What does Utah require right now?

Comprehensive privacy law with a business-friendly framework. Covers controllers processing data of 100,000+ Utah consumers or 25,000+ with 50%+ revenue from data sale. Grants rights to access, delete, and opt out of sale and targeted advertising. No right to correct data. No data protection assessment requirement. AG enforcement only with 30-day cure period.

Utah's AI Policy Act (Artificial Intelligence Amendments). Requires disclosure that a person is interacting with generative AI: on request for general consumer interactions, and proactively for regulated occupations. Creates the Office of Artificial Intelligence Policy (Dept. of Commerce) and an AI learning-lab program. Effective May 1, 2024. Contains no student-specific or K-12 disclosure mandate — do not frame as a school requirement.

Directs the state board to establish standards for a digital skills course an LEA MAY offer in grades 7-8 — not a required course. Standards must include AI literacy, cybersecurity, and digital privacy, in place by the 2027-28 school year. Governor action Mar 18, 2026; effective May 6, 2026. Products delivering AI literacy content or educator PD map to the optional course standards.