purpose of administering the benefits;(p)an individual's processing of personal data for purely personal or household purposes; or(q)an air carrier.(3)A controller is in compliance with any obligation to obtain parental consent under this chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online Privacy Protection Act, 15 U.S.C. Sec. 6501 et seq., and the act's implementing regulations and exemptions.(4)This chapter does not require a person to take any action in conflict with the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. Sec. 1320d et seq., or related regulations.

Section 3. Section 63I-2-213 is amended to read:63I-2-213Effective 08/01/26. Repeal dates: Title 13.(1)Title 13, Chapter 47, Private Employer Verification Act, is repealed on the program start date, as defined in Section 63G-12-102.(2)Title 13, Chapter 72, Artificial Intelligence Policy Act, is repealed July 1, 2027.

Section 4. Section 63N-22-101, which is renumbered from Section 13-72-101 is renumbered and amended to read:13-72-10163N-22-101Effective 08/01/26Repealed 07/01/27. Definitions.As used in this chapter:(1)"Applicant" means a person that applies for participation in the regulatory learning laboratory.(2)"Artificial intelligence" means a machine-based system that makes predictions, recommendations, or decisions influencing real or virtual environments.(3)"Artificial intelligence technology" means a computer system, application, or other product that uses or incorporates one or more forms of artificial intelligence.(4)"Department" means the Department of Commerce.(5)(4)"Director" means the director of the office.(6)(5)"Executive director" means the executive director of the Department of Commerceof the Governor's Office of Economic Opportunity.(7)(6)"Learning agenda" means the areas of artificial intelligence applications, risks, and policy considerations selected by the office for focus by the learning laboratory.(8)(7)"Learning laboratory" means the artificial intelligence analysis and research program created in Section 13-72-30163N-22-301.(9)(8)"Office" means the Office of Artificial Intelligence Policy created in Section 13-74-20163N-22-201.(10)(9)"Participant" means a person that is accepted to participate in the learning laboratory.(11)(10)"Regulatory mitigation agreement" means an agreement between a participant, the office, and relevant state agencies described in Section 63N-22-302.13-72-302.(12)(11)"Regulatory mitigation" means:(a)when restitution to users may be required;(b)terms and conditions related to any cure period before penalties may be assessed;(c)any reduced civil fines during the participation term; and(d)other terms tailored to identified issues of the artificial intelligence technology.

Section 5. Section 63N-22-201, which is renumbered from Section 13-72-201 is renumbered and amended to read:13-72-20163N-22-201Effective 08/01/26Repealed 07/01/27. Creation of Office of Artificial Intelligence Policy -- Director appointed -- Duties and authority.(1)There is created in the departmentwithin the Governor's Office of Economic Opportunity the Office of Artificial Intelligence Policy.(2)The executive director of the departmentGOEO shall appoint a director to oversee the management and operations of the office.(3)The office shall:(a)create and administer an artificial intelligence learning laboratory program;(b)consult with businesses and other stakeholders in the state about potential regulatory proposals;(c)make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, establishing:(i)procedures, requirements, and fees to apply to participate in the learning laboratory program;(ii)criteria for invitation, acceptance, denial, or removal of participants;(iii)data usage limitations and cybersecurity criteria for participants;(iv)required participant disclosures to consumers;(v)reporting requirements for participants to the office;(vi)criteria for limited extension of the participation period; and(vii)other requirements necessary to administer the learning laboratory; and(d)report annually, before November 30, to the Business and Labor Interim Committee regarding:(i)the proposed learning agenda for the learning laboratory;(ii)the findings, participation, and outcomes of the learning laboratory; and(iii)recommended legislation from findings from the learning laboratory.

Section 6. Section 63N-22-301, which is renumbered from Section 13-72-301 is renumbered and amended to read:13-72-30163N-22-301Effective 08/01/26Repealed 07/01/27. Artificial Intelligence Learning Laboratory Program.(1)There is established the Artificial Intelligence Learning Laboratory Program, to be administered by the office.(2)The purpose of the learning laboratory is to:(a)analyze and research the risks, benefits, impacts, and policy implications of artificial intelligence technologies to inform the state regulatory framework;(b)encourage development of artificial intelligence technologies in the state;(c)evaluate the effectiveness and viability of current, potential, or proposed regulation on artificial intelligence technologies with artificial intelligence companies; and(d)produce findings and recommendations for legislation and regulation of artificial intelligence.(3)(a)The office shall periodically set a learning agenda for the learning laboratory that establishes the specific areas of artificial intelligence policy the office intends to study.(b)In establishing the learning agenda, the office may consult with:(i)relevant agencies;(ii)industry leaders;(iii)academic institutions in the state; and(iv)key stakeholders with relevant knowledge, experience, or expertise in the area.(4)The office may invite and receive an application from a person to participate in the learning laboratory.(5)The office shall establish the procedures and requirements for sending an invitation and receiving requests to participate in the learning laboratory in accordance with the purposes of the learning laboratory.(6)In selecting participants for the learning laboratory, the office shall consider:(a)the relevance and utility of an invitee or applicant's artificial intelligence technology to the learning agenda;(b)the invitee or applicant's expertise and knowledge specific to the learning agenda; and(c)other factors identified by the office as relevant to participation in the learning laboratory.(7)The office shall work with participants to establish benchmarks and assess outcomes of participation in the learning laboratory.

Section 7. Section 63N-22-302, which is renumbered from Section 13-72-302 is renumbered and amended to read:13-72-30263N-22-302Effective 08/01/26Repealed 07/01/27. Regulatory mitigation agreements.(1)A participant who uses or wants to utilize an artificial intelligence technology in the state may apply for regulatory mitigation according to criteria and procedures outlined by the office by rule made under Section 13-72-20163N-22-201.(2)The office may grant, on a temporary basis, regulatory mitigation to a participant by entering into a regulatory mitigation agreement with the office and relevant agencies.(3)To receive regulatory mitigation, a participant must demonstrate that the applicant meets eligibility criteria established in Section 13-72-30363N-22-303.(4)A regulatory mitigation agreement between a participant and the office and relevant agencies shall specify:(a)limitations on scope of the use of the participant's artificial intelligence technology, including:(i)the number and types of users;(ii)geographic limitations; and(iii)other limitations to implementation;(b)safeguards to be implemented; and(c)any regulatory mitigation granted to the applicant.(5)The office shall consult with relevant agencies regarding appropriate terms in a regulatory mitigation agreement.(6)A participant remains subject to all legal and regulatory requirements not expressly waived or modified by the terms of the regulatory mitigation agreement.(7)(a)The office may remove a participant at any time and for any reason, and the participant does not have an expectation of a property right or license to participate in the learning laboratory.(b)A participant demonstrating an artificial intelligence technology that violates legal or regulatory requirements or the terms of the participation agreement may be immediately removed from further participation and subject to all applicable civil and criminal penalties.(8)Participation in the learning laboratory does not constitute an endorsement or approval from the state.(9)The state shall not be responsible for any claims, liabilities, damages, losses, or expenses arising out of a participant's involvement in the learning laboratory.

Section 8. Section 63N-22-304, which is renumbered from Section 13-72-304 is renumbered and amended to read:13-72-30463N-22-304Effective 08/01/26Repealed 07/01/27. Participation in Artificial Intelligence Learning Laboratory.(1)(a)The office may approve an applicant to participate in the program.(b)An approved applicant becomes a participant by entering into a participation agreement with the office and relevant state agencies.(2)A participant shall:(a)provide required information to state agencies in accordance with the terms of the participation agreement; and(b)report to the office as required in the participation agreement.(3)The office may establish additional cybersecurity auditing procedures applicable to participants demonstrating artificial intelligence technologies that the office considers higher risk.(4)A participant shall retain records as required by office rule or the participation agreement.(5)A participant shall immediately report to the office any incidents resulting in consumer harm, privacy breach, or unauthorized data usage, which may result in removal of the participant from the learning laboratory.

Section 9. Section 63N-22-305, which is renumbered from Section 13-72-305 is renumbered and amended to read:13-72-30563N-22-305Effective 08/01/26Repealed 07/01/27. Program extension.(1)An initial regulatory mitigation agreement shall be in force for no longer than 12 months.(2)A participant may request a single 12-month extension for participation in the learning laboratory period no later than 30 days before the end of the initial 12-month period.(3)The office shall grant or deny an extension request before expiration of the initial demonstration period.

Section 10. Section 63N-22b-101 is enacted to read:22b. Companion Chatbot Safety Act1. General Provisions63N-22b-101Effective 08/01/26. Definitions.(1)(a)"Affirmative consent" means a clear act signifying a user's freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from an operator, provided:(i)the request is provided to the user in a clear and conspicuous standalone disclosure;(ii)the request includes a description, written in easy-to-understand language, of the act or practice for which the user's consent is sought;(iii)the request is made in a manner reasonably accessible to and usable by a user with a disability;(iv)the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and(v)affirmative consent to an act or practice is not inferred from the inaction of the user or the user's continued use of a chatbot provided by the chatbot provider.(b)"Affirmative consent" does not include:(i)acceptance of a general or broad terms of use or similar document;(ii)hovering over, muting, pausing, or closing a given piece of content;(iii)an agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or(iv)an agreement obtained through the use of a dark pattern.(2)"Artificial intelligence" means the same as that term is defined in Section 63N-22-101.(3)"Companion chatbot" means an artificial intelligence system that uses a natural language interface that:(a)uses personal data retained, stored, or retrieved from a prior interaction and generates an output that:(i)simulates a relationship with the user; or(ii)indicates the companion chatbot has emotions, feelings, memories, or personal opinions; and(b)generates an output containing an affective or social inquiry that:(i)is not logically required to resolve a user prompt or task-based command; or(ii)prioritizes extension of the interaction over task resolution.(4)"Core functioning" means features and services for which the collection or processing of the user's personal data is reasonably necessary to provide the companion chatbot service to the user.(5)"Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, and includes any practice the Federal Trade Commission refers to as a "dark pattern."(6)"Interaction" means a user input and a subsequent response by a companion chatbot.(7)"Material harmful to minors" means the same as that term is defined in Section 76-5c-101.(8)"Minor" means an individual under 18 years old that:(a)has not been emancipated as that term is defined in Section 80-7-102; or(b)has not been married.(9)"Office" means the Governor's Office of Economic Opportunity created in Section 63N-1a-301.(10)"Operator" means a person who makes a companion chatbot available to a user in the state.(11)"Personal data" means the same as that term is defined in Section 13-61-101.(12)"Sensitive data" means the same as that term is defined in Section 13-61-101.(13)"Targeted advertising" means the same as that term is defined in Section 13-61-101.(14)"User" means an individual who:(a)interacts with a companion chatbot; and(b)is a Utah resident.

Section 11. Section 63N-22b-201 is enacted to read:2. Safety Requirements63N-22b-201Effective 08/01/26. Safety requirements for users.(1)An operator shall comply with the requirements of Chapter 61, Utah Consumer Privacy Act, including:(a)allowing a user to obtain a copy of the user's interactions with a companion chatbot that are retained by the operator in a format that is portable and readily usable in accordance with Section 13-61-201; and(b)obtaining a user's affirmative consent before processing the user's sensitive data in accordance with Section 13-61-302.(2)An operator shall prevent the companion chatbot from engaging with a user unless:(a)the operator prevents the companion chatbot from generating responses that encourage suicidal ideation, suicide, self-harm, or harm to others; and(b)if the user expresses suicidal ideation, self-harm, or harm to others, the companion chatbot provides to the user resources including a referral to:(i)crisis service providers;(ii)a suicide hotline; or(iii)a crisis text line.(3)An operator may not advertise a specific product or service to the user, unless the operator clearly and conspicuously, in the companion chatbot's interaction with the user:(a)identifies the advertisement as an advertisement; and(b)discloses to the user any sponsorship, business affiliation, or agreement that the operator has with a person to promote, advertise, or recommend the advertised product or service.

Section 12. Section 63N-22b-202 is enacted to read:63N-22b-202Effective 08/01/26. Additional safety requirements for minor users.(1)An operator shall, for a user who is a minor:(a)provide a clear and conspicuous notice to the user at least every hour during a continuing chatbot interaction that:(i)reminds the user to take a break from interacting with the companion chatbot; and(ii)states that the user is interacting with an artificial intelligence system, not a human; and(b)opt out, by default, the user from targeted advertising.(2)An operator may not, for a user who is a minor:(a)produce or provide material harmful to minors;(b)direct a user to material harmful to minors;(c)encourage the user to:(i)use illegal substances;(ii)consume alcohol;(iii)use a tobacco or nicotine product;(iv)engage in sexual conduct;(v)engage in self-harm; or(vi)engage in illegal conduct;(d)direct targeted advertising to the user unless a parent or legal guardian of the user has provided affirmative consent;(e)collect data from the user that is not required for core functioning of the companion chatbot;(f)sell a user's personal data; or(g)otherwise convey a user's personal data unless a parent or legal guardian of the user has provided affirmative consent, except as required for core functioning of the companion chatbot.(3)The requirements of this section are in addition to the requirements of Section 63N-22b-201.

Section 13. Section 63N-22b-301 is enacted to read:3. Rulemaking and Reporting63N-22b-301Effective 08/01/26. Office rulemaking.In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the office may make rules:(1)establishing reasonable age assurance standards that an operator may meet to qualify for the safe harbor described in Section 63N-22b-402, including standards for:(a)third-party age assurance services;(b)protecting user privacy and data security;(c)verifying the reliability and accuracy of age assurance methods; and(d)retaining, protecting, and securely disposing of any information obtained as a result of age assurance;(2)establishing the form of the report required in Section 63N-22b-302; and(3)establishing standards an operator may meet to qualify for the safe harbor described in Section 63N-22b-402, including:(a)design features that prevent a companion chatbot from engaging in or reciprocating user attempts to establish a relationship; (b)measures or methods to limit a user's emotional and social attachment to a companion chatbot;(c)measures and processes to reduce mental and physical risk to a user; and(d)disclosure, transparency, and reporting requirements relevant to Subsections (3)(a)-(c).

Section 14. Section 63N-22b-302 is enacted to read:63N-22b-302Effective 08/01/26. Reporting requirements.(1)An operator shall annually report to the office:(a)the number of times the operator has issued a crisis service provider referral notification in accordance with Section 63N-22b-202 in the preceding calendar year;(b)methods the operator has implemented to detect, remove, and respond to expressions of suicidal ideation, suicide, or self-harm by users; and(c)methods the operator has implemented to prevent a companion chatbot response about suicidal ideation or actions with the user.(2)The report required by this section may not include a user's personal data.

Section 15. Section 63N-22b-401 is enacted to read:4. Enforcement and Safe Harbor63N-22b-401Effective 08/01/26. Enforcement.(1)The office shall administer this chapter and monitor operator compliance with the provisions of this chapter.(2)The office may investigate potential violations of this chapter, including by:(a)reviewing reports submitted under Section 63N-22b-302;(b)auditing an operator's compliance with the requirements of this chapter; and(c)issuing a determination of violation to an operator that the office finds to be in noncompliance with this chapter.(3)Upon issuing a determination of violation under Subsection (2)(c), the office shall refer the matter to the attorney general for civil enforcement.(4)The attorney general may bring a civil action in a court of competent jurisdiction to enforce a provision of this chapter. In such an action, the court may:(a)declare that an act or practice violates a provision of this chapter;(b)issue an injunction for a violation of this chapter;(c)order disgorgement of money received in violation of this chapter;(d)order payment of disgorged money to an injured user or consumer;(e)impose a civil penalty of up to $2,500 for each violation of this chapter; or(f)award other relief that the court determines reasonable and necessary.(5)A court may impose a civil penalty of no more than $50,000 for each violation of an administrative or court order issued for a violation of this chapter.(6)A civil penalty authorized under this section shall be paid to the Division of Finance for deposit into the General Fund.(7)If a court awards judgment or injunctive relief to the attorney general under this section, the court shall award reasonable attorney fees and court costs.(8)Nothing in this chapter displaces any other available remedies or rights authorized under the laws of this state or the United States.

Section 16. Section 63N-22b-402 is enacted to read:63N-22b-402Effective 08/01/26. Safe harbor.(1)An operator bears the burden of demonstrating by clear and convincing evidence that the operator qualifies for a safe harbor described in this section.(2)An operator is not liable for a violation of Section 63N-22b-202 if the operator uses an age assurance method that meets the standards established by rule made in accordance with Section 63N-22b-301.(3)An operator is not liable for a violation of this chapter if the operator meets the standards established by office rule made in accordance with Subsection 63N-22b-301(3).

Section 17. Section 63N-22b-501 is enacted to read:5. Severability63N-22b-501Effective 08/01/26. Severability.(1)If any provision of this chapter, or the application of any provision to any person or circumstance, is held invalid by a final decision of a court of competent jurisdiction, the remainder of this chapter shall be given effect without the invalid provision or application.(2)The provisions of this chapter are severable.

Section 18. Effective Date.This bill takes effect on August 1, 2026.