Data Sharing Amendments

35
13-81-101
13-81-102
13-81-201
13-81-202
13-81-301
13-81-401
26
27
Data Sharing Amendments
2026 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Doug Fiefia
Senate Sponsor: Michael K. McKell

Cosponsor:
Jason E. Thompson
David Shallenberger
LONG TITLE
General Description:
This bill modifies provisions related to social media data portability and interoperability.
Highlighted Provisions:
This bill:
allows users to select portions of their social media data to transfer;
requires social media platforms to share user data in real time when users move to other
platforms;
requires consent from users before their comments or interactions can be included when
others transfer data;
clarifies when users must give permission for their data to be shared; and
protects social media companies from penalties for temporary technical problems if they
make good faith efforts to fix them.
Money Appropriated in this Bill:
None
Other Special Clauses:
This bill provides a special effective date.
Utah Code Sections Affected:
AMENDS:
13-81-101
Effective
07/01/27
, as enacted by Laws of Utah 2025, Chapter 468
13-81-102
Effective
07/01/27
, as enacted by Laws of Utah 2025, Chapter 468
13-81-201
Effective
07/01/27
, as enacted by Laws of Utah 2025, Chapter 468
13-81-202
Effective
07/01/27
, as enacted by Laws of Utah 2025, Chapter 468
13-81-301
Effective
07/01/27
, as enacted by Laws of Utah 2025, Chapter 468
13-81-401
Effective
07/01/27
, as enacted by Laws of Utah 2025, Chapter 468
Be it enacted by the Legislature of the state of Utah:
Section 1. Section
13-81-101
is amended to read:
13-81-101
Effective
07/01/26
Effective
07/01/27
. Definitions.
As used in this chapter:
(1)
"Open protocol" means a publicly available technical standard that:
(a)
enables interoperability and data exchange between social media services by
providing a common data infrastructure where multiple social media services can
access
, contribute to, and synchronize
a user's personal data;
(b)
is free from:
(i)
licensing fees; and
(ii)
patent restrictions; and
(c)
governs how social media services communicate and exchange data with each other.
(2)
(a)
"Personal data" means the same as that term is defined in Section
13-61-101
.
(b)
"Personal data" includes a user's social graph.
(3)
(a)
"Social graph" means data
, or a user-selected portion of data,
that represents a
person's connections and interactions within a social media service.
(b)
"Social graph" includes:
(i)
the person's social connections with other users;
(ii)
content created by the person;
(iii)
the person's responses to other users' content, including comments, reactions,
and
mentions, reposts,
shares
, and other engagements
;
(iv)
other users' responses to the person's content; and
(v)
(iv)
metadata associated with the items described in Subsections
(3)(b)(i)

through
(iv)
.
(iii); and
(v)
relational references sufficient to maintain the associations among data elements
described in Subsections
(3)(b)(i)
through (iii).
(c)
"Social graph" does not include another user's or an entity's content and responses
that have been designated private by those users and entities, including private
messages.
(4)
"Social media company" means an entity that owns or operates a social media service.
(5)
(a)
"Social media service" means a public website or application that:
(i)
displays content that is primarily generated by account holders and not by the
social media company;
(ii)
permits an individual to register as an account holder and create a profile that is
made visible to the general public or a set of other users defined by the account
holder;
(iii)
connects account holders to allow users to interact socially with each other
within the website or application;
(iv)
makes available to each account holder a list or lists of other account holders
with whom the account holder shares a connection within the system;
and
(iv)
(v)
allows account holders to post content viewable by other users.
(b)
"Social media service" does not include:
(i)
email;
(ii)
cloud storage; or
(iii)
document viewing, sharing, or collaboration services.
(6)
"User" means an individual located in the state who accesses or uses a social media
service.
Section 2. Section
13-81-102
is amended to read:
13-81-102
Effective
07/01/26
Effective
07/01/27
. Legislative findings.
The Legislature finds that:
(1)
an individual has a right to control and move the individual's own personal data,
including social interactions online;
(2)
companies have demonstrated a pattern of restricting the interoperability of content,
preventing users from easily sharing posts and interactions across different platforms
,
reducing effective consumer choice, and stifling market competition
; and
(3)
the state should ensure that individuals have the right to access a complete personal data
record
in a portable format
from social media platforms.
Section 3. Section
13-81-201
is amended to read:
13-81-201
Effective
07/01/26
Effective
07/01/27
. Data portability
requirements.
If a consumer requests a copy of the consumer's personal data under Section
13-61-201
, a
social media service shall
within five business days
provide the personal data, including the
user's social graph, in a format that:
(1)
is portable, to the extent technically feasible;
(2)
is readily usable, to the extent practicable; and
(3)
allows the consumer to transmit the data to another controller without impediment if the
controller processes the data by automated means.
Section 4. Section
13-81-202
is amended to read:
13-81-202
Effective
07/01/26
Effective
07/01/27
. Data interoperability
requirements.
(1)
A social media company shall implement a transparent, third-party-accessible
interoperability interface or interfaces to allow users to choose to:
(a)
share a common set of the user's personal data
or a user-selected part of the user's
personal data
between the social media services designated by the user; and
(b)
enable third parties to access
content
personal data
created by the user and to be
notified when new or updated
content
personal data
is available, with the user's
permission.
(2)
A social media company shall reasonably secure all personal data obtained through an
interoperability interface.
(3)
To achieve interoperability under Subsection
(1)
, a social media company shall:
(a)
utilize an open protocol;
(b)
facilitate and maintain interoperability and
synchronous
continuous, real-time
data
sharing with other social media services through an interoperability interface, based
on reasonable terms that do not discriminate between social media services;
(c)
establish reasonable and proportionate thresholds related to the frequency, nature,
and volume of requests, beyond which the social media company may assess a
reasonable fee for such access;
and
(d)
offer to other social media companies a functionally equivalent version of any
internal interfaces created by the social media company for the social media
company's own social media services; and
(e)
(d)
disclose to other social media companies complete, accurate, and regularly
updated documentation describing access to the interoperability interface required
under this section.
(4)
A social media company shall publicly disclose the open protocol that the social media
company intends to use for purposes of Subsection
(3)(a)
.
(4)
(5)
A social media company or third party shall safeguard the privacy and security of a
user's personal data obtained from other social media services through the
interoperability interface in accordance with the social media company's or third party's
privacy notice and administrative, technical, and physical data security practices.
(5)
(6)
A social media company or third party may not share or receive a user's personal
data through the interoperability interface except with the user's consent
, including when
a user's personal data is intended to be shared in response to another user's request to
share a social graph
.
(6)
(7)
(a)
A social media company shall adopt an accessible, prominent, and persistent
method for users to give consent for data sharing with other social media services or
third parties through the interoperability interface.
(b)
The method described in Subsection
(7)(a)
shall allow users to provide consent:
(i)
when the user initiates a transfer of the user's own personal data; and
(ii)
before the user's personal data is shared as part of another user's social graph.
(c)
A social media company shall implement the user's consent decisions within five
business days.
(7)
(8)
A social media company is not required to:
(a)
provide access to:
(i)
inferences, analyses, or derived data that the social media company has generated
internally about a user; or
(ii)
proprietary algorithms, ranking systems, or other internal operating mechanisms;
or
(b)
transmit personal data that:
(i)
is stored or structured in a proprietary format; and
(ii)
meets both of the following criteria:
(A)
no open, industry-standard format is reasonably available; and
(B)
transmitting the data would disclose information described in Subsection
(7)(a)
(8)(a)
.
(8)
(9)
This chapter does not apply to an entity that is:
(a)
owned, controlled, operated, or maintained by a religious organization; and
(b)
exempt from property taxation under state law.
Section 5. Section
13-81-301
is amended to read:
13-81-301
Effective
07/01/27
. Rulemaking authority -- Rebuttable presumption
-- Safe harbor.
(1)
The division may identify open protocols that the division has determined, after an
assessment, meet the requirements of Section
13-81-202
.
(2)
If a social media company uses an open protocol that the division identifies under
Subsection
(1)
, the social media company shall be entitled to a rebuttable presumption of
providing access on reasonable terms that do not discriminate between social media
services.
(3)
A social media company does not violate Section
13-81-202
for a temporary loss of
continuous real-time data sharing if the social media company demonstrates that:
(a)
the social media company made good faith efforts to maintain continuous real-time
data sharing; and
(b)
the social media company took reasonable steps to restore data sharing as soon as
practicable.
(4)
Nothing in this chapter shall be construed to require a social media company to receive
data through an interoperability interface.
Section 6. Section
13-81-401
is amended to read:
13-81-401
Effective
07/01/26
Effective
07/01/27
. Severability.
(1)
If any provision of this chapter or the application of any provision to any person or
circumstance is held invalid by a final decision of a court of competent jurisdiction, the
remainder of this chapter shall be given effect without the invalid provision or
application.
(2)
The provisions of this chapter are severable.
Section 7.
Effective Date.
This bill takes effect on
July 1, 2027
.
3-6-26 11:42 PM