Data Sharing Amendments, the official text

Data Sharing Amendments
2026 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Doug Fiefia
Senate Sponsor: Michael K. McKell
Cosponsor: Jason E. Thompson David Shallenberger
LONG TITLE
General Description:
This bill modifies provisions related to social media data portability and interoperability.
Highlighted Provisions:
This bill: allows users to select portions of their social media data to transfer;
requires social media platforms to share user data in real time when users move to other platforms;
requires consent from users before their comments or interactions can be included when others transfer data;
clarifies when users must give permission for their data to be shared; and
protects social media companies from penalties for temporary technical problems if they make good faith efforts to fix them.

Money Appropriated in this Bill: None Other Special Clauses: This bill provides a special effective date. Utah Code Sections Affected: AMENDS:
13-81-101 Effective 07/01/27, as enacted by Laws of Utah 2025, Chapter 468
13-81-102 Effective 07/01/27, as enacted by Laws of Utah 2025, Chapter 468
13-81-201 Effective 07/01/27, as enacted by Laws of Utah 2025, Chapter 468
13-81-202 Effective 07/01/27, as enacted by Laws of Utah 2025, Chapter 468
13-81-301 Effective 07/01/27, as enacted by Laws of Utah 2025, Chapter 468
13-81-401 Effective 07/01/27, as enacted by Laws of Utah 2025, Chapter 468

Be it enacted by the Legislature of the state of Utah:
Section 1. Section 13-81-101 is amended to read:
13-81-101 [Effective 07/01/26] Effective 07/01/27. Definitions.
As used in this chapter: (1) "Open protocol" means a publicly available technical standard that: (a) enables interoperability and data exchange between social media services by providing a common data infrastructure where multiple social media services can access[, contribute to, and synchronize] a user's personal data;
(b) is free from: (i) licensing fees; and
(ii) patent restrictions; and

(c) governs how social media services communicate and exchange data with each other.

(2) (a) "Personal data" means the same as that term is defined in Section 13-61-101.
(b) "Personal data" includes a user's social graph.

(3) (a) "Social graph" means data, or a user-selected portion of data, that represents a person's connections and interactions within a social media service.
(b) "Social graph" includes: (i) the person's social connections with other users;
(ii) content created by the person;
(iii) the person's responses to other users' content, including comments, reactions, [and] mentions, reposts, shares, and other engagements;
[(iv) other users' responses to the person's content; and]
[(v)] (iv) metadata associated with the items described in Subsections (3)(b)(i) through [(iv).] (iii); and
(v) relational references sufficient to maintain the associations among data elements described in Subsections (3)(b)(i) through (iii).

(c) "Social graph" does not include another user's or an entity's content and responses that have been designated private by those users and entities, including private messages.

(4) "Social media company" means an entity that owns or operates a social media service.
(5) (a) "Social media service" means a public website or application that: (i) displays content that is primarily generated by account holders and not by the social media company;
(ii) permits an individual to register as an account holder and create a profile that is made visible to the general public or a set of other users defined by the account holder;
(iii) connects account holders to allow users to interact socially with each other within the website or application;
(iv) makes available to each account holder a list or lists of other account holders with whom the account holder shares a connection within the system; and
[(iv)] (v) allows account holders to post content viewable by other users.

(b) "Social media service" does not include: (i) email;
(ii) cloud storage; or
(iii) document viewing, sharing, or collaboration services.

(6) "User" means an individual located in the state who accesses or uses a social media service.

Section 2. Section 13-81-102 is amended to read:
13-81-102 [Effective 07/01/26] Effective 07/01/27. Legislative findings.
The Legislature finds that: (1) an individual has a right to control and move the individual's own personal data, including social interactions online;
(2) companies have demonstrated a pattern of restricting the interoperability of content, preventing users from easily sharing posts and interactions across different platforms, reducing effective consumer choice, and stifling market competition; and
(3) the state should ensure that individuals have the right to access a complete personal data record in a portable format from social media platforms.

Section 3. Section 13-81-201 is amended to read:
13-81-201 [Effective 07/01/26] Effective 07/01/27. Data portability requirements.
If a consumer requests a copy of the consumer's personal data under Section 13-61-201, a social media service shall within five business days provide the personal data, including the user's social graph, in a format that: (1) is portable, to the extent technically feasible;
(2) is readily usable, to the extent practicable; and
(3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means.

Section 4. Section 13-81-202 is amended to read:
13-81-202 [Effective 07/01/26] Effective 07/01/27. Data interoperability requirements.
(1) A social media company shall implement a transparent, third-party-accessible interoperability interface or interfaces to allow users to choose to: (a) share a common set of the user's personal data or a user-selected part of the user's personal data between the social media services designated by the user; and
(b) enable third parties to access [content] personal data created by the user and to be notified when new or updated [content] personal data is available, with the user's permission.

(2) A social media company shall reasonably secure all personal data obtained through an interoperability interface.
(3) To achieve interoperability under Subsection (1), a social media company shall: (a) utilize an open protocol;
(b) facilitate and maintain interoperability and [synchronous] continuous, real-time data sharing with other social media services through an interoperability interface, based on reasonable terms that do not discriminate between social media services;
(c) establish reasonable and proportionate thresholds related to the frequency, nature, and volume of requests, beyond which the social media company may assess a reasonable fee for such access; and
[(d) offer to other social media companies a functionally equivalent version of any internal interfaces created by the social media company for the social media company's own social media services; and]
[(e)] (d) disclose to other social media companies complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.

(4) A social media company shall publicly disclose the open protocol that the social media company intends to use for purposes of Subsection (3)(a).
[(4)] (5) A social media company or third party shall safeguard the privacy and security of a user's personal data obtained from other social media services through the interoperability interface in accordance with the social media company's or third party's privacy notice and administrative, technical, and physical data security practices.
[(5)] (6) A social media company or third party may not share or receive a user's personal data through the interoperability interface except with the user's consent, including when a user's personal data is intended to be shared in response to another user's request to share a social graph.
[(6)] (7) (a) A social media company shall adopt an accessible, prominent, and persistent method for users to give consent for data sharing with other social media services or third parties through the interoperability interface.
(b) The method described in Subsection (7)(a) shall allow users to provide consent: (i) when the user initiates a transfer of the user's own personal data; and
(ii) before the user's personal data is shared as part of another user's social graph.

(c) A social media company shall implement the user's consent decisions within five business days.

[(7)] (8) A social media company is not required to: (a) provide access to: (i) inferences, analyses, or derived data that the social media company has generated internally about a user; or
(ii) proprietary algorithms, ranking systems, or other internal operating mechanisms; or

(b) transmit personal data that: (i) is stored or structured in a proprietary format; and
(ii) meets both of the following criteria: (A) no open, industry-standard format is reasonably available; and
(B) transmitting the data would disclose information described in Subsection [(7)(a)] (8)(a).

[(8)] (9) This chapter does not apply to an entity that is: (a) owned, controlled, operated, or maintained by a religious organization; and
(b) exempt from property taxation under state law.

Section 5. Section 13-81-301 is amended to read:
13-81-301 Effective 07/01/27. Rulemaking authority -- Rebuttable presumption -- Safe harbor.
(1) The division may identify open protocols that the division has determined, after an assessment, meet the requirements of Section 13-81-202.
(2) If a social media company uses an open protocol that the division identifies under Subsection (1), the social media company shall be entitled to a rebuttable presumption of providing access on reasonable terms that do not discriminate between social media services.
(3) A social media company does not violate Section 13-81-202 for a temporary loss of continuous real-time data sharing if the social media company demonstrates that: (a) the social media company made good faith efforts to maintain continuous real-time data sharing; and
(b) the social media company took reasonable steps to restore data sharing as soon as practicable.

(4) Nothing in this chapter shall be construed to require a social media company to receive data through an interoperability interface.

Section 6. Section 13-81-401 is amended to read:
13-81-401 [Effective 07/01/26] Effective 07/01/27. Severability.
(1) If any provision of this chapter or the application of any provision to any person or circumstance is held invalid by a final decision of a court of competent jurisdiction, the remainder of this chapter shall be given effect without the invalid provision or application.
(2) The provisions of this chapter are severable.

Section 7. Effective Date.
This bill takes effect on July 1, 2027.

3-6-26 11:42 PM