On Thursday, Utah Governor Spencer Cox passed new legislation that curtails the use of social media for Utah residents under the age of 18.

The most important takeaways from the two bills (collectively known as the “Social Media Regulation Act”) Cox signed into law are:

1. Social media companies must obtain the consent of a parent or guardian before children can sign up for social media accounts.
2. Children are prohibited from using social media between the hours of 10:30 PM and 6:30 AM.
3. Age verification is required for anyone who wants to use social media in the state.
4. Social media companies are required to prohibit or limit certain elements for accounts held by children (including prohibiting direct messaging with certain accounts, not showing the child’s account in search results, not displaying advertising, not targeting/suggesting ads, accounts, or content, and not collecting/sharing/using personal information from the account, subject to certain exceptions).
5. Social media companies are prohibited from using design features that “cause[] a minor to have an addiction to the company’s social media platform”

The law is set to go into effect as of March 1, 2024, but Cox has already acknowledged there may be potential issues surrounding enforcement. On NBC’s Meet the Press on Sunday, Cox said that the state is going to work with social media companies over the next year to figure out what enforcement is going to look like, but that “we don’t think it’s going to be foolproof, there’s no question about that.”

These Utah bills follow California passing the Age-Appropriate Design Code Act (“AADC”), which is modeled after the UK’s own Age-Appropriate Design Code (the “Children’s Code”). Notably, Utah requires parental consent for children to create social media accounts, whereas the California AADC does not contemplate parental consent. However, both California and Utah define “children” as users under the age of 18, an important departure from the previous threshold of under 13 years old established under the federal Children’s Online Privacy Protection Act (“COPPA”).

Additionally, Utah’s new social media bills appear to indicate a growing trend in requiring age verification (or, at the very least, more robust age assurances) to access certain online features. Such age assurances likely extend well beyond standard self-reporting (commonly referred to as “age-gating”).

As Cox mentioned, enforcement may be challenging – though companies that operate any online services or features should begin thinking about how they may enable age verifications, such as by collecting identifications of users or through automated means.