HB 438

03-05 19:35  5th Sub. (Salmon) H.B. 438
                       Kirk A. Cullimore proposes the following substitute bill:
1Artificial Intelligence Amendments
                                       2026 GENERAL SESSION
                                             STATE OF UTAH
                                       Chief Sponsor: Doug Fiefia
                                   Senate Sponsor: Kirk A. Cullimore
2
3   LONG TITLE
4   General Description:
5This bill enacts the Companion Chatbot Safety Act to regulate operators of companion
6   chatbots and protect consumers.
7   Highlighted Provisions:
8This bill:
9▸ defines terms;
10▸ requires operators of companion chatbots to comply with the Utah Consumer Privacy
11   Act;
12▸ establishes disclosure and data protection requirements for operators;
13▸ establishes additional safety requirements for operators serving minor users;
14▸ authorizes rulemaking for age assurance standards;
15▸ requires annual reporting by operators to the Office of Artificial Intelligence Policy;
16▸ grants enforcement authority to the Division of Consumer Protection;
17▸ provides for administrative fines and civil penalties;
                                                                                                    5th Sub. H.B. 438
18▸ establishes a safe harbor provision for operators;
19▸ requires the Office of Artificial Intelligence Policy to study and report on companion
20   chatbot safety standards; and
21▸ provides a severability clause.
22   Money Appropriated in this Bill:
23None
24   Other Special Clauses:
25This bill provides a special effective date.
26   Utah Code Sections Affected:
27   AMENDS:
2813-2-1 [(Effective 07/01/26) ] (Effective 08/01/26), as last amended by Laws of Utah 2025,
5th Sub. (Salmon) H.B. 438  03-05 19:35
29Chapter 468
3013-61-101 (Effective 08/01/26), as last amended by Laws of Utah 2024, Chapter 186
3113-61-102 (Effective 08/01/26), as last amended by Laws of Utah 2024, Chapter 381
32   ENACTS:
3313-72b-101 (Effective 08/01/26), Utah Code Annotated 1953
3413-72b-201 (Effective 08/01/26), Utah Code Annotated 1953
3513-72b-202 (Effective 08/01/26), Utah Code Annotated 1953
3613-72b-301 (Effective 08/01/26), Utah Code Annotated 1953
3713-72b-302 (Effective 08/01/26), Utah Code Annotated 1953
3813-72b-303 (Effective 08/01/26), Utah Code Annotated 1953
3913-72b-401 (Effective 08/01/26), Utah Code Annotated 1953
4013-72b-402 (Effective 08/01/26), Utah Code Annotated 1953
4113-72b-501 (Effective 08/01/26), Utah Code Annotated 1953
42
43   Be it enacted by the Legislature of the state of Utah:
44Section 1. Section 13-2-1 is amended to read:
4513-2-1 [(Effective 07/01/26) ] (Effective 08/01/26). Consumer protection division
46   established -- Functions.
47   (1) There is established within the Department of Commerce the Division of Consumer
48Protection.
49   (2) The division shall administer and enforce the following:
50(a) Chapter 10a, Music Licensing Practices Act;
51(b) Chapter 11, Utah Consumer Sales Practices Act;
52(c) Chapter 15, Business Opportunity Disclosure Act;
53(d) Chapter 20, New Motor Vehicle Warranties Act;
54(e) Chapter 21, Credit Services Organizations Act;
55(f) Chapter 22, Charitable Solicitations Act;
56(g) Chapter 23, Health Spa Services Protection Act;
57(h) Chapter 25a, Telephone and Facsimile Solicitation Act;
58(i) Chapter 26, Telephone Fraud Prevention Act;
59(j) Chapter 28, Prize Notices Regulation Act;
60(k) Chapter 32a, Pawnshop, Secondhand Merchandise, and Catalytic Converter
61Transaction Information Act;
62(l) Chapter 34, Utah Postsecondary School and State Authorization Act;
                                                -2-
03-05 19:35  5th Sub. (Salmon) H.B. 438
63      (m) Chapter 41, Price Controls During Emergencies Act;
64      (n) Chapter 42, Uniform Debt-Management Services Act;
65      (o) Chapter 49, Immigration Consultants Registration Act;
66      (p) Chapter 51, Transportation Network Company Registration Act;
67      (q) Chapter 52, Residential Solar Energy Consumer Protection Act;
68      (r) Chapter 53, Residential, Vocational [or] and Life Skills Program Act;
69      (s) Chapter 54, Ticket Website Sales Act;
70      (t) Chapter 56, Ticket Transferability Act;
71      (u) Chapter 57, Maintenance Funding Practices Act;
72      (v) Chapter 61, Utah Consumer Privacy Act;
73      (w) Chapter 64, Vehicle Value Protection Agreement Act;
74      (x) Chapter 65, Utah Commercial Email Act;
75      (y) Chapter 67, Online Dating Safety Act;
76      (z) Chapter 68, Lawyer Referral Consultants Registration Act;
77      (aa) Chapter 70, Automatic Renewal Contracts Act;
78      (bb) Chapter 71, Utah Minor Protection in Social Media Act;
79      (cc) Chapter 72a, Artificial Intelligence Applications Relating to Mental Health;
80      (dd) Chapter 72b, Companion Chatbot Safety Act;
81      [(dd)] (ee) Chapter 78, Earned Wage Access Services Act; and
82      [(ee)] (ff) Chapter 81, Utah Digital Choice Act.
83   (3) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
84      division may make rules to establish:
85      (a) a public list that identifies a person that:
86(i) violates a chapter described in Subsection (2);
87(ii) without proper legal justification, fails to comply with an order, subpoena,
88judgment, or other legal process issued by:
89(A) the division; or
90(B) a court of competent jurisdiction; or
91(iii) breaches a settlement agreement, stipulation, assurance of voluntary compliance,
92or similar instrument signed by the person and the division; and
93      (b) a process by which a person may be removed from the list the division establishes as
94described in Subsection (3)(a).
95Section 2. Section 13-61-101 is amended to read:
9613-61-101 (Effective 08/01/26). Definitions.
                                                 -3-
 5th Sub. (Salmon) H.B. 438  03-05 19:35
97      As used in this chapter:
98   (1) "Account" means the Consumer Privacy Restricted Account established in Section
9913-61-403.
100   (2) "Affiliate" means an entity that:
101(a) controls, is controlled by, or is under common control with another entity; or
102(b) shares common branding with another entity.
103   (3) "Aggregated data" means information that relates to a group or category of consumers:
104(a) from which individual consumer identities have been removed; and
105(b) that is not linked or reasonably linkable to any consumer.
106   (4) "Air carrier" means the same as that term is defined in 49 U.S.C. Sec. 40102.
107   (5) "Authenticate" means to use reasonable means to determine that a consumer's request to
108exercise the rights described in Section 13-61-201 is made by the consumer who is
109entitled to exercise those rights.
110   (6)(a) "Biometric data" means data generated by automatic measurements of an
111individual's unique biological characteristics.
112(b) "Biometric data" includes data described in Subsection (6)(a) that are generated by
113automatic measurements of an individual's fingerprint, voiceprint, eye retinas, irises,
114or any other unique biological pattern or characteristic that is used to identify a
115specific individual.
116(c) "Biometric data" does not include:
117(i) a physical or digital photograph;
118(ii) a video or audio recording;
119(iii) data generated from an item described in Subsection (6)(c)(i) or (ii);
120(iv) information captured from a patient in a health care setting; or
121(v) information collected, used, or stored for treatment, payment, or health care
122operations as those terms are defined in 45 C.F.R. Parts 160, 162, and 164.
123   (7) "Business associate" means the same as that term is defined in 45 C.F.R. Sec. 160.103.
124   (8) "Child" means an individual younger than 13 years old.
125   (9) "Companion chatbot operator" means the same as the term "operator" is defined in
126Section 13-72b-101.
127   [(9)] (10) "Consent" means an affirmative act by a consumer that unambiguously indicates
128the consumer's voluntary and informed agreement to allow a person to process personal
129data related to the consumer.
130   [(10)] (11)(a) "Consumer" means an individual who is a resident of the state acting in an
                                                   -4-
 03-05 19:35  5th Sub. (Salmon) H.B. 438
131individual or household context.
132(b) "Consumer" does not include an individual acting in an employment or commercial
133context.
134   [(11)] (12) "Control" or "controlled" as used in Subsection (2) means:
135(a) ownership of, or the power to vote, more than 50% of the outstanding shares of any
136class of voting securities of an entity;
137(b) control in any manner over the election of a majority of the directors or of the
138individuals exercising similar functions; or
139(c) the power to exercise controlling influence of the management of an entity.
140   [(12)] (13) "Controller" means a person doing business in the state who determines the
141purposes for which and the means by which personal data are processed, regardless of
142whether the person makes the determination alone or with others.
143   [(13)] (14) "Covered entity" means the same as that term is defined in 45 C.F.R. Sec.
144160.103.
145   [(14)] (15)(a) "Deidentified data" means data that:
146(i) cannot reasonably be linked to an identified individual or an identifiable
147individual; and
148(ii) are possessed by a controller who:
149(A) takes reasonable measures to ensure that a person cannot associate the data
150with an individual;
151(B) publicly commits to maintain and use the data only in deidentified form and
152not attempt to reidentify the data; and
153(C) contractually obligates any recipients of the data to comply with the
154requirements described in [Subsections (14)(b)(i) and (ii)] this Subsection
155(15)(a).
156(b) "Deidentified data" includes synthetic data.
157   [(15)] (16) "Director" means the director of the Division of Consumer Protection.
158   [(16)] (17) "Division" means the Division of Consumer Protection created in Section 13-2-1.
159   [(17)] (18) "Governmental entity" means the same as that term is defined in Section
16063G-2-103.
161   [(18)] (19) "Health care facility" means the same as that term is defined in Section
16226B-2-201.
163   [(19)] (20) "Health care provider" means the same as that term is defined in Section
16478B-3-403.
                                                   -5-
 5th Sub. (Salmon) H.B. 438  03-05 19:35
165   [(20)] (21) "Identifiable individual" means an individual who can be readily identified,
166directly or indirectly.
167   [(21)] (22) "Institution of higher education" means a public or private institution of higher
168education.
169   [(22)] (23) "Local political subdivision" means the same as that term is defined in Section
17011-14-102.
171   [(23)] (24) "Nonprofit corporation" means:
172(a) the same as that term is defined in Section 16-6a-102; or
173(b) a foreign nonprofit corporation as defined in Section 16-6a-102.
174   [(24)] (25)(a) "Personal data" means information that is linked or reasonably linkable to
175an identified individual or an identifiable individual.
176(b) "Personal data" does not include deidentified data, aggregated data, or publicly
177available information.
178   [(25)] (26) "Process" means an operation or set of operations performed on personal data,
179including collection, use, storage, disclosure, analysis, deletion, or modification of
180personal data.
181   [(26)] (27) "Processor" means a person who processes personal data on behalf of a
182controller.
183   [(27)] (28) "Protected health information" means the same as that term is defined in 45
184C.F.R. Sec. 160.103.
185   [(28)] (29) "Pseudonymous data" means personal data that cannot be attributed to a specific
186individual without the use of additional information, if the additional information is:
187(a) kept separate from the consumer's personal data; and
188(b) subject to appropriate technical and organizational measures to ensure that the
189personal data are not attributable to an identified individual or an identifiable
190individual.
191   [(29)] (30) "Publicly available information" means information that a person:
192(a) lawfully obtains from a record of a governmental entity;
193(b) reasonably believes a consumer or widely distributed media has lawfully made
194available to the general public; or
195(c) if the consumer has not restricted the information to a specific audience, obtains from
196a person to whom the consumer disclosed the information.
197   [(30)] (31) "Right" means a consumer right described in Section 13-61-201.
198   [(31)] (32)(a) "Sale," "sell," or "sold" means the exchange of personal data for monetary
                                                  -6-
 03-05 19:35  5th Sub. (Salmon) H.B. 438
199consideration by a controller to a third party.
200(b) "Sale," "sell," or "sold" does not include:
201(i) a controller's disclosure of personal data to a processor who processes the personal
202data on behalf of the controller;
203(ii) a controller's disclosure of personal data to an affiliate of the controller;
204(iii) considering the context in which the consumer provided the personal data to the
205controller, a controller's disclosure of personal data to a third party if the purpose
206is consistent with a consumer's reasonable expectations;
207(iv) the disclosure or transfer of personal data when a consumer directs a controller to:
208(A) disclose the personal data; or
209(B) interact with one or more third parties;
210(v) a consumer's disclosure of personal data to a third party for the purpose of
211providing a product or service requested by the consumer or a parent or legal
212guardian of a child;
213(vi) the disclosure of information that the consumer:
214(A) intentionally makes available to the general public via a channel of mass
215media; and
216(B) does not restrict to a specific audience; or
217(vii) a controller's transfer of personal data to a third party as an asset that is part of a
218proposed or actual merger, an acquisition, or a bankruptcy in which the third party
219assumes control of all or part of the controller's assets.
220   [(32)] (33)(a) "Sensitive data" means:
221(i) personal data that reveals:
222(A) an individual's racial or ethnic origin;
223(B) an individual's religious beliefs;
224(C) an individual's sexual orientation;
225(D) an individual's citizenship or immigration status; or
226(E) information regarding an individual's medical history, mental or physical
227health condition, or medical treatment or diagnosis by a health care
228professional;
229(ii) the processing of genetic personal data or biometric data, if the processing is for
230the purpose of identifying a specific individual; or
231(iii) specific geolocation data.
232(b) "Sensitive data" does not include personal data that reveals an individual's:
                                                   -7-
 5th Sub. (Salmon) H.B. 438  03-05 19:35
233(i) racial or ethnic origin, if the personal data are processed by a video
234communication service; or
235(ii) if the personal data are processed by a person licensed to provide health care
236under Title 26B, Chapter 2, Part 2, Health Care Facility Licensing and Inspection,
237or Title 58, Occupations and Professions, information regarding an individual's
238medical history, mental or physical health condition, or medical treatment or
239diagnosis by a health care professional.
240   [(33)] (34)(a) "Specific geolocation data" means information derived from technology,
241including global position system level latitude and longitude coordinates, that directly
242identifies an individual's specific location, accurate within a radius of 1,750 feet or
243less.
244(b) "Specific geolocation data" does not include:
245(i) the content of a communication; or
246(ii) any data generated by or connected to advanced utility metering infrastructure
247systems or equipment for use by a utility.
248   [(34)] (35) "Synthetic data" means data that has been generated by computer algorithms or
249statistical models and does not contain personal data.
250   [(35)] (36)(a) "Targeted advertising" means displaying an advertisement to a consumer
251where the advertisement is selected based on personal data obtained from the
252consumer's activities over time and across nonaffiliated websites or online
253applications to predict the consumer's preferences or interests.
254(b) "Targeted advertising" does not include advertising:
255(i) based on a consumer's activities within a controller's website or online application
256or any affiliated website or online application;
257(ii) based on the context of a consumer's current search query or visit to a website or
258online application;
259(iii) directed to a consumer in response to the consumer's request for information,
260product, a service, or feedback; or
261(iv) processing personal data solely to measure or report advertising:
262(A) performance;
263(B) reach; or
264(C) frequency.
265   [(36)] (37) "Third party" means a person other than:
266(a) the consumer, controller, or processor; or
                                                  -8-
 03-05 19:35  5th Sub. (Salmon) H.B. 438
267(b) an affiliate or contractor of the controller or the processor.
268   [(37)] (38) "Trade secret" means information, including a formula, pattern, compilation,
269program, device, method, technique, or process, that:
270(a) derives independent economic value, actual or potential, from not being generally
271known to, and not being readily ascertainable by proper means by, other persons who
272can obtain economic value from the information's disclosure or use; and
273(b) is the subject of efforts that are reasonable under the circumstances to maintain the
274information's secrecy.
275Section 3. Section 13-61-102 is amended to read:
27613-61-102 (Effective 08/01/26). Applicability.
277   (1) This chapter applies to:
278(a) [ ]any controller or processor who:
279[(a)] (i)[(i)] (A) conducts business in the state; or
280[(ii)] (B) produces a product or service that is targeted to consumers who are
281residents of the state;
282[(b)] (ii) has annual revenue of $25,000,000 or more; and
283[(c)] (iii) satisfies one or more of the following thresholds:
284[(i)] (A) during a calendar year, controls or processes personal data of 100,000 or
285more consumers; or
286[(ii)] (B) derives over 50% of the entity's gross revenue from the sale of personal
287data and controls or processes personal data of 25,000 or more consumers[.] ; or
288(b) a companion chatbot operator.
289   (2) This chapter does not apply to:
290(a) a governmental entity or a third party under contract with a governmental entity
291when the third party is acting on behalf of the governmental entity;
292(b) a tribe;
293(c) an institution of higher education;
294(d) a nonprofit corporation;
295(e) a covered entity;
296(f) a business associate;
297(g) information that meets the definition of:
298(i) protected health information for purposes of the federal Health Insurance
299Portability and Accountability Act of 1996, 42 U.S.C. Sec. 1320d et seq., and
300related regulations;
                                                  -9-
 5th Sub. (Salmon) H.B. 438  03-05 19:35
301(ii) patient identifying information for purposes of 42 C.F.R. Part 2;
302(iii) identifiable private information for purposes of the Federal Policy for the
303Protection of Human Subjects, 45 C.F.R. Part 46;
304(iv) identifiable private information or personal data collected as part of human
305subjects research [pursuant to] in accordance with or under the same standards as:
306(A) the good clinical practice guidelines issued by the International Council for
307Harmonisation; or
308(B) the Protection of Human Subjects under 21 C.F.R. Part 50 and Institutional
309Review Boards under 21 C.F.R. Part 56;
310(v) personal data used or shared in research conducted in accordance with one or
311more of the requirements described in Subsection (2)(g)(iv);
312(vi) information and documents created specifically for, and collected and maintained
313by, a committee but not a board or council listed in Section 26B-1-204;
314(vii) information and documents created for purposes of the federal Health Care
315Quality Improvement Act of 1986, 42 U.S.C. Sec. 11101 et seq., and related
316regulations;
317(viii) patient safety work product for purposes of 42 C.F.R. Part 3; or
318(ix) information that is:
319(A) deidentified in accordance with the requirements for deidentification set forth
320in 45 C.F.R. Part 164; and
321(B) derived from any of the health care-related information listed in this
322Subsection (2)(g);
323      (h) information originating from, and intermingled to be indistinguishable with,
324information under Subsection (2)(g) that is maintained by:
325(i) a health care facility or health care provider; or
326(ii) a program or a qualified service organization as defined in 42 C.F.R. Sec. 2.11;
327      (i) information used only for public health activities and purposes as described in 45
328C.F.R. Sec. 164.512;
329      (j)(i) an activity by:
330(A) a consumer reporting agency, as defined in 15 U.S.C. Sec. 1681a;
331(B) a furnisher of information, as set forth in 15 U.S.C. Sec. 1681s-2, who
332provides information for use in a consumer report, as defined in 15 U.S.C. Sec.
3331681a; or
334(C) a user of a consumer report, as set forth in 15 U.S.C. Sec. 1681b;
                                                - 10 -
 03-05 19:35  5th Sub. (Salmon) H.B. 438
335(ii) subject to regulation under the federal Fair Credit Reporting Act, 15 U.S.C. Sec.
3361681 et seq.; and
337(iii) involving the collection, maintenance, disclosure, sale, communication, or use of
338any personal data bearing on a consumer's:
339(A) credit worthiness;
340(B) credit standing;
341(C) credit capacity;
342(D) character;
343(E) general reputation;
344(F) personal characteristics; or
345(G) mode of living;
346(k) a financial institution or an affiliate of a financial institution governed by, or personal
347data collected, processed, sold, or disclosed in accordance with, Title V of the
348Gramm-Leach-Bliley Act, 15 U.S.C. Sec. 6801 et seq., and related regulations;
349(l) personal data collected, processed, sold, or disclosed in accordance with the federal
350Driver's Privacy Protection Act of 1994, 18 U.S.C. Sec. 2721 et seq.;
351(m) personal data regulated by the federal Family Education Rights and Privacy Act, 20
352U.S.C. Sec. 1232g, and related regulations;
353(n) personal data collected, processed, sold, or disclosed in accordance with the federal
354Farm Credit Act of 1971, 12 U.S.C. Sec. 2001 et seq.;
355(o) data that are processed or maintained:
356(i) in the course of an individual applying to, being employed by, or acting as an
357agent or independent contractor of a controller, processor, or third party, to the
358extent the collection and use of the data are related to the individual's role;
359(ii) as the emergency contact information of an individual described in Subsection
360(2)(o)(i) and used for emergency contact purposes; or
361(iii) to administer benefits for another individual relating to an individual described in
362Subsection (2)(o)(i) and used for the purpose of administering the benefits;
363(p) an individual's processing of personal data for purely personal or household
364purposes; or
365(q) an air carrier.
366   (3) A controller is in compliance with any obligation to obtain parental consent under this
367chapter if the controller complies with the verifiable parental consent mechanisms under
368the Children's Online Privacy Protection Act, 15 U.S.C. Sec. 6501 et seq., and the act's
                                                   - 11 -
 5th Sub. (Salmon) H.B. 438  03-05 19:35
369implementing regulations and exemptions.
370   (4) This chapter does not require a person to take any action in conflict with the federal
371Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. Sec. 1320d et
372seq., or related regulations.
373Section 4. Section 13-72b-101 is enacted to read:
374CHAPTER 72b. Companion Chatbot Safety Act
375Part 1. General Provisions
37613-72b-101 (Effective 08/01/26). Definitions.
377   (1) "Advertisement" means content, a communication, or a digital display provided through
378a companion chatbot's interface that:
379(a) promotes the availability, quality, or purchase of a specific product, service, or
380brand; and
381(b) is provided to the user in exchange for compensation from a third party.
382   (2)(a) "Affirmative consent" means a clear act signifying a user's freely given, specific,
383informed, and unambiguous authorization for an act or practice in response to a
384specific request from an operator, provided:
385(i) the request is clear, conspicuous, and written in easy-to-understand language;
386(ii) the option to refuse to give consent is at least as prominent as the option to give
387consent, and the option to refuse to give consent takes the same number of steps or
388fewer as the option to give consent; and
389(iii) affirmative consent to an act or practice is not inferred from the inaction of the
390user or the user's continued use of a companion chatbot.
391(b) "Affirmative consent" does not include:
392(i) acceptance of a general or broad terms of use or similar document;
393(ii) hovering over, muting, pausing, or closing a given piece of content; or
394(iii) an agreement obtained through the use of a false, fraudulent, or materially
395misleading statement or representation.
396   (3) "Application programming interface" means a set of protocols, tools, or specifications
397that allows software systems to communicate with one another and through which a
398third party may access, integrate, or build upon an artificial intelligence system's
399underlying capabilities.
400   (4) "Artificial intelligence" means the same as that term is defined in Section 13-72-101.
401   (5)(a) "Companion chatbot" means an artificial intelligence system that uses a natural
                                                 - 12 -
 03-05 19:35  5th Sub. (Salmon) H.B. 438
402language interface that:
403(i) is designed to use personal data retained, stored, or retrieved from a prior
404interaction and generate an output that:
405(A) simulates an ongoing relationship with the user; or
406(B) indicates the companion chatbot has emotions, feelings, memories, or personal
407opinions;
408(ii) is designed to generate an output containing an affective or social inquiry that:
409(A) is not logically required to resolve a user prompt or task-based command; or
410(B) prioritizes extension of the interaction over task resolution; and
411(iii) holds itself out as primarily useful for providing companionship or an ongoing
412social or emotional relationship with the user.
413(b) "Companion chatbot" does not include an artificial intelligence system that:
414(i) is deployed by a business, employer, or institution exclusively for internal
415operational purposes; or
416(ii) is marketed or offered exclusively to businesses, employers, or institutions or
417through an application programming interface.
418   (6) "Core functioning" means features and services for which the collection or processing
419of the user's personal data is reasonably necessary to provide the companion chatbot
420service to the user.
421   (7) "Division" means the Division of Consumer Protection created in Section 13-2-1.
422   (8) "Interaction" means a user input and a subsequent response by a companion chatbot.
423   (9) "Material harmful to minors" means the same as that term is defined in Section
42476-5c-101.
425   (10) "Minor" means an individual under 18 years old who:
426(a) has not been emancipated as that term is defined in Section 80-7-102; or
427(b) has not been married.
428   (11) "Office" means the Office of Artificial Intelligence Policy created in Section 13-72-201.
429   (12)(a) "Operator" means a person who:
430(i) makes a companion chatbot available to a user in the state; and
431(ii) exerts substantial control over the design, features, or content moderation policies
432of the companion chatbot.
433(b) "Operator" does not include a person who merely provides:
434(i) hosting or infrastructure services;
435(ii) cloud computing services; or
                                                 - 13 -
 5th Sub. (Salmon) H.B. 438  03-05 19:35
436(iii) application programming interface access used by another person to operate a
437companion chatbot.
438   (13) "Personal data" means the same as that term is defined in Section 13-61-101.
439   (14) "Sensitive data" means the same as that term is defined in Section 13-61-101.
440   (15) "Targeted advertising" means the same as that term is defined in Section 13-61-101.
441   (16) "User" means an individual who:
442(a) interacts with a companion chatbot; and
443(b) is a Utah resident.
444Section 5. Section 13-72b-201 is enacted to read:
445Part 2. Safety Requirements
44613-72b-201 (Effective 08/01/26). Safety requirements for users.
447   (1) An operator shall comply with the requirements of Chapter 61, Utah Consumer Privacy
448Act, including:
449(a) allowing a user to obtain a copy of the prompts provided to a companion chatbot that
450are retained by the operator in a format that is portable and readily usable in
451accordance with Section 13-61-201; and
452(b) complying with the requirements of Section 13-61-302 with respect to the processing
453of a user's sensitive data.
454   (2) An operator shall prevent the companion chatbot from engaging with a user unless:
455(a) the operator prevents the companion chatbot from generating responses that
456encourage suicidal ideation, suicide, self-harm, or harm to others; and
457(b) if the user expresses suicidal ideation, self-harm, or harm to others, the companion
458chatbot provides to the user resources including a referral to:
459(i) crisis service providers;
460(ii) a suicide hotline; or
461(iii) a crisis text line.
462   (3) An operator may not display an advertisement to a user, unless the operator clearly and
463conspicuously identifies the advertisement as an advertisement.
464Section 6. Section 13-72b-202 is enacted to read:
46513-72b-202 (Effective 08/01/26). Additional safety requirements for minor users.
466   (1) An operator shall, for a user who is a minor:
467(a) provide a clear and conspicuous notice to the user at least once every three hours
468during a continuing chatbot interaction that:
469(i) reminds the user to take a break from interacting with the companion chatbot; and
                                                 - 14 -
 03-05 19:35  5th Sub. (Salmon) H.B. 438
470(ii) states that the user is interacting with an artificial intelligence system, not a
471human; and
472(b) opt out, by default, the user from targeted advertising.
473   (2) An operator may not, for a user who is a minor:
474(a) produce, provide, or direct a user to material harmful to minors;
475(b) collect data from the user that is not required for core functioning of the companion
476chatbot;
477(c) sell a user's personal data;
478(d) direct targeted advertising to the user unless a parent or legal guardian of the user has
479provided affirmative consent; or
480(e) otherwise convey a user's personal data unless a parent or legal guardian of the user
481has provided affirmative consent, except as required for core functioning of the
482companion chatbot.
483   (3) An operator shall take reasonable and proportionate steps to prevent a companion
484chatbot from encouraging a user who is a minor to:
485(a) use illegal substances, alcohol, or a tobacco or nicotine product;
486(b) engage in sexual conduct;
487(c) engage in self-harm;
488(d) engage in illegal conduct;
489(e) engage in behaviors that promote eating disorders, disordered eating behaviors, or
490extreme weight-loss practices; or
491(f) engage in activities that are lawful for adults but pose a material risk of serious harm
492to a minor, including age-restricted challenges, stunts, or risky behaviors.
493   (4) An operator that makes a companion chatbot available to a user who is a minor shall:
494(a) offer a parent or legal guardian of the user accessible tools to:
495(i) control whether the companion chatbot retains data from prior interactions with
496the user;
497(ii) control whether the user's personal data is used to train the companion chatbot;
498(iii) set time limits on the user's interactions with the companion chatbot; and
499(iv) disable the user's access to the companion chatbot;
500(b) take reasonable steps to ensure that a parent or legal guardian of the user is aware of
501the tools described in Subsection (4)(a), including through direct communications
502reasonably calculated to reach a parent or legal guardian; and
503(c) provide timely notice to a parent or legal guardian of the user if the user modifies or
                                                  - 15 -
 5th Sub. (Salmon) H.B. 438  03-05 19:35
504disables a setting previously configured by the parent or legal guardian under
505Subsection (4)(a).
506   (5) The requirements of this section are in addition to the requirements of Section
50713-72b-201.
508Section 7. Section 13-72b-301 is enacted to read:
509Part 3. Rulemaking and Reporting
51013-72b-301 (Effective 08/01/26). Division rulemaking.
511      In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
512   division may make rules establishing reasonable age assurance standards that an operator may
513   meet to qualify for the safe harbor described in Section 13-72b-402, including standards for:
514   (1) third-party age assurance services;
515   (2) protecting user privacy and data security;
516   (3) verifying the reliability and accuracy of age assurance methods; and
517   (4) retaining, protecting, and securely disposing of any information obtained as a result of
518age assurance.
519Section 8. Section 13-72b-302 is enacted to read:
52013-72b-302 (Effective 08/01/26). Office rulemaking and reporting.
521   (1) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
522office may make rules establishing the form of the report required in Section 13-72b-303.
523   (2) The office shall study and report to the Business and Labor Interim Committee at the
524November 2026 interim meeting on standards relating to:
525(a) design features that prevent a companion chatbot from engaging in or reciprocating
526user attempts to establish a relationship;
527(b) measures or methods to limit a user's emotional and social attachment to a
528companion chatbot; and
529(c) measures and processes to reduce mental and physical risk to a user.
530Section 9. Section 13-72b-303 is enacted to read:
53113-72b-303 (Effective 08/01/26). Reporting requirements.
532   (1) An operator shall annually report to the office:
533(a) the number of times the operator has issued a crisis service provider referral
534notification in accordance with Section 13-72b-201 in the preceding calendar year;
535(b) methods the operator has implemented to detect, remove, and respond to expressions
536of suicidal ideation, suicide, or self-harm by users; and
537(c) methods the operator has implemented to prevent a companion chatbot from
                                                 - 16 -
 03-05 19:35  5th Sub. (Salmon) H.B. 438
538generating responses that encourage suicidal ideation, suicide, or self-harm.
539   (2) The report required by this section may not include a user's personal data.
540Section 10. Section 13-72b-401 is enacted to read:
541Part 4. Enforcement and Safe Harbor
54213-72b-401 (Effective 08/01/26). Enforcement.
543   (1) The division shall administer and enforce the provisions of this chapter in accordance
544with Chapter 2, Division of Consumer Protection.
545   (2) The division may coordinate with the office to investigate and enforce violations of this
546chapter.
547   (3) In addition to the division's enforcement powers under Chapter 2, Division of Consumer
548Protection:
549(a) the division director may impose an administrative fine of up to $2,500 for each
550violation of this chapter; and
551(b) the division may bring an action in a court of competent jurisdiction to enforce a
552provision of this chapter.
553   (4) In a court action by the division to enforce a provision of this chapter, the court may:
554(a) declare that an act or practice violates a provision of this chapter;
555(b) issue an injunction for a violation of this chapter;
556(c) order disgorgement of money received in violation of this chapter;
557(d) order payment of disgorged money to an injured purchaser or consumer;
558(e) impose a fine of up to $2,500 for each violation of this chapter; or
559(f) award other relief that the court determines reasonable and necessary.
560   (5) If a court awards judgment or injunctive relief to the division, the court shall award the
561division:
562(a) reasonable attorney fees;
563(b) court costs; and
564(c) investigative fees.
565   (6) A court may impose a civil penalty of no more than $50,000 for each violation of an
566administrative or court order issued for a violation of this chapter.
567   (7) A civil penalty authorized under this section may be imposed in a civil action.
568   (8) The division shall deposit all fines and civil penalties collected under this section into
569the Consumer Protection Education and Training Fund created in Section 13-2-8.
570   (9) Nothing in this chapter displaces any other available remedy or right authorized under
571the laws of this state or the United States.
                                                  - 17 -
 5th Sub. (Salmon) H.B. 438  03-05 19:35
572Section 11. Section 13-72b-402 is enacted to read:
57313-72b-402 (Effective 08/01/26). Safe harbor.
574   (1) An operator bears the burden of demonstrating by clear and convincing evidence that
575the operator qualifies for the safe harbor described in this section.
576   (2) An operator is not liable for a violation of Section 13-72b-202 if the operator uses an
577age assurance method that meets the standards established by division rule made in
578accordance with Section 13-72b-301.
579Section 12. Section 13-72b-501 is enacted to read:
580Part 5. Severability
58113-72b-501 (Effective 08/01/26). Severability.
582   (1) If any provision of this chapter, or the application of any provision to any person or
583circumstance, is held invalid by a final decision of a court of competent jurisdiction, the
584remainder of this chapter shall be given effect without the invalid provision or
585application.
586   (2) The provisions of this chapter are severable.
587Section 13. Effective Date.
588   This bill takes effect on August 1, 2026.
                                                 - 18 -