Utah Updates Consumer Privacy and Protection Acts with AI-Focused Provisions

Effective May 1, 2024, companies must face new artificial intelligence (AI) disclosure requirements in Utah. The Utah AI Policy Act (AI Act) amends the Utah Consumer Privacy Act (UCPA) and Utah Consumer Sales Practices Act (UCSPA) to address consumer-related AI.

Generated Data to Protect Privacy

The AI Act provides a specific exclusion for a special type of generated data—synthetic data—allowing companies to broadly use data that was not previously excluded from the definition of personal data under Utah’s comprehensive privacy statute. Synthetic data is artificial data that is made by mathematically modeling real data to create new data. The new data preserves the statistical properties of the original data but does not contain the underlying details. As a result, synthetic data is a “step above de-identification” but otherwise shows “no significant difference” from the original data.¹ Synthetic data techniques provide the ability to not only recreate data, but also to make additional data with specific properties. Mixing this additional data into a data set can help create better results, such as by mitigating known biases.²

The UCPA definition of “personal data” covers “information that is linked or reasonably linkable to an identified individual or an identifiable individual” and excludes de-identified data, aggregated data or publicly available information.³ Under the new UCPA amendments, synthetic data is defined as “data that has been generated by computer algorithms or statistical models and does not contain personal data” and is explicitly stated to be a form of de-identified data.⁴ These changes support and align with best practices and provide clear guidance for using synthetic data in Utah.

Transparency and Liability for AI

Further, the bill adds provisions to the UCSPA that address responsibility for consumer protection violations involving generative AI and requires disclosure when consumers are interacting with AI. The amendments clarify that using AI is not a defense to violations, including whether AI performs the act or statement—or the AI is used by a person.⁵ Accordingly, organizations are responsible for their AI and must take steps to ensure that it remains compliant with Utah’s consumer protection laws.

Under the new amendments, consumer-facing AI must—upon request—clearly and conspicuously disclose that the user is interacting with “generative artificial intelligence and not a human.”⁶ For regulated occupations, which are defined as those that require a license or state certification, this transparency requirement does not require the consumer to ask—the use of generative AI must be disclosed when providing regulated services.⁷ Like the other amendments, this transparency requirement is consistent with best practices and many other proposed regulations aimed at providing notice when AI is involved.

Other AI-Related Measures

In addition to amending the UCPA and UCSPA, the bill includes an Artificial Intelligence Policy Act, which creates the Office of Artificial Intelligence Policy and a Learning Laboratory Program to support state regulatory efforts and encourage in-state AI development.⁸

Utah also enacted a second AI-related bill on the same day. As of May 1, 2024, the second bill requires identifying AI-generated content with both human-observable and “embedded tamper-evident digital” measures (e.g., watermarks, metadata) used in political campaigns or otherwise intended to influence voters.⁹ The second bill also creates a new aggravating factor under the Utah Criminal Code, which allows judges to consider the intentional or knowing use of AI for material assistance in a criminal offense.¹⁰

Key Takeaways

Utah is among the first states to address AI in the context of consumer protection and may set a template that other states follow. By clarifying the status of synthetic data, the amended UCPA provides certainty for organizations to use synthetic data and comply with Utah’s privacy law. Paired with the consumer-facing transparency and liability pieces, Utah is making it easier for AI-using organizations to understand and comply with the state’s regulations.

^{1 Brian Eastwood, What is synthetic data — and how can it help you competitively?, MIT Sloan (Jan 23, 2023), https://mitsloan.mit.edu/ideas-made-to-matter/what-synthetic-data-and-how-can-it-help-you-competitively.}

^{2 Kim Martineau, What is synthetic data?, IBM Research (Feb. 8, 2023), https://research.ibm.com/blog/what-is-synthetic-data.}

^{3 Utah Code § 13-61-101(24).}

^{4 S.B. 149 § 13-61-101(14)(b), (34).}

^{5 Id § 13-2-12(2).}

^{6 Id § 13-2-12(3).}

^{7 Id § 13-2-12(4).}

^{8 Id ch. 70.}

^{9 S.B. 131 § 20A-11-1104.}

^{10 Id. § 76-3-203.18. This amendment takes effect on July 1, 2024.}