HB 261

Enrolled Copy  H.B. 261
1Electronic Information Privacy Act Amendments
  2026 GENERAL SESSION
  STATE OF UTAH
  Chief Sponsor: Jason B. Kyle
  Senate Sponsor: Todd Weiler
2
3  LONG TITLE
4  General Description:
5      This bill amends the Electronic Information Privacy Act.
6  Highlighted Provisions:
7      This bill:
8      ▸ amends and clarifies definitions;
9      ▸ clarifies and amends procedures and requirements for a law enforcement agency that
10  seeks to obtain, use, copy, or disclose certain electronic information or records;
11      ▸ revises liability provisions for a provider of an electronic communication service or a
12  remote computing service;
13      ▸ provides that the procedures and requirements described in the Electronic Information
14  Privacy Act (act) are the only permissible methods for a law enforcement agency to
15  obtain, use, copy, disclose, or otherwise access certain electronic information or records,
16  with certain exceptions;
17      ▸ prohibits a law enforcement agency from contracting with or otherwise using a third party
18  to obtain, use, copy, disclose, or otherwise access certain electronic information or
19  records in a manner that the law enforcement agency would be prohibited from doing
20  directly, with certain exceptions;
21      ▸ provides that electronic information or records obtained in violation of the act, as well as
22  any evidence derived from the electronic information or records, are subject to the same
23  rules governing exclusion of evidence obtained in violation of constitutional
24  requirements; and
25      ▸ makes technical and conforming changes.
26  Money Appropriated in this Bill:
27      None
H.B. 261  Enrolled Copy
28   Other Special Clauses:
29None
30   Utah Code Sections Affected:
31   AMENDS:
3277-23c-101.2, as last amended by Laws of Utah 2023, Chapter 382
3377-23c-102, as last amended by Laws of Utah 2023, Chapters 382, 514
3477-23c-103, as last amended by Laws of Utah 2023, Chapter 382
3577-23c-104, as last amended by Laws of Utah 2023, Chapter 382
3677-23c-105, as enacted by Laws of Utah 2019, Chapter 362
37   ENACTS:
3877-23c-104.1, Utah Code Annotated 1953
39
40   Be it enacted by the Legislature of the state of Utah:
41Section 1. Section 77-23c-101.2 is amended to read:
4277-23c-101.2 . Definitions.
43      As used in this chapter:
44   (1) "Electronic communication service" means a service that provides to users of the
45service the ability to send or receive wire or electronic communications.
46   (2) "Electronic device" means a device that enables access to or use of an electronic
47communication service, remote computing service, or location information service.
48   (3)(a) "Electronic information" means information or data including a sign, signal,
49writing, image, sound, or intelligence of any nature transmitted or stored in whole or
50in part by a wire, radio, electromagnetic, photoelectronic, or photooptical system.
51(b) "Electronic information" includes the location information, stored data, or
52transmitted data of an electronic device.
53(c) "Electronic information" does not include:
54(i) a wire or oral communication;
55(ii) a communication made through a tone-only paging device; or
56(iii) electronic funds transfer information stored by a financial institution in a
57communications system used for the electronic storage and transfer of money.
58   (4) "Law enforcement agency" means:
59(a) an entity of the state or a political subdivision of the state that exists to primarily
60prevent, detect, or prosecute crime and enforce criminal statutes or ordinances; or
61(b) an individual or entity acting for or on behalf of an entity described in Subsection
  -2-
Enrolled Copy  H.B. 261
62(4)(a).
63  (5)(a) "Location information" means information concerning the geographical location
64      of an electronic device that, in whole or in part, is generated or derived from or
65      obtained by the operation of an electronic device or the operation of a software
66      application on an electronic device.
67      (b) "Location information" includes past, current, and future location information.
68  (6) "Location information service" means the provision of a global positioning service or
69      other mapping, location, or directional information service.
70  (7) "Oral communication" means the same as that term is defined in Section 77-23a-3.
71  (8) "Remote computing service" means the provision to the public of computer storage or
72      processing services by means of an electronic communications system.
73  (9) "Subscriber record" means a record or information that:
74      (a)(i) is in the possession of a provider of an electronic communication service or a
75remote computing service;
76(ii) is created or maintained by a provider of an electronic communication service or
77a remote computing service; or
78(iii) is received from, or derived from, a record or information originally possessed,
79created, or maintained by a provider of an electronic communication service or a
80remote computing service; and
81      (b) reveals a subscriber's or customer's:
82(i) name;
83(ii) address;
84(iii) local or long distance telephone connection record, or record of session time and
85duration;
86(iv) length of service, including the start date;
87(v) type of service used;
88(vi) telephone number, instrument number, or other subscriber or customer number or
89identification, including a temporarily assigned network address; or
90(vii) means or source of payment to the electronic communication service or a remote
91computing service, including a credit card or bank account number.
92  [(9)] (10) "Transmitted data" means electronic information that is transmitted wirelessly:
93      (a) from an electronic device to another electronic device without the use of an
94intermediate connection or relay; or
95      (b) from an electronic device to a nearby antenna or from a nearby antenna to an
  -3-
 H.B. 261  Enrolled Copy
96electronic device.
97   [(10)] (11) "Wire communication" means the same as that term is defined in Section
9877-23a-3.
99Section 2. Section 77-23c-102 is amended to read:
10077-23c-102 . Electronic information privacy -- Warrant required for disclosure.
101   (1)(a) Except as provided in Subsection (2)[ or] , (4), or Section 77-23c-104.1, and
102subject to Section 77-23c-105, for a criminal investigation or prosecution, a law
103enforcement agency may not obtain, [without] copy, or use the following information
104or data except through the use of a search warrant issued by a court upon probable
105cause:
106(i) the location information, stored data, or transmitted data of an electronic device; or
107(ii) electronic information transmitted by the owner of the electronic information:
108(A) to a provider of a remote computing service; or
109(B) through a provider of an electronic communication service.
110(b)(i) Except as provided in Subsection (1)(b)(ii) and subject to Subsection (1)(c), [a]
111if a law enforcement agency, in response to a warrant obtained under Subsection
112(1)(a), obtains information or data described in Subsection (1)(a)(i) or (ii), the law
113enforcement agency may not use, copy, or disclose, for any purpose, [the location
114information, stored data, or transmitted data of an electronic device, or electronic
115information provided by a provider of a remote computing service or an electronic
116communication service, ] any information or data described in Subsection (1)(a)(i)
117or (ii) that:
118[(i)] (A) is not the subject of the warrant obtained under Subsection (1)(a); and
119[(ii)] (B) is collected as part of an effort to obtain the [location information, stored
120data, or transmitted data of an electronic device, or electronic information
121provided by a provider of a remote computing service or an electronic
122communication service] information or data described in Subsection (1)(a)(i) or
123(ii) that is the subject of the warrant [in] obtained under Subsection (1)(a).
124[(c)] (ii) A law enforcement agency may use, copy, or disclose the transmitted data of
125an electronic device used to communicate with the electronic device that is the
126subject of the warrant if the law enforcement agency reasonably believes that the
127transmitted data is necessary to achieve the objective of the warrant.
128[(d)] (c) The electronic information described in Subsection (1)(b) shall be destroyed in
129an unrecoverable manner by the law enforcement agency as soon as reasonably
  -4-
 Enrolled Copy  H.B. 261
130possible after the electronic information is collected.
131  (2)(a) [A ] Except as provided in Subsection (2)(c) or Section 77-23c-104.1 and subject
132      to Section 77-23c-105, a law enforcement agency may obtain location information
133      without a warrant for an electronic device only:
134(i) in accordance with Section 53-10-104.5;
135(ii) if the device is reported stolen by the owner;
136(iii) with the informed, affirmative consent of the owner or user of the electronic
137device;
138(iv) except for the automobile exception to the warrant requirement, in accordance
139with a judicially recognized exception to warrant requirements;
140(v) if the owner has voluntarily and publicly disclosed the location information; or
141(vi) from a provider of a remote computing service or an electronic communications
142service if the provider voluntarily discloses the location information:
143(A) under a belief that an emergency exists involving an imminent risk to an
144individual of death, serious physical injury, sexual abuse, live-streamed sexual
145exploitation, kidnapping, or human trafficking; or
146(B) that is inadvertently discovered by the provider and appears to pertain to the
147commission of a felony, or of a misdemeanor involving physical violence,
148sexual abuse, or dishonesty.
149      (b) [A ] Except as provided in Subsection (2)(c) or Section 77-23c-104.1 and subject to
150Section 77-23c-105, a law enforcement agency may obtain stored data or transmitted
151data from an electronic device or electronic information transmitted by the owner of
152the electronic information to a provider of a remote computing service or through a
153provider of an electronic communication service, without a warrant, only:
154(i) with the informed consent of the owner of the electronic device or electronic
155information;
156(ii) except for the automobile exception to the warrant requirement, in accordance
157with a judicially recognized exception to warrant requirements; or
158(iii) subject to Subsection (2)(a)(vi)(B), from a provider of a remote computing
159service or an electronic communication service if the provider voluntarily
160discloses the stored or transmitted data as otherwise permitted under 18 U.S.C.
161Sec. 2702.
162      (c) A prosecutor may obtain a judicial order as described in Section 77-22-2.5 for the
163purposes described in Section 77-22-2.5.
  -5-
 H.B. 261  Enrolled Copy
164   (3) A provider of an electronic communication service or a remote computing service, the
165provider's officers, employees, or agents, or other specified persons may not be held
166liable for [providing ]information, facilities, or assistance provided in good faith reliance [
167on the terms of the warrant issued under this section or without a warrant in accordance
168with Subsection (2)] under this section.
169   [(4) Nothing in this chapter:]
170[(a) limits or affects the disclosure of public records under Title 63G, Chapter 2,
171Government Records Access and Management Act;]
172[(b) affects the rights of an employer under Subsection 34-48-202(1)(e) or an
173administrative rule adopted under Section 63A-16-205; or]
174[(c) limits the ability of a law enforcement agency to receive or use information, without
175a warrant or subpoena, from the National Center for Missing and Exploited Children
176under 18 U.S.C. Sec. 2258A.]
177Section 3. Section 77-23c-103 is amended to read:
17877-23c-103 . Notification required -- Exceptions -- Delayed notification.
179   (1)(a) Except as provided in Subsection (1)(b) or (2), a law enforcement agency that
180executes a warrant under [Subsection 77-23c-102(1) or 77-23c-104(3)] Section
18177-23c-102 or 77-23c-104 shall serve the owner of the electronic device or electronic
182information specified in the warrant with a notice described in Subsection (3):
183(i) within 90 days after the day on which the electronic device or the electronic
184information is obtained by the law enforcement agency but in no case more than
185three days after the day on which the investigation is concluded; or
186(ii) if the owner of the electronic device or electronic information specified in the
187warrant is unknown to the law enforcement agency, within 90 days after the day
188on which the law enforcement agency identifies, or reasonably could identify, the
189owner.
190(b) A law enforcement agency is not required to serve a notice described in Subsection
191(1)(a) to the owner of the electronic device or electronic information if the owner is
192located outside of the United States.
193   (2)(a)(i) A law enforcement agency seeking a warrant in accordance with [Subsection
19477-23c-102(1)(a) or 77-23c-104(3)] Section 77-23c-102 or 77-23c-104 may submit
195a request, and the court may grant permission, to delay service of the notice
196required under Subsection (1) for a period not to exceed 30 days, if the court
197determines that there is reasonable cause to believe that the notification may:
  -6-
 Enrolled Copy  H.B. 261
198(A) endanger the life or physical safety of an individual;
199(B) cause a person to flee from prosecution;
200(C) lead to the destruction of or tampering with evidence;
201(D) intimidate a potential witness; or
202(E) otherwise seriously jeopardize an investigation or unduly delay a trial.
203(ii) When a delay of notification is granted under Subsection (2)(a)(i) and upon
204application by the law enforcement agency, the court may grant additional
205extensions of up to 30 days each.
206      (b)(i) A law enforcement agency that seeks a warrant for an electronic device or
207electronic information in accordance with [Subsection 77-23c-102(1)(a) or
20877-23c-104(3)] Section 77-23c-102 or 77-23c-104 may submit a request to the
209court, and the court may grant permission, to delay service of the notice required
210under Subsection (1), if the purpose of delaying the notification is to apprehend an
211individual:
212(A) who is a fugitive from justice under Section 77-30-13; and
213(B) for whom an arrest warrant has been issued for a violent felony offense as
214defined in Section 76-3-203.5.
215(ii)(A) The court may grant the request under Subsection (2)(b)(i) to delay
216notification until the individual who is a fugitive from justice under Section
21777-30-13 is apprehended by the law enforcement agency.
218(B) A law enforcement agency shall serve the notice required under Subsection (1)
219to the owner of the electronic device or electronic information within 14 days
220after the day on which the law enforcement agency apprehends the individual
221described in Subsection (2)(b)(i).
222  (3) A notice required under Subsection (1) shall include:
223      (a) a copy of the warrant; and
224      (b) a written statement identifying:
225(i) the offense specified in the warrant application;
226(ii) the identity of the law enforcement agency that filed the application;
227(iii) the date on which the electronic information was obtained; and
228(iv) the number and length of any authorized delays in serving the notice required
229under Subsection (1), including, if applicable, the name of the court that
230authorized the delay and a reference to the provision of this chapter that permitted
231the delay.
  -7-
 H.B. 261  Enrolled Copy
232   (4) A law enforcement agency shall serve the notice required under Subsection (1) to the
233owner of the electronic device or electronic information by:
234(a) personal service on the owner;
235(b) first-class mail to the owner's last-known address; or
236(c) other reasonable means if the owner's last-known address is unknown.
237Section 4. Section 77-23c-104 is amended to read:
23877-23c-104 . Third-party electronic information and records.
239   [(1) As used in this section, "subscriber record" means a record or information of a provider
240of an electronic communication service or remote computing service that reveals the
241subscriber's or customer's:]
242[(a) name;]
243[(b) address;]
244[(c) local and long distance telephone connection record, or record of session time and
245duration;]
246[(d) length of service, including the start date;]
247[(e) type of service used;]
248[(f) telephone number, instrument number, or other subscriber or customer number or
249identification, including a temporarily assigned network address; and]
250[(g) means and source of payment for the service, including a credit card or bank
251account number.]
252   [(2)] (1) Except as provided in [Chapter 22, Subpoena Powers for Aid of Criminal
253Investigation and Grants of Immunity or Section 77-23f-105,] Subsection (2) or Section
25477-22-2.5 or 77-23c-104.1, and subject to Section 77-23c-105, a law enforcement
255agency may not, except through the use of a search warrant issued by a court upon
256probable cause, obtain, use, copy, or disclose[ ] :
257(a) a subscriber record[.] ; or
258[(3)] (b) [A law enforcement agency may not obtain, use, copy, or disclose, ]for a
259criminal investigation or prosecution, any record or information related to a
260subscriber or a customer, other than a subscriber record, [of a] that is:
261(i) in the possession of a provider of an electronic communication service or a remote
262computing service[ related to a subscriber or customer without a warrant.] ;
263(ii) created or maintained by a provider of an electronic communication service or a
264remote computing service; or
265(iii) received from, or derived from, a record or information originally possessed,
  -8-
 Enrolled Copy  H.B. 261
266created, or maintained by a provider of an electronic communication service or a
267remote computing service.
268  [(4)] (2) [Notwithstanding Subsections (2) and (3), a ] Except as provided in Section
269      77-23c-104.1 and subject to Section 77-23c-105, a law enforcement agency may obtain,
270      use, copy, or disclose a subscriber record, or other record or information related to a
271      subscriber or customer described in Subsection (1)(b), without an investigative subpoena
272      or a warrant, only:
273      (a) with the informed, affirmed consent of the subscriber or customer;
274      (b) in accordance with a judicially recognized exception to warrant requirements;
275      (c) if the subscriber or customer voluntarily discloses the record in a manner that is
276publicly accessible; or
277      (d) if the provider of an electronic communication service or remote computing service
278voluntarily discloses the record:
279(i) under a belief that an emergency exists involving the imminent risk to an
280individual of:
281(A) death;
282(B) serious physical injury;
283(C) sexual abuse;
284(D) live-streamed sexual exploitation;
285(E) kidnapping; or
286(F) human trafficking;
287(ii) that is inadvertently discovered by the provider, if the record appears to pertain to
288the commission of:
289(A) a felony; or
290(B) a misdemeanor involving physical violence, sexual abuse, or dishonesty; or
291(iii) subject to Subsection [77-23c-104(4)(d)(ii)] (2)(d)(ii), as otherwise permitted
292under 18 U.S.C. Sec. 2702.
293  [(5)] (3) A provider of an electronic communication service or remote computing service, or
294      the provider's officers, employees, agents, or other specified persons may not be held
295      liable for [providing ]information, facilities, or assistance provided in good faith reliance [
296      on the terms of a warrant issued under this section, or without a warrant in accordance
297      with Subsection (3)] under this section.
298Section 5. Section 77-23c-104.1 is enacted to read:
29977-23c-104.1 . Exceptions from chapter requirements.
  -9-
 H.B. 261  Enrolled Copy
300   (1) A law enforcement agency may obtain, use, copy, disclose, or otherwise access
301electronic information or a record described in this chapter without complying with the
302requirements and procedures described in this chapter if the law enforcement agency
303obtains the electronic information or record:
304(a)(i) from a federal law enforcement agency, a law enforcement agency in a different
305state, or a law enforcement agency in a different country; and
306(ii) the law enforcement agency described in Subsection (1)(a)(i) obtained the
307electronic information or record:
308(A) in a legal manner under the constitutional requirements and any applicable
309laws, rules, and procedures of that jurisdiction; and
310(B) as part of an investigation of conduct that was occurring in that jurisdiction or
311of a person over which the law enforcement agency had jurisdiction;
312(b) as part of a written interagency agreement that:
313(i) establishes a joint task force or investigative partnership with a federal law
314enforcement agency, a law enforcement agency in a different state, or a law
315enforcement agency in a different country; and
316(ii) defines the scope and purpose of the joint task force or investigative partnership;
317or
318(c) at the law enforcement agency's request:
319(i) from a federal law enforcement agency, a law enforcement agency in a different
320state, or a law enforcement agency in a different country; and
321(ii) if the procedures employed to obtain the electronic information or record by the
322law enforcement agency described in Subsection (1)(c)(i) comply with the level of
323legal process that is required under this chapter.
324   (2) Nothing in this chapter:
325(a) limits or affects the disclosure of public records under Title 63G, Chapter 2,
326Government Records Access and Management Act;
327(b) affects the rights of an employer under Subsection 34-48-202(1)(e) or an
328administrative rule adopted under Section 63A-16-205; or
329(c) limits the ability of a law enforcement agency to receive or use information, without
330a warrant or subpoena, from:
331(i) the National Center for Missing and Exploited Children under 18 U.S.C. Sec.
3322258A; or
333(ii) information publicly or otherwise legally accessible to a law enforcement agency
  - 10 -
 Enrolled Copy  H.B. 261
334without a warrant, subpoena, or court order, either for free or for a fee, from a
335third-party data aggregator.
336Section 6. Section 77-23c-105 is amended to read:
33777-23c-105 . Chapter is exclusive method of obtaining, using, copying, or
338  disclosing electronic information or records -- Exclusion of electronic information or
339  records obtained, used, copied, or disclosed in violation of this chapter.
340     [    All electronic ]
341  (1) A law enforcement agency may only obtain, use, copy, disclose, or otherwise access
342      electronic information or a record described in this chapter if the law enforcement
343      agency has:
344      (a) complied with the applicable procedures and requirements provided under this
345chapter; or
346      (b) obtained the electronic information or record under an exception described in Section
34777-23c-104.1.
348  (2) Except as provided in Section 77-23c-104.1, a law enforcement agency may not
349      approach, solicit, direct, or contract with or otherwise use a third party, including a
350      federal agency, an agency in a different state, or an agency in a different country, to
351      obtain, use, copy, disclose, or otherwise access electronic information or a record
352      described in this chapter:
353      (a) in a manner that the law enforcement agency would be prohibited from doing
354directly under this chapter; or
355      (b) in an attempt to circumvent or subvert the requirements of this chapter.
356  (3)(a) Electronic information [or data and records of a provider of an electronic
357      communications service or remote computing service pertaining to a subscriber or
358      customer] or records described in this chapter that are obtained, used, copied,
359      disclosed, or otherwise accessed in violation of the provisions of this chapter shall be
360      subject to the rules governing exclusion as if the electronic information or records
361      were obtained, used, copied, disclosed, or otherwise accessed in violation of the
362      Fourth Amendment to the United States Constitution and Utah Constitution, Article I,
363      Section 14.
364      (b) Evidence derived from electronic information or records described in Subsection
365(3)(a) shall be subject to the rules governing exclusion as if the evidence were
366obtained, used, copied, disclosed, or otherwise accessed in violation of the Fourth
367Amendment to the United States Constitution and Utah Constitution, Article I,
  - 11 -
 H.B. 261  Enrolled Copy
368Section 14.
369Section 7. Effective Date.
370   This bill takes effect on May 6, 2026.
  - 12 -