NOTICE OF SUBSTANTIVE CHANGE
1. Agency Information
Commerce, Consumer Protection
Salt Lake City, UT 84114-6704
2. Contact Persons
Please address questions regarding information on this notice to the persons listed above.
3. General Information
A. Rule or section catchline:
R152-78B. Liability for Publishers and Distributors of Material Harmful to Minors Rule
B. Purpose of the new rule or reason for the change:
This rule is being proposed to establish commercially reasonable age verification standards and to aid the Division of Consumer Protection's (division) administration and enforcement of Title 78B, Chapter 3, Part 10, Liability for Publishers and Distributors of Material Harmful to Minors.
C. Summary of the new rule or change:
This rule defines terms, establishes the "commercially reasonable" standard with respect to age verification and geolocation detection performed in accordance with Section 78B-3-1002, establishes a safe harbor in accordance with Section 78B-3-1006, and establishes standards for data collection and disposal.
4. Legislative Action Information
A. Are any changes in this filing
because of state legislative action?
Changes are because of legislative action.
B. If yes, any bill number and
session:
SB 73 (2026 General Session)
5. Fiscal Information
Provide an estimate and written explanation of the aggregate anticipated cost or savings to:
The proposed rule is not anticipated to have a fiscal impact on the state budget beyond that already described in the Fiscal Note to SB 73, passed in the 2026 General Session.
The proposed rule is not anticipated to have a fiscal impact on local governments beyond that already described in the Fiscal Note to SB 73 (2026).
C. Small businesses ("small business" means a business employing 1-49 persons):
This rule may have a fiscal impact on small businesses; however, that impact is inestimable because the number of small businesses to which this rule will apply is not readily available and is fluid.
Costs will vary depending on the commercially reasonable age assurance and geolocation detection methods chosen by a covered commercial entity, and the number of age verification and geolocation checks the covered commercial entity performs.
While the division is unable to estimate aggregate costs to small businesses, it estimates that each age verification attempt will cost between $0.01 and $0.12, with those costs decreasing over time.
The division estimates that a covered commercial entity may spend approximately $0.01 per person who attempts to access a covered website for geolocation detection and geolocation obfuscation detection, with costs decreasing at larger scales.
D. Non-small businesses ("non-small business" means a business employing 50 or more persons):
This rule may have a fiscal impact on non-small businesses; however, that impact is inestimable because the number of non-small businesses to which this rule will apply is not readily available and is fluid.
Costs will vary depending on the commercially reasonable age assurance and geolocation detection methods chosen by a covered commercial entity, and the number of age verification and geolocation checks the covered commercial entity performs.
While the division is unable to estimate aggregate costs to non-small businesses, it estimates that each age verification attempt will cost between $0.01 and $0.12, with those costs decreasing over time.
The division estimates that a covered commercial entity may spend approximately $0.01 per person who attempts to access a covered website for geolocation detection and geolocation obfuscation detection, with costs decreasing at larger scales.
E. Persons other than small businesses, non-small businesses, state, or local government entities ("person" means any individual, partnership, corporation, association, governmental entity, or public or private organization of any character other than an agency):
The proposed rule is not anticipated to have a fiscal impact on persons other than small businesses, non-small businesses, state, or local government entities beyond that already described in the Fiscal Note to SB 73 (2026).
F. Compliance costs for affected persons:
Aggregated costs are inestimable because the number of covered businesses and non-small businesses to which this rule will apply is not readily available and is fluid.
Additionally, the division is unable to calculate the number of people who will attempt to access from Utah covered websites operated by covered commercial entities.
However, the division estimates that each age verification attempt will cost between $0.01 and $0.12, with those costs decreasing over time.
Further, the division estimates that a covered commercial entity may spend approximately $0.01 per person who attempts to access a covered website for geolocation detection and geolocation obfuscation detection, with costs decreasing at larger scales.
6. Regulatory Impact Summary Table
Enter the cost or savings in the relevant cell. If there is no cost or savings, enter, "$0." If a cost or savings is inestimable, enter, "inestimable."
7. Regulatory Impact Analysis Approval
The Commissioner of the Department of Commerce, Margaret Busse, has reviewed and approved this regulatory impact analysis.
8. Family Impact Information
A. The agency has considered this rule's impact on family health, stability, and formation:
9. Citation Information
Provide citations to the statutory authority for the rule. If there is also a federal requirement for the rule, provide a citation to that requirement:
11. Public Notice Information
The public may submit written or oral comments to the agency identified in box 1.
A. Comments will be accepted until:
12. Effective Date Information
This rule change MAY become effective on:
(NOTE: This is the date the agency anticipates making the filing effective. It is NOT the effective date)
13. Agency Authorization Information
Agency head or
designee and title:
Katherine Hass, Division Director
R152. Commerce, Consumer Protection.
R152-78B. Liability for Publishers and Distributors of Material Harmful to Minors Rule. The purpose of this rule is to: (1) to establish commercially reasonable age verification standards that a commercial entity may meet to comply with Section 78B-3-1002, including standards for: (a) third party age verification services; (b) location obfuscation detection and geolocation services; (c) user privacy and data protection; and (2) aid the division's administration and enforcement of Title 78B, Chapter 3, Part 10, Liability for Publishers and Distributors of Material Harmful to Minors. This rule is promulgated in accordance with Subsections 13-2-106(1) and Section 78B-3-1005. R152-78B-103. Definitions. (1) "False positive" means an age verification system's incorrect determination that a person attempting to access a commercial entity's website described by Subsection 78B-3-1002(1) is not a minor. (2)(a) "False positive rate" means the rate at which a commercial entity's age verification system incorrectly determines that a person attempting to access a commercial entity's website described by Subsection 78B-3-1002(1) is not a minor. (b) "False positive rate" is calculated as (false positive rate = false positives ÷ (false positives + true negatives)). (3) "Geolocation obfuscation" means a virtual private network, proxy server, or other location technology that masks a person's or device's geographic location. (4) "Geolocation obfuscation detection system" means a method, process, or technique used to identify: (a) whether a person's or device's location is masked; or (b) whether a person is in Utah. (5) "Proxy server" means any intermediate hardware, software, or network routing service configured to intercept, filter, relay, or re-route data requests and responses between a client device and a destination network or server. (6) "True negative" means an age verification system's correct determination that a person attempting to access a commercial entity's website described by Subsection 78B-3-1002(1) is a minor. (7) "Virtual private network" means a system that allows a computing device to link to a network of computers from a remote location by a secure means of communication in a way that causes the remote computing device to appear to have the same characteristics as the network to which it connects. R152-78B-201. Commercially Reasonable Methods -- Age Verification -- Geolocation Obfuscation. (1) A commercially reasonable age verification method is a measure calculated to enable the commercial entity to identify with at least 95% accuracy whether a person attempting to access a website described by Subsection 78B-3-1002(1) is a minor. (2)(a) A commercially reasonable geolocation obfuscation detection system is a measure calculated to enable the commercial entity to identify with at least 95% accuracy whether a person attempting to access a website described by Subsection 78B-3-1002(1)(a) is in Utah. (b) To determine whether a person attempting to access a website described by Subsection 78B-3-1002(1) is in Utah, a commercial entity may analyze latent signals, including: (ii) a device's or browser's time zone setting; and (iii) other relevant data transmitted by the device or browser. R152-78B-202. Safe Harbor. (1) A commercial entity's age verification system qualifies for the safe harbor described by Section 78B-3-1006 if: (a) the methods used by the age verification system produce outcomes that satisfy the criteria in the following table: Accuracy of Age Verification Outcomes 
