Utah Governor Spencer J. Cox signed three state AI bills into law that took effect May 7, 2025. These laws require businesses to make “you’re talking to a bot” disclosures and comply with privacy requirements when using AI in connection with consumer transactions, mental health chatbots, and certain content used for advertising, fundraising or endorsements.
- SB 226 narrows the focus of Utah’s current AI-disclosure requirements.
- HB 452 applies disclosure and privacy requirements specific to businesses that provide AI mental health chatbots.
- SB 271 expands existing law that prohibits the unauthorized use of an individual’s personal identity, including through the use of generative-AI, in advertisements, fundraising and endorsements.
SB 226: Artificial Intelligence Consumer Protection Amendments
Utah previously passed an AI disclosure law, which required businesses to provide a “reactive” you-are-talking-to-AI disclosure to inform users they were interacting with generative AI – but only when the AI tool was asked by the consumer. It also required a “proactive” disclosure at the beginning of an AI interaction in certain regulated industries, such as pharmaceutical and financial services.
Previously, the reactive disclosure applied broadly to entities conducting business activities in Utah, including business-to-business interactions and employee engagements. Businesses must now comply during consumer transactions, defined to include transactions related to consumers’ first-time, personal participation in business opportunities. The law explicitly excludes the sale of securities and insurance.
SB 226 further limits proactive disclosures to now only apply when users engage in “high-risk artificial intelligence interactions,” where professionals collect sensitive information such as health, financial, biometric information, or give recommendations or advice that users may rely on for significant decisions, such as the provision of financial, legal or medical services.
Businesses that violate the law may be subject to a maximum civil penalty of $2,500 per violation under SB 226 in addition to civil penalties and administrative fines under the Utah Consumer Sales Practice Act and the Consumer Protection statute.
SB 226 provides a safe harbor for businesses if the generative AI discloses that it is generative AI, not a human or is an AI assistant both at the outset of and throughout the interaction.
HB 452: Artificial Intelligence Applications Relating to Mental Health
HB 452 applies to suppliers of mental health chatbots that use generative AI. It requires similar disclosures to those in SB 226 but includes additional data protection requirements and restrictions on advertising.
Businesses must clearly and conspicuously disclose that users are interacting with AI before the user can access the chatbot, after seven days without using the chatbot, and whenever asked by the user. Businesses cannot share or sell individually identifiable health information or user input with any third party, except as necessary for the chatbot’s function, or to health providers with user consent and provided they abide by HIPAA.
Further, any advertisements delivered through the chatbot must be disclosed, and no user input can be used to decide whether to advertise to the user or to customize an advertisement.
Businesses that violate the law may be subject to a maximum civil penalty of $2,500 per violation under HB 452 in addition to civil penalties and administrative fines under the Utah Consumer Sales Practice Act and the Consumer Protection statute.
SB 271: Unauthorized AI Impersonation
Utah’s Abuse of Personal Identity Act prohibits using an individual’s personal identity to imply endorsement or approval of the subject of the advertisement, without that individual’s consent.
SB 271 expands the definition of personal identity from name, title, picture and portrait to include video likeness, voice, and audiovisual appearance and the imitation of any of these categories through generative AI and other technological means. Businesses are prohibited from using any content containing the personal identity of an individual, without that individual’s consent, for advertising, fundraising, soliciting donations or the purchase of products or services if the use implies endorsement, creates a likelihood of confusion that the individual is associated with the business, or creates a false impression the individual participated in the content.
Individuals whose personal identity is abused can sue for damages from those who directed the content to be published, the publishers themselves in certain circumstances, and those who distribute, sell, or license any software whose intended primary purpose is to use an individual’s personal identity in the prohibited ways. Abuse of personal identity in an advertisement may also be a class B misdemeanor.
We will continue to track legislative and regulatory developments related to AI. Contact us for more information, including on our multidisciplinary approach to AI counseling.
