Utah

Plain:Assign an age rating to the app and notify the app store of a significant change to the app.

Engineering:Publish age-rating metadata to the store; emit a significant-change notification on the events HB 498 enumerates (new data collection, a shift in age rating, or newly added in-app purchases or advertising).

Statute’s own ages: Age categories: child (under 13), younger teenager (13-15), older teenager (16-17), adult (18+).

Plain:Before a Utah minor uses the app, obtain the user's age category and, for minors, verifiable parental consent through the app store's data-sharing method.

Engineering:At account setup / first launch, request the store-provided age-category signal for Utah users; for minor categories, gate use on the store-relayed verifiable-parental-consent signal before enabling the account.

Statute’s own ages: Minor categories: child (under 13), younger teenager (13-15), older teenager (16-17).

Plain:Use the age-category data received from the app store only to enforce age-related restrictions, comply with law, or implement safety features.

Engineering:Constrain downstream use of the store-provided age-category signal to the three enumerated purposes; do not repurpose it for profiling, advertising, or other secondary uses.

Plain:Operate an age-assurance system that determines whether an account holder is a minor using measures reasonably calculated to reach an accuracy rate of at least 95%.

Engineering:Run age assurance on account holders to classify minors (under 18) at a stated >=95% accuracy target, rather than collecting hard identity documents. Provision preliminarily enjoined, not operative.

Statute’s own ages: Distinguishes minors (under 18) from adults; no finer statutory age cut for the assurance duty.

Plain:Apply protective default settings to minor accounts: restricting account and post visibility and searchability to connected accounts, disabling search-engine indexing, limiting direct messaging to connected accounts, and limiting collection and sale of a minor's data to what a core function requires.

Engineering:Ship minor accounts with maximum-privacy defaults (connections-only visibility/messaging, no search indexing, minimized data collection/sale); block the minor from loosening these defaults absent verifiable parental consent. Provision preliminarily enjoined, not operative.

Statute’s own ages: Applies to minor account holders (under 18).

Plain:Refrain from deploying specified engagement-driving design features on minor accounts, including autoplay, seamless (infinite-scroll) pagination, and push notifications.

Engineering:Disable autoplay, infinite/seamless feeds, and push notifications for accounts assured as minors. This design-feature restriction is the provision NetChoice's Tenth Circuit appeal centers on. Provision preliminarily enjoined, not operative.

Statute’s own ages: Applies to minor account holders (under 18).

Plain:Provide verifiable parental-consent mechanisms and supervisory tools; a minor may not change the protective default data-privacy settings unless the company first obtains verifiable parental consent.

Engineering:Gate any relaxation of a minor's default privacy settings on a verifiable parental-consent flow, and expose parental supervisory tooling. Provision preliminarily enjoined, not operative.

Statute’s own ages: Applies to minor account holders (under 18).