- Gov. Cox signed Utah's App Store Accountability Act requiring Apple and Google to verify age and secure parental consent.
- Apple and Google opposed the bill, saying it requires them to share private user information with app creators who don't need it.
- SB142 is one of two first-in-the-nation bills that Cox said he hopes other states will also pass into law.
Utah reasserted its place at the tip of the spear in the battle against Big Tech this legislative session with a pair of pioneering bills aimed at protecting parental consent and user data.
Gov. Spencer Cox signed the state’s first-in-the-nation App Store Accountability Act into law on Wednesday and signed the state’s similarly unprecedented Data Sharing Amendments law on Thursday.
Critics of the proposals predict they will end up in the same place as Utah’s earlier efforts in 2023 and 2024 to mandate social media safety features for minors, which courts have paused out of constitutional concerns.
Advocates argue that the Beehive State’s latest attempt to rein in software giants is lawsuit-proof because of its focus on contracts instead of content. The new laws, they say, will give Utahns important tools to prevent exploitation at the hands of companies that profit from private information and unhealthy screen time.
Parent permission on app stores
SB142, App Store Accountability Act, mirrors legislation introduced by Utah Sen. Mike Lee at the federal level that was proposed by a coalition of child protection groups led by Utahn Melissa McKay.
The new law will require app stores to verify whether a user is an adult, using the same information required to set up an app store account. Minor accounts must be affiliated with a parent account and will be placed in one of three age categories: child (under 13), younger teenager (13-16) or older teenager (16-18).
App stores will be required to obtain verifiable parental consent if a minor attempts to download an app or make an in-app purchase. The consent process must inform parents of the app’s age rating and a description of how the app will use and protect their child’s information.
“This was kind of a radical new concept,” McKay said in an interview with the Deseret News. “It took us a long time to realize it doesn’t matter what we do as a coalition ... these companies aren’t fixing themselves.”
Under the new law, app developers will be required to verify a user’s age category and parental consent status with app stores once a year or whenever the app’s terms of use agreement is updated.
The law also creates a new right of action for parents of harmed minors to sue app stores or developers if they violate these provisions by enforcing contracts against minors without parental consent, by misrepresenting the app when asking for consent or by sharing personal age verification data inappropriately.
“While we need to embrace technology as part of our future and as something important in our society, we also need to protect children,” said Aimee Winder Newton, director of Utah’s Office of Families, in an interview with the Deseret News. “And that’s what’s so great about Utah, is we recognize that protecting children is No. 1.”
Pushback from Google and Apple
During the 2025 legislative session, the bill received the support of app developers, like Meta, Snap Inc. and X, who were happy to see the responsibility for verifying identity moved to one central location and called for other states to implement Utah’s solution.
“Parents want a one-stop-shop to oversee and approve the many apps their teens want to download,” the three companies said in a joint statement. “This approach spares users from repeatedly submitting personal information to countless individual apps and online services.”
But the country’s main app store companies, Apple and Google, were strongly against the bill and put forward their own proposals that would have made age verification between stores and developers optional.
In a blog post following the bill’s passage, Google’s public policy director, Kareem Ghanem, said the bill introduced new privacy risks for minors by informing every developer of users’ ages without parents’ permission.
Meanwhile, Apple also suggested that Utah’s law forced app stores to unnecessarily collect and distribute “sensitive personally identifying information.”
Caden Rosenbaum, a senior policy analyst at the Utah-based Libertas Institute, told the Deseret News that the bill simply recodified current contract law while potentially compromising internet anonymity and expanding government interference in the private sector and in the home.
“In an ideal world, the government would not be in the business of parenting. I think that is the fundamental disagreement here,” Rosenbaum said. “There are relevant issues that we need to discuss and we shouldn’t be just throwing spaghetti at the wall and seeing what sticks when it comes to the way that we do it.”
While Rosenbaum questioned the bill’s ability to survive constitutional scrutiny, the sponsor of the legislation, state Sen. Todd Weiler, R-Woods Cross, said he doesn’t expect the law to receive the same fate as the state’s previous attempts to regulate minors’ experience on social media.
Unlike those policies, SB142 is difficult to attack on First Amendment grounds, Weiler said. But the bill was given a delayed implementation date of May 6, 2026, to give the social media companies “time to react.”
Several other states, including Texas, are likely to pass legislation based on Utah’s this year and could receive legal challenges first because of earlier implementation dates.
Data control on social media
On the final night of the legislative session, Cox praised Weiler’s bill while also giving recognition to HB418, sponsored by Rep. Doug Fiefia, R-Herriman.
“This was a top priority of our administration,” Cox said. “I can’t underscore how big this is; I don’t think people really understand what this could do if we could get it done in other states and as a nation.”
HB418, Data Sharing Amendments, reaffirms an individual’s right to control the data social media companies collect on them by requiring companies to provide or delete this data upon request.
It will also mandate that social media companies remove barriers that prevent users from sharing their own data, like followers, posts and messages, from one platform to another to prevent companies from guarding user data.
Once signed, the law will require social media companies to develop “accessible, prominent, and persistent” methods for getting consent to share personal data with any third-party. The Division of Consumer Protection will be empowered to fine bad actors up to $2,500 for each violation or to bring a legal motion to enforce the law.
“This bill isn’t about punishing businesses, but it does challenge exploitative business models that rely on unchecked data harvesting,” Fiefia told the Deseret News. “There are still plenty of sustainable, responsible ways to innovate and succeed without compromising individual rights.”
Fiefia worked with many of the same stakeholders as Weiler, he said, but, like Weiler, Fiefia said he did not see a compromise path forward to implement these protections voluntarily. HB418 also has a delayed implementation date, taking effect July 1, 2026, to give developers time to update their platforms and to suggest tweaks to lawmakers.
Fiefia plans to convene with legislators from across the country later this year to share best practices as multiple states, leaning Republican and Democrat, have expressed interest in copying Utah’s legislation, Fiefia said, adding that he has not heard of any legal action being taken in response to the bill.
For countless Utah parents, legislative efforts to hold social media accountable are “very encouraging,” according to Jenna Baker, a Heber City resident studying for a master’s in public health.
As the mother of four children between 7 and 16, Baker said watching the impact of social media on the country’s youngest and most vulnerable has been “heart-wrenching.”
“It’s so disheartening because I wonder how many tragedies could have been avoided if we would have had this conversation 15 years prior,” Baker said.
Baker said she hopes the new laws are just the beginning for public policy that seeks to help parents manage a problem that looks much more like a public health crisis than a moral panic over new technology.
While the responsibility for a child’s experience on a phone ultimately comes down to the parent, Baker said that additional tools to level the playing field with huge corporations are long overdue.
“It’s now like, how do we pick up the pieces and move forward so that our youth have a brighter and more healthy future?” Baker said.