Technology

HB 223 updates Utah's process for collecting signatures on petitions by requiring all electronic signature devices to scan voter ID data (like driver's licenses) and operate offline by 2028. Starting January 1, 2030, petition sponsors and circulators must use electronic signatures exclusively, banning manual signature collection entirely. The bill also clarifies security standards for devices and mandates annual reports from the lieutenant governor to the Government Operations Committee. These changes directly affect initiative/referendum petition sponsors and candidate nomination circulators, streamlining the verification process while phasing out manual methods.

HB 438, the AI Companion Chatbot Safety Act, regulates companies that create AI chatbots designed for emotional engagement. It requires suppliers to implement safety protocols for identifying risks, conduct independent safety evaluations, and publicly report on safety measures and user engagement. The bill specifically prohibits sharing minors' data, sending unsolicited messages to encourage use, exposing minors to harmful content, or hiding that the chatbot is AI (mandating clear disclosure). It grants enforcement authority to Utah's Division of Consumer Protection and establishes fines for violations. The law directly affects AI chatbot developers and users, particularly minors, by setting concrete safety and transparency standards.

HB 26 amends Utah's voting equipment rules to enhance security and standardize procurement. It bans wireless communication in all voting machines (except electronic pollbooks), repeals outdated ranked-choice voting certification rules, and requires election officials to purchase only equipment selected by the lieutenant governor's new voting equipment system. The bill creates a Voting Equipment Selection Committee to help the lieutenant governor evaluate and procure secure voting systems that meet mechanical ballot requirements. These changes directly affect election officials, vendors, and voters by standardizing equipment security and procurement processes.

HB 42 establishes minimum cybersecurity standards for Utah's public schools (local education agencies) and expands the Utah Cyber Center's role to provide dedicated security services to schools. It requires schools to implement specific measures like multi-factor authentication, patch management, and endpoint detection systems, while mandating incident reporting to the Cyber Center. The law also directs the State Board of Education to develop implementation guidelines and creates new reporting requirements for cybersecurity breaches in educational settings. These changes directly affect all Utah public schools and their cybersecurity practices, aiming to strengthen protection for student and school data. The bill contains no new funding and amends several existing Utah Code sections related to education and cybersecurity.

HB 55 requires schools and government agencies contracting with education technology vendors to include specific privacy clauses in their agreements. It mandates that if a vendor illegally sells student data (violating state or federal law), the school must notify the vendor within 30 days and terminate the contract if the violation isn’t fixed within another 30 days. The bill also prohibits vendors from charging fees or seeking damages for contract termination due to privacy violations and repeals a prior provision allowing vendors to respond to student feedback requests. This directly affects schools, their ed tech vendors, and student data privacy protections under Utah law.