Privacy Law Library

Artificial Intelligence Applications Relating to Mental Health

Utah Mental Health Chatbot Act

Artificial intelligence · Health

Enacted by 2025 H.B. 452, it requires mental health chatbots to disclose they are AI, bars selling or sharing users' health information and inputs, and limits advertising based on user input. A separate affirmative defense against unlicensed-practice claims is available to suppliers that file a written policy with the Division (58-60-118).

Where
Utah
Citation
Utah Code Title 13, Chapter 72a; Utah Code 58-60-118
Status
In force
In force since
2025-05-07
Last amended
2026-05-06
Enforced by
Utah Division of Consumer Protection
People can sue
No
Penalties
Administrative and court fines up to $2,500 per violation; $5,000 per violation of an order (13-72a-204).
Applies to
  • Suppliers of a mental health chatbot (generative AI holding therapy-like conversations that the supplier represents, or a reasonable person would believe, can provide mental health therapy or help manage mental health conditions) used by people located in Utah; excludes scripted tools and pure referral tools (13-72a-101(10), (16))

What a privacy notice must say

  • Clearly and conspicuously disclose that the chatbot is AI and not a human: before access, at the start of an interaction after seven or more days of non-use, and whenever the user asks.Utah Code 13-72a-203
  • Clearly identify in-conversation advertisements and disclose any sponsorship, business affiliation, or third-party promotion agreement.Utah Code 13-72a-202(1)

Practices it requires

  • Do not sell or share a Utah user's individually identifiable health information or user input with third parties, except listed provider, health plan, and HIPAA-equivalent contractor exceptions.Utah Code 13-72a-201
  • Do not use user input to target, select, or customize advertisements, other than ads for the chatbot itself.Utah Code 13-72a-202(2)

Other duties

  • Affirmative defense to unlicensed-practice claims if the supplier keeps and files with the Division a written policy covering purposes, testing, crisis protocols, AI disclosure, and HIPAA-equivalent privacy and security, and documents user data collection and sharing practices.Utah Code 58-60-118 · Only if: Supplier relies on the affirmative defense

Sources

Checked against these sources on 2026-09-23 by research agent (Claude), primary sources.

Research reference, not legal advice.