Utah Digital Content Provenance Standards Act (HB 276)
Utah · Utah Code ch. 13-72c (HB 276, Laws of Utah 2026, ch. 352) · effective 2027-01-01 · The capture device duty applies to devices produced for sale on or after Jan 1, 2028. Utah's code site marks the chapter "Affected by 63I-2-213 on 7/1/2027", but the current text of that section repeals only chapter 72, and HB 276 does not amend it.
Summary
From Jan 1, 2027, anyone who produces a publicly accessible generative AI system with over one million monthly visitors or users must embed a latent (machine-readable) disclosure in images, video and audio the system creates or substantially modifies. Social media, mass messaging and search platforms with over two million monthly users must detect standards-based provenance data, show users it exists and let them inspect it, and must not knowingly strip it. From 2028, new cameras and phones sold in Utah must embed a latent disclosure, which users may turn off.
Who must comply
Makers of generative AI systems with over 1M monthly visitors or users; large online platforms with over 2M monthly users; capture device manufacturers.
What you must disclose
A latent disclosure in AI-created or substantially modified images, video and audio, with the time and date, and digital signatures that can show AI use or the other detail § 13-72c-203 lists, as far as technically feasible and reasonable. Platforms must tell users when provenance data is available.
When: At generation (AI system makers); on the platform (large platforms); at capture (devices produced for sale from Jan 1, 2028).
Other duties
- Large platforms must let users inspect provenance data directly, by download or by link, and must not knowingly strip it, as far as technically feasible.
- A business that only uses another company's AI tool is not named in the act. Keeping the provenance data its tools attach matches the rule platforms must follow.
Exemptions
- AI systems used only for a business's internal operations and not made public.
- AI systems at or under one million monthly visitors or users.
- Platforms at or under two million monthly users; broadband and telecommunications services.
Penalties
Administrative fines or court fines up to $2,500 per violation, plus injunctions, disgorgement and the state's fees and costs; up to $5,000 per violation of an administrative or court order.