13-81-202. Data interoperability requirements.
(1) A social media company shall implement a transparent, third-party-accessible interoperability interface or interfaces to allow users to choose to:
(a) share a common set of the user's personal data between the social media services designated by the user; and
(b) enable third parties to access content created by the user and to be notified when new or updated content is available, with the user's permission.
(2) A social media company shall reasonably secure all personal data obtained through an interoperability interface.
(3) To achieve interoperability under Subsection (1), a social media company shall:
(a) utilize an open protocol;
(b) facilitate and maintain interoperability and synchronous data sharing with other social media services through an interoperability interface, based on reasonable terms that do not discriminate between social media services;
(c) establish reasonable and proportionate thresholds related to the frequency, nature, and volume of requests, beyond which the social media company may assess a reasonable fee for such access;
(d) offer to other social media companies a functionally equivalent version of any internal interfaces created by the social media company for the social media company's own social media services; and
(e) disclose to other social media companies complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.
(4) A social media company or third party shall safeguard the privacy and security of a user's personal data obtained from other social media services through the interoperability interface in accordance with the social media company's or third party's privacy notice and administrative, technical, and physical data security practices.
(5) A social media company or third party may not share or receive a user's personal data through the interoperability interface except with the user's consent.
(6) A social media company shall adopt an accessible, prominent, and persistent method for users to give consent for data sharing with other social media services or third parties through the interoperability interface.
(7) A social media company is not required to:
(a) provide access to:
(i) inferences, analyses, or derived data that the social media company has generated internally about a user; or
(ii) proprietary algorithms, ranking systems, or other internal operating mechanisms; or
(b) transmit personal data that:
(i) is stored or structured in a proprietary format; and
(ii) meets both of the following criteria:
(A) no open, industry-standard format is reasonably available; and
(B) transmitting the data would disclose information described in Subsection (7)(a).
(8) This chapter does not apply to an entity that is:
(a) owned, controlled, operated, or maintained by a religious organization; and
(b) exempt from property taxation under state law.
Enacted by Chapter 468, 2025 General Session
