A social media company shall, for Utah minor account holders on the social media service:
(1) set default privacy settings to prioritize maximum privacy, including settings that:
(a) restrict the visibility of a Utah minor account holder's account to only connected accounts;
(b) limit the Utah minor account holder's ability to share content to only connected accounts;
(c) restrict any data collection and sale of data from a Utah minor account holder's account that is not required for core functioning of the social media service;
(d) disable search engine indexing of Utah minor account holder profiles;
(e) restrict a Utah minor account holder's direct messaging capabilities to only allow direct messaging to connected accounts; and
(f) allow a Utah minor account holder to download a file with all information associated with the Utah minor account holder's account;
(2) implement and maintain reasonable security measures, including data encryption, to protect the confidentiality, security, and integrity of personal information collected from a Utah minor account holder;
(3) provide an easily accessible and understandable notice that:
(a) describes any information the social media company collects from a Utah minor account holder; and
(b) explains how the information may be used or disclosed;
(4) upon request of a Utah minor account holder:
(a) delete the personal information of the Utah minor account holder, unless the information is required to be retained under Section 13-61-203, or a different provision of state or federal law; and
(b) remove any information or material the Utah minor account holder made publicly available through the social media service; and
(5) disable the following features that prolong user engagement:
(a) autoplay functions that continuously play content without user interaction;
(b) scroll or pagination that loads additional content as long as the user continues scrolling; and
(c) push notifications prompting repeated user engagement.