Effective 5/6/2026
78B-3-1002 Age verification requirement -- Retention of data -- Exceptions.
(1)
(a)A commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of material harmful to minors shall perform reasonable age verification methods to verify the age of an individual attempting to access the material.
(b)There is a rebuttable presumption that a website contains a substantial portion of material harmful to minors if the commercial entity:
(i)markets or brands the website as primarily providing material harmful to minors;
(ii)uses a website name, domain name, or subdomain that indicates the website primarily provides material harmful to minors; or
(iii)advertises or promotes material harmful to minors as a primary feature of the website.
(2)A commercial entity or third party that performs the required age verification shall not retain any identifying information of the individual after access has been granted to the material.
(3)An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.
(4)A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements, including by providing:
(a)instructions on how to use a virtual private network or proxy server to access the website; or
(b)means for individuals in this state to circumvent geofencing or blocking.
(5)This section shall not apply to any bona fide news or public interest broadcast, website video, report, or event and shall not be construed to affect the rights of a news-gathering organization.
(6)No internet service provider, affiliate or subsidiary of an internet service provider, search engine, or cloud service provider shall be held to have violated the provisions of this section solely for providing access or connection to or from a website or other information or content on the internet, or a facility, system, or network not under that provider’s control, including transmission, downloading, storing, or providing access, to the extent that such provider is not responsible for the creation of the content of the communication that constitutes material harmful to minors.

Amended by Chapter 220, 2026 General Session