Utah Digital Choice Act Takes Effect: Data Portability Rules

Utah Digital Choice Act Takes Effect: Data Portability and Interoperability Rules for Social Media

Utah's Digital Choice Act is now in force. Enacted by HB 418 (2025 General Session) and codified at Utah Code Title 13, Chapter 81, the law requires large social media companies serving Utah residents to let users export their data and move it to other platforms. Most provisions took effect July 1, 2026.

Information last verified on July 2, 2026. This is a developing story; we update it as the record changes.

Status: Signed into law (2025 session); most provisions effective July 1, 2026.

Jurisdiction scope: This law is Utah-specific and does not create rights in other states. For how other jurisdictions handle these questions, see our overview of state data privacy laws.

What Happened

The Utah Legislature passed HB 418, titled "Data Sharing Amendments," during the 2025 General Session. Governor Spencer Cox signed it on March 27, 2025, and it drew broad bipartisan support in the House. The bill did two distinct things in one package.

First, it created the Utah Digital Choice Act, a new chapter of Utah law codified at Utah Code Title 13, Chapter 81. Second, it amended the existing Utah Consumer Privacy Act (UCPA) to add a consumer right to correct inaccurate personal data. Most provisions of both parts took effect July 1, 2026.

The Digital Choice Act targets social media companies that operate a social media service for Utah residents. The statute defines a social media service broadly as a public website or application that displays content account holders generate, lets people register and create a profile, and connects account holders to interact socially. There is no strict user-count threshold in the definition, so applicability turns on factors like the platform's Utah user base and whether it markets to Utah residents.

The Utah Division of Consumer Protection administers and enforces the Act. It can impose administrative fines up to $2,500 per violation and bring court actions seeking additional penalties, injunctions, and other remedies. The Division also received rulemaking authority to identify open protocols that satisfy the interoperability requirement.

What the Law Actually Says

The Digital Choice Act rests on two obligations: portability and interoperability. They are related but not the same.

Portability means a user can request and receive a copy of their personal data. That includes their social graph, meaning their connections and interactions, along with content they created. The company must provide the data in a format that is as portable and readily usable as is technically and practically feasible, so the user can transmit it to another platform.

Interoperability goes further than a one-time download. The Act requires covered companies to implement a transparent, third-party-accessible interoperability interface built on open protocols. With the user's consent, that interface lets users share a common set of their personal data between platforms and lets approved third parties access content the user created. The statute does not mandate one specific protocol, but it requires that the standard be open and accessible. Companies that adopt an open protocol the Division identifies get a rebuttable presumption that they provided access on reasonable, nondiscriminatory terms.

The Act sets limits. It does not require a company to hand over inferences, analyses, or derived data the company generated internally about a user, nor its proprietary algorithms or ranking systems. When an open format is not reasonably available, it does not force transmission in a proprietary format.

Separately, HB 418 amended the UCPA to add a right to correct. Utah consumers can now ask a controller to correct inaccuracies in their personal data, taking into account the nature of the data and the purposes of processing. Businesses generally have 45 days to respond to a correction request. This brings Utah closer to the consumer-rights baseline in most other state privacy laws. For background on Utah's underlying framework, see our guide to Utah's consumer privacy law and the specific UCPA consumer rights that were already on the books. Utah's portability and interoperability mandate reaches further than the access and deletion rights in laws like California's CCPA, which focus on access, deletion, and opt-out rather than compelled cross-platform transfer.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

Most US state privacy laws give consumers a right to access and delete their data and to opt out of certain uses. The Utah Digital Choice Act adds a different idea: the right to take your data and your connections with you, and to keep moving them in near real time. Supporters, including Governor Cox and advocacy groups, have described it as a first-in-the-nation approach to compelled social-media portability and interoperability.

That framing matters because portability without interoperability can be a dead end. A one-time export file is useful, but it does not help much if no other service can ingest it or if your connections do not follow. By pairing a portability right with an open-protocol interoperability interface, the Act aims at lowering the switching costs that keep users locked into a single platform.

The statute's carve-outs are just as important as its mandates. By excluding inferences, derived data, proprietary algorithms, and ranking systems, the law separates a user's own content and social graph from the internal models a company builds. The rebuttable presumption for Division-identified open protocols also signals that Utah wants to steer the market toward common standards rather than litigate each interface case by case. How the Division writes those rules will shape what compliance actually looks like.

We are not predicting how enforcement or any future dispute will resolve. Those outcomes depend on the Division's rulemaking, company implementation choices, and any court review that follows.

How This Affects You

If you use social media and live in Utah, the Act is designed to give you more control over your own content and connections. In practice, that means you should be able to request a portable copy of your data and, over time, use interoperability tools to move or share it with other services after you consent. The right to correct also lets you ask companies to fix inaccurate personal data, generally within 45 days.

If you operate a social media platform that serves Utah residents, the Act creates concrete obligations around portability, interoperability interfaces, and open protocols, enforced by the Division of Consumer Protection. Businesses subject to the UCPA also need a process to handle correction requests within the response window. This is general information, not a compliance opinion for any specific company, and the Division's rulemaking will fill in operational detail.

This is general legal information, not legal advice. It covers Utah law and reflects sources verified on July 2, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Sources

• H.B. 418 Data Sharing Amendments, Utah Legislature (2025 General Session)
• Utah Code Title 13, Chapter 81, Utah Digital Choice Act (effective July 1, 2026)
• Governor Cox Signs the Utah Digital Choice Act (press release, PR Newswire)
• Utah Digital Choice Act: Reshaping Social Media, Harvard Ash Center
• Why Utah's Digital Choice Act Will Reshape Social Media, Project Liberty

Related articles

• Utah data privacy laws (UCPA overview)
• UCPA consumer rights
• California data privacy laws (CCPA comparison)
• State data privacy laws hub

Last updated: 2026-07-02. This is a developing story; details verified as of 2026-07-02.