Utah AI Laws Require Consumer-Facing Disclosures Starting May 1 | Orrick, Herrington & Sutcliffe LLP

Two laws take effect in Utah on May 1 that impose legal requirements on a broad range of generative AI uses. The laws:

• Clarify that synthetic data generated by generative AI is not personal data under the Utah Consumer Privacy Act (UCPA).
• Require disclosures relating to the use of generative AI in consumer-facing applications.
• Specify that generative AI users are responsible for the impact caused by the use of the AI.
• Create an Office of Artificial Intelligence Policy and the AI Learning Laboratory Program.

With the implementation of these laws, Utah becomes one of the first U.S. states to impose specific obligations on private-sector AI technologies. 

Here’s a more detailed look at what the new laws require and what this means for your business:

1. Synthetic data is not personal data.

SB 149 amends the UCPA to clarify that data generated by computer algorithms or statistical models that do not contain personal data (i.e., “synthetic data”) is not “personal data” under the UCPA.

2. Companies must disclose the use of generative AI in consumer-facing applications.

SB 149 requires any person who causes generative AI to interact with individuals to disclose if asked that they are interacting with generative AI and not a human being. The law also requires disclosure of the use of generative AI at the beginning of an interaction with an individual when using the technology to provide services requiring a license or state certification.

SB 131 adds a requirement to make clear disclosures where a person uses generative AI to create audio or visual content intended to influence an election or ballot proposition when that content is paid for by a political party, candidate campaign committee, political action committee, political issues committee or a person using a contribution.

These disclosures must include a disclaimer that the audio or visual content is generated by AI, as well as the identity of the initial author of the content and any use of generative AI in creating the substantive content. However, the law exempts persons that solely provide the technology used in the creation of such audio or visual content.

3. Generative AI users are responsible for the impact.

The new laws clarify that users of generative AI are generally responsible for their impact as follows:

• The provision of services requiring a license or state certification through generative AI still requires meeting the requirements of such regulated services.
• It is not a defense to the violation of any statute administered and enforced by the Division of Consumer Protection (including Utah’s Unfair Practices Act) that generative AI caused the applicable violation.
• An actor may be found guilty of a crime if the actor:
  • Commits the offense with the aid of generative AI.
  • Intentionally prompts or otherwise causes generative AI to commit the offense.
• The sentencing judge or the Board of Pardons and Parole may consider as an aggravating factor in their deliberations that the defendant committed or facilitated the criminal offense with the intentional or knowing use and material assistance of an AI system.

Violations of SB 149 can be enforced under the Division of Consumer Protection’s ordinary enforcement powers in addition to a separate administrative fine of up to $2,500 per violation or $5,000 for each violation of an administrative or court order previously issued for a violation of the law.

In comparison, SB 131 provides for a lower civil penalty of $1,000 per violation, but indicates that sum may be recoverable by any person bringing a claim against the relevant creator or sponsor of political content (suggesting a private right of action is available). 

4. One of the laws creates an Office of Artificial Intelligence Policy and the AI Learning Laboratory Program.

SB 149 establishes an Artificial Intelligence Learning Laboratory Program whose purpose is to empower the state to study AI and develop informed AI legislation and regulation.

Companies can apply to participate in the program. Participation provides a company the potential to enter into a regulatory mitigation agreement with the state that reduces the regulatory burden relating to the company’s development and testing of AI in the state for a period of 12 months. In exchange, certain parameters are imposed on the company’s activities, and the company must share some information with the state.

Participating companies are permitted to request a 12-month extension for participation. The state has discretion over whether or not to grant the extension.

SB 149 also creates an Office of Artificial Intelligence Policy within Utah’s Department of Commerce, which is responsible for the Artificial Intelligence Learning Laboratory Program and consulting with businesses and other stakeholders about potential regulatory proposals.

5. What Does This Mean for Your Business?

The new laws take effect in May and are enforceable immediately. As a result, we recommend taking the following steps:

• Consider the Use of Synthetic Data: Regulators have hinted that they consider synthetic data to be non-personal, but Utah has now codified that concept into law. As a result, companies should consider whether using synthetic data allows the company to obtain the same objectives without triggering U.S. privacy law.
• Prepare an AI Inventory: Prepare an inventory of your company’s AI technologies that, at a minimum, identifies each AI technology in use at your company, the purposes for which it is used, whether the model is generative, whether the model interacts with consumers and whether a human is in the loop with the development and delivery of the output.
• Implement Any Required Disclosures: Modify the consumer interface and outputs, where necessary, to provide clear disclosure to an individual that they are interacting with generative AI or that the applicable election-related content was AI-generated.
• Continue to Monitor Future Developments: The passage of two AI laws in Utah is a sign that state legislators are interested and willing to put in place new regulatory regimes for AI. As a result, we recommend monitoring future developments in the AI legislative space relating to either new laws and regulations or the development of AI within the AI Learning Laboratory Program.