Electronic Information Privacy Act Amendments, the official text

Electronic Information Privacy Act Amendments
2026 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Jason B. Kyle
Senate Sponsor: Todd Weiler

LONG TITLE
General Description:
This bill amends the Electronic Information Privacy Act.
Highlighted Provisions:
This bill: amends and clarifies definitions;
clarifies and amends procedures and requirements for a law enforcement agency that seeks to obtain, use, copy, or disclose certain electronic information or records;
revises liability provisions for a provider of an electronic communication service or a remote computing service;
provides that the procedures and requirements described in the Electronic Information Privacy Act (act) are the only permissible methods for a law enforcement agency to obtain, use, copy, disclose, or otherwise access certain electronic information or records, with certain exceptions;
prohibits a law enforcement agency from contracting with or otherwise using a third party to obtain, use, copy, disclose, or otherwise access certain electronic information or records in a manner that the law enforcement agency would be prohibited from doing directly, with certain exceptions;
provides that electronic information or records obtained in violation of the act, as well as any evidence derived from the electronic information or records, are subject to the same rules governing exclusion of evidence obtained in violation of constitutional requirements; and
makes technical and conforming changes.

Money Appropriated in this Bill: None Other Special Clauses: None Utah Code Sections Affected: AMENDS:
77-23c-101.2, as last amended by Laws of Utah 2023, Chapter 382
77-23c-102, as last amended by Laws of Utah 2023, Chapters 382, 514
77-23c-103, as last amended by Laws of Utah 2023, Chapter 382
77-23c-104, as last amended by Laws of Utah 2023, Chapter 382
77-23c-105, as enacted by Laws of Utah 2019, Chapter 362

ENACTS:
77-23c-104.1, Utah Code Annotated 1953

Be it enacted by the Legislature of the state of Utah:
Section 1. Section 77-23c-101.2 is amended to read:
77-23c-101.2. Definitions.
As used in this chapter: (1) "Electronic communication service" means a service that provides to users of the service the ability to send or receive wire or electronic communications.
(2) "Electronic device" means a device that enables access to or use of an electronic communication service, remote computing service, or location information service.
(3) (a) "Electronic information" means information or data including a sign, signal, writing, image, sound, or intelligence of any nature transmitted or stored in whole or in part by a wire, radio, electromagnetic, photoelectronic, or photooptical system.
(b) "Electronic information" includes the location information, stored data, or transmitted data of an electronic device.
(c) "Electronic information" does not include: (i) a wire or oral communication;
(ii) a communication made through a tone-only paging device; or
(iii) electronic funds transfer information stored by a financial institution in a communications system used for the electronic storage and transfer of money.

(4) "Law enforcement agency" means: (a) an entity of the state or a political subdivision of the state that exists to primarily prevent, detect, or prosecute crime and enforce criminal statutes or ordinances; or
(b) an individual or entity acting for or on behalf of an entity described in Subsection (4)(a).

(5) (a) "Location information" means information concerning the geographical location of an electronic device that, in whole or in part, is generated or derived from or obtained by the operation of an electronic device or the operation of a software application on an electronic device.
(b) "Location information" includes past, current, and future location information.

(6) "Location information service" means the provision of a global positioning service or other mapping, location, or directional information service.
(7) "Oral communication" means the same as that term is defined in Section 77-23a-3.
(8) "Remote computing service" means the provision to the public of computer storage or processing services by means of an electronic communications system.
(9) "Subscriber record" means a record or information that: (a) (i) is in the possession of a provider of an electronic communication service or a remote computing service;
(ii) is created or maintained by a provider of an electronic communication service or a remote computing service; or
(iii) is received from, or derived from, a record or information originally possessed, created, or maintained by a provider of an electronic communication service or a remote computing service; and

(b) reveals a subscriber's or customer's: (i) name;
(ii) address;
(iii) local or long distance telephone connection record, or record of session time and duration;
(iv) length of service, including the start date;
(v) type of service used;
(vi) telephone number, instrument number, or other subscriber or customer number or identification, including a temporarily assigned network address; or
(vii) means or source of payment to the electronic communication service or a remote computing service, including a credit card or bank account number.

[(9)] (10) "Transmitted data" means electronic information that is transmitted wirelessly: (a) from an electronic device to another electronic device without the use of an intermediate connection or relay; or
(b) from an electronic device to a nearby antenna or from a nearby antenna to an electronic device.

[(10)] (11) "Wire communication" means the same as that term is defined in Section 77-23a-3.

Section 2. Section 77-23c-102 is amended to read:
77-23c-102. Electronic information privacy -- Warrant required for disclosure.
(1) (a) Except as provided in Subsection (2) [or], (4), or Section 77-23c-104.1, and subject to Section 77-23c-105, for a criminal investigation or prosecution, a law enforcement agency may not obtain, [without] copy, or use the following information or data except through the use of a search warrant issued by a court upon probable cause: (i) the location information, stored data, or transmitted data of an electronic device; or
(ii) electronic information transmitted by the owner of the electronic information: (A) to a provider of a remote computing service; or
(B) through a provider of an electronic communication service.

(b) (i) Except as provided in Subsection (1)(b)(ii) and subject to Subsection (1)(c), [a] if a law enforcement agency, in response to a warrant obtained under Subsection (1)(a), obtains information or data described in Subsection (1)(a)(i) or (ii), the law enforcement agency may not use, copy, or disclose, for any purpose, [the location information, stored data, or transmitted data of an electronic device, or electronic information provided by a provider of a remote computing service or an electronic communication service,] any information or data described in Subsection (1)(a)(i) or (ii) that: [(i)] (A) is not the subject of the warrant obtained under Subsection (1)(a); and
[(ii)] (B) is collected as part of an effort to obtain the [location information, stored data, or transmitted data of an electronic device, or electronic information provided by a provider of a remote computing service or an electronic communication service] information or data described in Subsection (1)(a)(i) or (ii) that is the subject of the warrant [in] obtained under Subsection (1)(a).

[(c)] (ii) A law enforcement agency may use, copy, or disclose the transmitted data of an electronic device used to communicate with the electronic device that is the subject of the warrant if the law enforcement agency reasonably believes that the transmitted data is necessary to achieve the objective of the warrant.

[(d)] (c) The electronic information described in Subsection (1)(b) shall be destroyed in an unrecoverable manner by the law enforcement agency as soon as reasonably possible after the electronic information is collected.

(2) (a) [A] Except as provided in Subsection (2)(c) or Section 77-23c-104.1 and subject to Section 77-23c-105, a law enforcement agency may obtain location information without a warrant for an electronic device only: (i) in accordance with Section 53-10-104.5;
(ii) if the device is reported stolen by the owner;
(iii) with the informed, affirmative consent of the owner or user of the electronic device;
(iv) except for the automobile exception to the warrant requirement, in accordance with a judicially recognized exception to warrant requirements;
(v) if the owner has voluntarily and publicly disclosed the location information; or
(vi) from a provider of a remote computing service or an electronic communications service if the provider voluntarily discloses the location information: (A) under a belief that an emergency exists involving an imminent risk to an individual of death, serious physical injury, sexual abuse, live-streamed sexual exploitation, kidnapping, or human trafficking; or
(B) that is inadvertently discovered by the provider and appears to pertain to the commission of a felony, or of a misdemeanor involving physical violence, sexual abuse, or dishonesty.

(b) [A] Except as provided in Subsection (2)(c) or Section 77-23c-104.1 and subject to Section 77-23c-105, a law enforcement agency may obtain stored data or transmitted data from an electronic device or electronic information transmitted by the owner of the electronic information to a provider of a remote computing service or through a provider of an electronic communication service, without a warrant, only: (i) with the informed consent of the owner of the electronic device or electronic information;
(ii) except for the automobile exception to the warrant requirement, in accordance with a judicially recognized exception to warrant requirements; or
(iii) subject to Subsection (2)(a)(vi)(B), from a provider of a remote computing service or an electronic communication service if the provider voluntarily discloses the stored or transmitted data as otherwise permitted under 18 U.S.C. Sec. 2702.

(c) A prosecutor may obtain a judicial order as described in Section 77-22-2.5 for the purposes described in Section 77-22-2.5.

(3) A provider of an electronic communication service or a remote computing service, the provider's officers, employees, or agents, or other specified persons may not be held liable for [providing]information, facilities, or assistance provided in good faith reliance [on the terms of the warrant issued under this section or without a warrant in accordance with Subsection (2)] under this section.
[(4) Nothing in this chapter:] [(a) limits or affects the disclosure of public records under Title 63G, Chapter 2, Government Records Access and Management Act;]
[(b) affects the rights of an employer under Subsection 34-48-202(1)(e) or an administrative rule adopted under Section 63A-16-205; or]
[(c) limits the ability of a law enforcement agency to receive or use information, without a warrant or subpoena, from the National Center for Missing and Exploited Children under 18 U.S.C. Sec. 2258A.]

Section 3. Section 77-23c-103 is amended to read:
77-23c-103. Notification required -- Exceptions -- Delayed notification.
(1) (a) Except as provided in Subsection (1)(b) or (2), a law enforcement agency that executes a warrant under [Subsection 77-23c-102(1) or 77-23c-104(3)] Section 77-23c-102 or 77-23c-104 shall serve the owner of the electronic device or electronic information specified in the warrant with a notice described in Subsection (3): (i) within 90 days after the day on which the electronic device or the electronic information is obtained by the law enforcement agency but in no case more than three days after the day on which the investigation is concluded; or
(ii) if the owner of the electronic device or electronic information specified in the warrant is unknown to the law enforcement agency, within 90 days after the day on which the law enforcement agency identifies, or reasonably could identify, the owner.

(b) A law enforcement agency is not required to serve a notice described in Subsection (1)(a) to the owner of the electronic device or electronic information if the owner is located outside of the United States.

(2) (a) (i) A law enforcement agency seeking a warrant in accordance with [Subsection 77-23c-102(1)(a) or 77-23c-104(3)] Section 77-23c-102 or 77-23c-104 may submit a request, and the court may grant permission, to delay service of the notice required under Subsection (1) for a period not to exceed 30 days, if the court determines that there is reasonable cause to believe that the notification may: (A) endanger the life or physical safety of an individual;
(B) cause a person to flee from prosecution;
(C) lead to the destruction of or tampering with evidence;
(D) intimidate a potential witness; or
(E) otherwise seriously jeopardize an investigation or unduly delay a trial.

(ii) When a delay of notification is granted under Subsection (2)(a)(i) and upon application by the law enforcement agency, the court may grant additional extensions of up to 30 days each.

(b) (i) A law enforcement agency that seeks a warrant for an electronic device or electronic information in accordance with [Subsection 77-23c-102(1)(a) or 77-23c-104(3)] Section 77-23c-102 or 77-23c-104 may submit a request to the court, and the court may grant permission, to delay service of the notice required under Subsection (1), if the purpose of delaying the notification is to apprehend an individual: (A) who is a fugitive from justice under Section 77-30-13; and
(B) for whom an arrest warrant has been issued for a violent felony offense as defined in Section 76-3-203.5.

(ii) (A) The court may grant the request under Subsection (2)(b)(i) to delay notification until the individual who is a fugitive from justice under Section 77-30-13 is apprehended by the law enforcement agency.
(B) A law enforcement agency shall serve the notice required under Subsection (1) to the owner of the electronic device or electronic information within 14 days after the day on which the law enforcement agency apprehends the individual described in Subsection (2)(b)(i).

(3) A notice required under Subsection (1) shall include: (a) a copy of the warrant; and
(b) a written statement identifying: (i) the offense specified in the warrant application;
(ii) the identity of the law enforcement agency that filed the application;
(iii) the date on which the electronic information was obtained; and
(iv) the number and length of any authorized delays in serving the notice required under Subsection (1), including, if applicable, the name of the court that authorized the delay and a reference to the provision of this chapter that permitted the delay.

(4) A law enforcement agency shall serve the notice required under Subsection (1) to the owner of the electronic device or electronic information by: (a) personal service on the owner;
(b) first-class mail to the owner's last-known address; or
(c) other reasonable means if the owner's last-known address is unknown.

Section 4. Section 77-23c-104 is amended to read:
77-23c-104. Third-party electronic information and records.
[(1) As used in this section, "subscriber record" means a record or information of a provider of an electronic communication service or remote computing service that reveals the subscriber's or customer's:] [(a) name;]
[(b) address;]
[(c) local and long distance telephone connection record, or record of session time and duration;]
[(d) length of service, including the start date;]
[(e) type of service used;]
[(f) telephone number, instrument number, or other subscriber or customer number or identification, including a temporarily assigned network address; and]
[(g) means and source of payment for the service, including a credit card or bank account number.]

[(2)] (1) Except as provided in [Chapter 22, Subpoena Powers for Aid of Criminal Investigation and Grants of Immunity or Section 77-23f-105,] Subsection (2) or Section 77-22-2.5 or 77-23c-104.1, and subject to Section 77-23c-105, a law enforcement agency may not, except through the use of a search warrant issued by a court upon probable cause, obtain, use, copy, or disclose[]: (a) a subscriber record[.]; or
[(3)] (b) [A law enforcement agency may not obtain, use, copy, or disclose,]for a criminal investigation or prosecution, any record or information related to a subscriber or a customer, other than a subscriber record, [of a] that is: (i) in the possession of a provider of an electronic communication service or a remote computing service[related to a subscriber or customer without a warrant.];
(ii) created or maintained by a provider of an electronic communication service or a remote computing service; or
(iii) received from, or derived from, a record or information originally possessed, created, or maintained by a provider of an electronic communication service or a remote computing service.

[(4)] (2) [Notwithstanding Subsections (2) and (3), a] Except as provided in Section 77-23c-104.1 and subject to Section 77-23c-105, a law enforcement agency may obtain, use, copy, or disclose a subscriber record, or other record or information related to a subscriber or customer described in Subsection (1)(b), without an investigative subpoena or a warrant, only: (a) with the informed, affirmed consent of the subscriber or customer;
(b) in accordance with a judicially recognized exception to warrant requirements;
(c) if the subscriber or customer voluntarily discloses the record in a manner that is publicly accessible; or
(d) if the provider of an electronic communication service or remote computing service voluntarily discloses the record: (i) under a belief that an emergency exists involving the imminent risk to an individual of: (A) death;
(B) serious physical injury;
(C) sexual abuse;
(D) live-streamed sexual exploitation;
(E) kidnapping; or
(F) human trafficking;

(ii) that is inadvertently discovered by the provider, if the record appears to pertain to the commission of: (A) a felony; or
(B) a misdemeanor involving physical violence, sexual abuse, or dishonesty; or

(iii) subject to Subsection [77-23c-104(4)(d)(ii)] (2)(d)(ii), as otherwise permitted under 18 U.S.C. Sec. 2702.

[(5)] (3) A provider of an electronic communication service or remote computing service, or the provider's officers, employees, agents, or other specified persons may not be held liable for [providing]information, facilities, or assistance provided in good faith reliance [on the terms of a warrant issued under this section, or without a warrant in accordance with Subsection (3)] under this section.

Section 5. Section 77-23c-104.1 is enacted to read:
77-23c-104.1. Exceptions from chapter requirements.
(1) A law enforcement agency may obtain, use, copy, disclose, or otherwise access electronic information or a record described in this chapter without complying with the requirements and procedures described in this chapter if the law enforcement agency obtains the electronic information or record: (a) (i) from a federal law enforcement agency, a law enforcement agency in a different state, or a law enforcement agency in a different country; and
(ii) the law enforcement agency described in Subsection (1)(a)(i) obtained the electronic information or record: (A) in a legal manner under the constitutional requirements and any applicable laws, rules, and procedures of that jurisdiction; and
(B) as part of an investigation of conduct that was occurring in that jurisdiction or of a person over which the law enforcement agency had jurisdiction;

(b) as part of a written interagency agreement that: (i) establishes a joint task force or investigative partnership with a federal law enforcement agency, a law enforcement agency in a different state, or a law enforcement agency in a different country; and
(ii) defines the scope and purpose of the joint task force or investigative partnership; or

(c) at the law enforcement agency's request: (i) from a federal law enforcement agency, a law enforcement agency in a different state, or a law enforcement agency in a different country; and
(ii) if the procedures employed to obtain the electronic information or record by the law enforcement agency described in Subsection (1)(c)(i) comply with the level of legal process that is required under this chapter.

(2) Nothing in this chapter: (a) limits or affects the disclosure of public records under Title 63G, Chapter 2, Government Records Access and Management Act;
(b) affects the rights of an employer under Subsection 34-48-202(1)(e) or an administrative rule adopted under Section 63A-16-205; or
(c) limits the ability of a law enforcement agency to receive or use information, without a warrant or subpoena, from: (i) the National Center for Missing and Exploited Children under 18 U.S.C. Sec. 2258A; or
(ii) information publicly or otherwise legally accessible to a law enforcement agency without a warrant, subpoena, or court order, either for free or for a fee, from a third-party data aggregator.

Section 6. Section 77-23c-105 is amended to read:
77-23c-105. Chapter is exclusive method of obtaining, using, copying, or disclosing electronic information or records -- Exclusion of electronic information or records obtained, used, copied, or disclosed in violation of this chapter.
[All electronic] (1) A law enforcement agency may only obtain, use, copy, disclose, or otherwise access electronic information or a record described in this chapter if the law enforcement agency has: (a) complied with the applicable procedures and requirements provided under this chapter; or
(b) obtained the electronic information or record under an exception described in Section 77-23c-104.1.

(2) Except as provided in Section 77-23c-104.1, a law enforcement agency may not approach, solicit, direct, or contract with or otherwise use a third party, including a federal agency, an agency in a different state, or an agency in a different country, to obtain, use, copy, disclose, or otherwise access electronic information or a record described in this chapter: (a) in a manner that the law enforcement agency would be prohibited from doing directly under this chapter; or
(b) in an attempt to circumvent or subvert the requirements of this chapter.

(3) (a) Electronic information [or data and records of a provider of an electronic communications service or remote computing service pertaining to a subscriber or customer] or records described in this chapter that are obtained, used, copied, disclosed, or otherwise accessed in violation of the provisions of this chapter shall be subject to the rules governing exclusion as if the electronic information or records were obtained, used, copied, disclosed, or otherwise accessed in violation of the Fourth Amendment to the United States Constitution and Utah Constitution, Article I, Section 14.
(b) Evidence derived from electronic information or records described in Subsection (3)(a) shall be subject to the rules governing exclusion as if the evidence were obtained, used, copied, disclosed, or otherwise accessed in violation of the Fourth Amendment to the United States Constitution and Utah Constitution, Article I, Section 14.

Section 7. Effective Date.
This bill takes effect on May 6, 2026.

3-11-26 11:09 AM