New Utah AI Laws Change Disclosure Requirements and Identity Protections, Target Mental Health Chatbots

Key Takeaways 

• Utah has introduced five new bills that further shape its existing Artificial Intelligence Policy Act and add new requirements.
• Both the scope of disclosure requirements surrounding the use of AI technology and the definition of "generative AI" under the AIPA have been narrowed.
• Mental health chatbots are now subject to disclosure obligations and restrictions, and penalties have been established for failure to comply.
• One bill expands prior law regarding the "abuse of personal identity" beyond the realm of advertising to address threats posed by deepfakes and other new technology.

Five new artificial intelligence (AI) bills went into effect in Utah on May 7, 2025. Two of the new bills, SB 226 and SB 332, amend Utah’s Artificial Intelligence Policy Act (AIPA), which went into effect in May 2024. HB 452 creates specific obligations for chatbots in the mental health space, while SB 271 expands existing prohibitions against abuses of personal identity to include AI-generated content. The last bill, SB 180, which is not discussed in this Update, directs state law enforcement agencies to keep a written AI policy and disclose the use of AI to generate police reports.

Amendments extend the duration of the Utah Artificial Intelligence Policy Act but narrow its scope (SB 226 and SB 332).

Utah’s AIPA requires disclosure that a consumer is interacting with generative AI, not a human, if asked by the consumer or if the provider is in a “regulated occupation” (defined as an occupation regulated by the Department of Commerce that requires a person to obtain a license or state certification to practice the occupation, such as a lawyer, therapist, or financial expert).

SB 226 narrows the AIPA disclosure requirements in several significant ways, including:

• Consumer requests must now be clear and unambiguous. The requirement to disclose that the consumer is interacting with generative artificial intelligence when asked is now limited to a “clear and unambiguous request."
• Required disclosures for regulated occupations limited to “high-risk” interactions. SB 226 limits the AIPA disclosure requirements for regulated occupations to “high-risk artificial intelligence interaction[s],” which are those that entail:
  • The collection of sensitive personal information, such as health data, financial data, or biometric data
  • Providing personalized recommendations, advice, or information that the consumer could reasonably rely upon to make significant personal decisions
  • Providing financial, legal, medical, or mental health advice or services
• Generative AI more narrowly defined. SB 226 also amended the definition of generative AI to only include AI technology designed to simulate a human conversation with consumers (as opposed to any interactions with a human).
• New safe harbor added. SB 226 provides that a person is not subject to an enforcement action for violation of the disclosure provisions if the generative AI itself clearly and conspicuously discloses it is nonhuman (or an AI assistant or generative AI) at the outset of the interaction and throughout any interaction in connection with a consumer transaction or provision of regulated services.

SB 332 extends the duration of the AIPA, which was scheduled to sunset on May 7, 2025, until July 1, 2027.

Utah takes a harder look at mental health chatbots (HB 452).

HB 452 adds new consumer protections for users of “mental health chatbots” that use AI technology that to engage in interactive conversations with users “similar to the confidential communications that an individual would have with a licensed mental health therapist.” AI technology that merely provides scripted outputs or connects users to human mental health therapists are excluded.

HB 452 imposes a number of requirements on mental health chatbots, including:

• Disclosure obligations. Providers must clearly and conspicuously disclose that the user is interacting with AI at several points in time—prior to access, if more than seven days have passed since the last use, and when asked by the user.
• Advertising restrictions. The chatbots must clearly and conspicuously disclose any advertisements and any sponsorship or similar relationships with the advertised product or service. User input may not be used for targeted or customized advertisements (although referrals to licensed professionals are allowed).
• Restricting sales of individual health information. Providers may not sell or share individually identifiable health information or user inputs of Utah users, except under specified circumstances (including if the user consents).

Affirmative defense. Mental health chatbot providers may qualify for an affirmative defense to liability if they (1) create, implement, and comply with a written policy that meets certain detailed requirements specified in the statute (which must be filed with the Utah Division of Consumer Protection); and (2) maintain certain documentation regarding the development and implementation of the chatbot, including information describing the training data and foundational models, user data collection and sharing practices, and ongoing efforts to ensure accuracy, reliability, fairness, and safety.

Enforcement. Violations may result in a fine of up to $2,500 per violation, as well as an action in state court for injunctive relief, disgorgement, and additional penalties for each violation of an administrative order up to $5,000 each. There is no private right of action.

Utah adds generative AI content to abuses of personal identity (SB 271).

Utah’s existing "abuse of personal identity" law already prohibited the nonconsensual commercial use of an individual’s personal identity in advertising that implied approval or endorsement of the subject matter of the advertisement. SB 271 expands the scope of the law to address new risks like deepfakes.

Scope. SB 271 now extends beyond advertising to include use of an individual’s personal identity in fundraising, solicitation of donations, and the purchase of products, merchandise, goods, and services. It also expands the definition of personal identity to include any simulation, reproduction, or artificial recreation of an individual’s picture, portrait, video likeness, voice, or audiovisual appearance created through generative AI, as well as through computer animation, digital manipulation, or other technological means. “Voice” is now defined to include a computer-generated sound that is readily identifiable and attributable to a particular individual. In addition, the amendment also expands the law beyond false endorsement claims to prohibit nonconsensual uses that create a likelihood of confusion or a false impression that the individual participated in or approved the use.

Restrictions on tool providers. Notably, the law now prohibits the knowing sale, distribution, or licensing of any technology, software, or tool whose intended “primary purpose” is the unauthorized creation or modification of content that includes an individual’s personal identity for commercial purposes.

Exemptions. SB 271 includes exceptions designed to protect First Amendment rights (including for newsworthiness, artistic expression, public interest, and parody) and specifically exempts interactive computer services (as defined in Section 230 of the Communications Decency Act) from liability for content provided by another person. While Section 230 generally shields platforms from certain claims relating to third-party content, it does not cover intellectual property rights, and there is a split in authority as to whether right of publicity claims fall under this exclusion. So, it is notable that this statute specifically excludes such liability.

Enforcement. SB 271 maintains the private right of action afforded by Utah’s consumer protection laws against both those who use and publish an individual’s personal identity without authorization. Plaintiffs are entitled to injunctive relief, damages, and reasonable attorneys’ fees.