In a sweeping legislative session, Utah Governor Spencer Cox signed multiple bills advancing the state’s regulatory framework for artificial intelligence (AI), consumer data protection, and digital privacy. The package of laws positions Utah as a potential national leader in AI oversight while balancing innovation with public safety and transparency.
Among the most prominent is the “Artificial Intelligence Consumer Protection Amendments (S.B. 226),” which establishes new guardrails for generative AI in consumer transactions. Effective May 2025, the law requires AI developers and deployers to disclose when generative AI is used in high-risk scenarios—such as hiring or healthcare—and subjects violations to civil penalties of up to $5,000 per incident. The legislation also extends the repeal date of the state’s Artificial Intelligence Policy Act to July 2027, ensuring oversight remains in place while Utah continues to refine its AI governance strategy.
In another major move, Cox signed “H.B. 418, the Utah Digital Choice Act,” granting consumers enhanced rights over their personal data. The act, which takes effect in July 2026, mandates that users can access, delete, correct, and port their personal data—including their social graphs—across digital platforms. It also compels social media services to adopt open protocol standards to facilitate interoperability and user control.
Mental health also factored into the AI agenda with “H.B. 452,” creating a new legal framework for AI technologies that interact with users in therapeutic or emotional contexts. The law prohibits the use of generative AI in mental health applications unless explicit privacy and transparency standards are met. Companies must disclose AI usage and cannot replace licensed mental health professionals with AI systems, even in digital therapeutic contexts.
On privacy more broadly, “H.B. 444” amends data governance statutes to increase protections against unauthorized access to personal information and repeals outdated provisions. It reinforces access restrictions and clarifies how courts, law enforcement, and public institutions can handle sensitive digital data.
Together, these bills reflect Utah’s proactive approach in responding to the rapid advancement of AI and data-driven technologies, as well as its affects on privacy. While business groups have expressed concern about potential regulatory burdens, especially for startups, state lawmakers argue that these measures are essential to protecting residents from algorithmic discrimination, data exploitation, and digital deception.
Need Help?
If you have questions or concerns about any Utah, U.S. or global AI laws, reports, guidelines, and regulations, don’t hesitate to reach out to BABL AI. Their Audit Experts can offer valuable insight, and ensure you’re informed and compliant.
