UtahS.B. 382026 General SessionSenateWALLET

Consumer Protection Modifications

Your PRIA Score

Score Hidden

Personalized for You

How does this bill affect your finances?

Sign up for a PRIA Policy Scan to see your personalized alignment score for this bill and every other piece of legislation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.

Free to start

Bill Overview

Analyzed Economic Effects

57 provisions identified: 31 benefits, 9 costs, 17 mixed.

Earned wage access enforcement and refunds

Starting May 6, 2026, the director can fine earned‑wage‑access providers up to $2,500 per violation. Courts can order refunds, injunctions, and fines up to $2,500 per violation, and must award attorney and investigative fees when the Division wins. Breaking an order can cost up to $5,000 per violation.

Stronger refunds and protections for students

Beginning May 6, 2026, schools must give you a clear written disclosure before you enroll or pay. You can cancel within three business days after the later of signing, paying (not the application fee), first class, or first access to services. You get a full refund minus a reasonable application fee and a deposit up to 10% of first‑term tuition. Schools must also keep approved financial security, like a bond or CD, to protect prepaid tuition and nontransferable credits. That security stays in place while students are enrolled and at least 60 days after the last student leaves.

Price-gouging enforcement and fine limits

The Division can issue cease‑and‑desist orders and bring cases. For each excessive‑price violation, the fine cannot be more than double the excessive part of the price. If the Division wins, courts may award costs and attorney fees. Collected money goes to the Consumer Protection Education and Training Fund. The Division also limits when it discloses an investigated person’s identity.

Court reversal for blockchain fraud

Starting May 6, 2026, you can sue to reverse a fraudulent or mistaken transfer on a reversible blockchain. The blockchain must require identity proof and user consent to reversals and Utah court jurisdiction. For fraud, you must show reasonable reliance on a false statement, omission, or stolen identity and an injury. For mistakes, the recipient must refuse to return the funds and be unjustly enriched. If the court finds a violation, the Attorney General must execute the reversal.

Debt-relief firms: lower fees, stricter rules

Debt‑management fees are capped: up to $50 for setup, monthly fees up to $10 per account but no more than $50, education fees up to $100, and dishonored‑payment fees up to $25. For settlement plans, fees can be collected only as debts are actually settled. Firms must renew yearly with audited financials and usually carry insurance of at least $250,000 or their peak trust balance; the Division can waive in limited cases. Many deceptive or risky practices are banned. The Division can investigate, subpoena, and adjust dollar amounts for inflation by rule. Starts May 6, 2026.

Lawyer referral services: clear contracts

Consultants must give a written contract in English and your native language before services. Contracts must state the purpose, price, and that the consultant is not an attorney, and include a 3‑business‑day cancellation right. You must get signed receipts and an accounting in your language. Ads must clearly say the consultant is not an attorney. Lying, false guarantees, and implying state approval are banned. Rules start May 6, 2026.

Protecting kids on social media and apps

Age checks for minors must be at least 95% accurate. Parents must get clear notice and confirmation for verifiable consent. App stores must share age‑category data and tell parents about ratings, content, and how apps use a child’s data. The Division can fine social‑media violations up to $2,500 per violation and courts can order payments to harmed users; up to $5,000 per violation if someone breaks an order. Starts May 6, 2026.

Safer rules for legal funding

Starting May 6, 2026, maintenance (legal) funding agreements must say the funder cannot make settlement decisions or interfere with your lawyer. They must state you repay only from claim proceeds and owe nothing if there are no proceeds, unless you commit fraud or materially breach. You can cancel within five business days by following the stated steps. The Division can fine up to $2,500 per violation and sue to stop unlawful practices and get refunds.

Solar sales: clearer costs and timing

Solar retailers must give a written disclosure before you sign. Any savings estimate must include key assumptions and may assume electricity rates rise no more than 3% per year. Installation cannot start until at least four business days after you sign. Disclosures must cover system details, warranties, interconnection, roof penetrations, fees, and who handles operations and maintenance. Starts May 6, 2026.

Stronger gym protections and refunds

Gyms must register each facility, show liability insurance, and keep a bond to protect members. Bond tiers are $5,000 (≤100 contracts), $10,000 (101–250), $15,000 (251–500), $35,000 (501–1,500), $50,000 (1,501–3,000), and $75,000 (3,001+). You can cancel a fitness contract by email or mail within three business days and get a refund minus the reasonable value of services used. Some low‑risk options are bond‑exempt, like single classes, small credit packages (≤$150 unused), monthly plans with ≤2 months paid ahead, and equal‑payment plans that stop if the gym closes. Renewals are yearly; late renewals add a $25 per month fee. Rules apply beginning May 6, 2026.

Stronger home solar buyer protections

Beginning May 6, 2026, solar retailers must give you the signed contract and disclosures in paper and electronic form, unless you decline paper in writing. They cannot start installation until four business days after you receive the signed agreement. If you cancel, they must return any signed checks and refund your money within 10 days. The Division can investigate, issue stop orders, fine up to $2,500 per violation, and sue for refunds. Fines in solar cases may go to harmed customers after a Division proceeding decides the amount.

Tougher rules for credit repair firms

Credit services companies must register and keep a $100,000 surety bond or $100,000 certificate of deposit. Before taking money, they must give you required written disclosures and keep your signed copy for two years. Contracts must be written, dated, signed, and clearly state a five‑day cancellation right. Violations are a class A misdemeanor, and buyers can recover at least what they paid, plus attorney fees. The Division can fine up to $2,500 per violation.

New protections for earned wage access

Beginning May 6, 2026, earned wage access (EWA) lets you get pay you already earned before payday. Providers must clearly disclose fees and timelines, offer at least one no‑fee way to get funds, and let you cancel anytime without penalty. They must deliver funds as agreed and reimburse overdraft or NSF fees they cause. Providers cannot sue you to collect, use debt collectors, report to credit bureaus, charge interest or late fees, require tips, or take credit‑card payments for repayment.

AI advice and accountability rules

The law defines high‑risk AI interactions, like collecting sensitive data or giving advice people may rely on for big financial, legal, medical, or mental health decisions. Companies and people remain responsible even if AI made the statement or acted. You cannot use AI as a defense for breaking consumer‑protection laws. Starts May 6, 2026.

New Consumer Protection Division and tools

On July 1, 2026, the state creates the Division of Consumer Protection to enforce many consumer laws. The director can write rules, investigate, and issue cease‑and‑desist orders. The Division may publish a public list of violators and set a process to remove names. The law also defines what counts as "transactional resources" to aid investigations, like phones, websites, bank accounts, and facilities.

Stronger privacy for nonprofit donors

Beginning May 6, 2026, donors to government entities can ask in writing to keep their name private. Donation terms stay public, and extra limits apply for non‑college agencies. The law also shields some unpublished higher‑education research materials. Public agencies generally cannot force nonprofits or individual donors to give personal donor data or release it. Narrow exceptions apply for election or lobbyist law, voluntary release, lawful warrants or court orders, audits, and specific regulatory oversight.

Postsecondary schools: oversight and student relief

The Division runs school registration, sets complaint rules and fees, and posts a list of registered or authorized schools. It can accept and provide copies of credentials from closed schools for a fee and may negotiate reciprocity agreements. The Division can investigate, audit, and bring cases; courts can order injunctions, disgorgement, refunds to harmed students, and production of school records. Fines go to the Consumer Protection Education and Training Fund. Starts May 6, 2026.

Franchises and business opportunities: filings and fines

Before offering business opportunities or franchises in Utah, you must file with the Division and get a one‑year receipt, then renew at least 30 days before it expires. The Division can fine up to $2,500 per violation and courts can add up to $5,000 per violation for breaking orders, plus attorney and investigative fees. The Division may deny, suspend, or revoke a receipt for false or incomplete filings, fraud findings, certain convictions, misrepresentations, missing information, or unpaid fines/fees. Filing fees go to the Commerce Service Account. Starts May 6, 2026.

New rules for legal funding companies

Beginning May 6, 2026, maintenance (legal) funding providers must register with the Division, pay an application fee, and renew yearly at least 30 days before expiration. Providers must update filings within 30 days when details change, file a template agreement before signing with a customer, and submit an annual report by April 1 with a CFO or principal’s declaration. The Division may deny, suspend, or revoke a registration for false filings, rule violations, fraud findings, or unpaid fines. Providers cannot pay or take referral fees with attorneys or health providers, pay court or attorney fees from the funding, influence case decisions, run false ads, or claim state endorsement. The Division sets forms and procedures by rule.

Penalties for personal use of campaign money

Beginning May 6, 2026, municipal candidates and officeholders may not spend campaign money on personal expenses like mortgage, rent, utilities, car payments, food, clothing, vacations, entertainment, or personal debts. Political and official expenses remain allowed, and cities may set stricter local rules. After a probable‑cause finding and a hearing, the lieutenant governor may order a 50% administrative penalty on a personal‑use amount and require the original amount back into the campaign account. Penalty money goes to the General Fund.

Tighter rules for immigration consultants

Beginning May 6, 2026, paid immigration consultants must register, pass a background check (no felony or theft/fraud/dishonesty misdemeanor in the past 10 years), and keep a $50,000 bond or certificate of deposit. Before services, they must give a written disclosure and a contract in the client’s language, with a bold notice that they are not attorneys and a 3‑business‑day cancellation right. Clients get signed receipts for each payment and an accounting every two months; originals must be returned right after copying, and copies kept for three years. Consultants cannot lie, guarantee results, or imply state endorsement. If harmed, clients can sue for the greater of $500 or twice their loss, plus court costs and reasonable attorney fees. The Division can fine up to $2,500 per violation; intentional violations after notice are class A misdemeanors with fines up to $10,000.

Bigger bonds and rules for debt managers

Beginning May 6, 2026, debt‑management providers must keep a $100,000 surety bond in place during registration and for two years after they stop. With approval, they can use a letter of credit or U.S. obligations instead of a bond. The Division can order fixes and restitution and fine up to $10,000 per violation, or up to $20,000 for violating a final order. The law expands who counts as an affiliate and lets Utah accept an out‑of‑state license if it is as detailed and the provider files a Utah‑payable bond. If sued over a Utah consumer’s claim, a provider must notify the Division within 30 days.

Enforcement fines and support fund

The law creates a Consumer Protection Education and Training Fund. The Division deposits fines, settlements, and other non‑restitution money into the fund and can spend it on education, training, investigations, and litigation. The Division can fine up to $2,500 per violation and increase unpaid fines by 10% after 60 days. Courts can also fine up to $2,000 per day for breaking restraining or injunction orders. If the fund exceeds $1,000,000 at year‑end, the extra goes to the General Fund.

Old consumer protection sections repealed

The law repeals many listed code sections in Title 13 and related chapters. These repeals take effect on the bill’s effective date unless another date is set in the law. This cleans up and consolidates consumer protection statutes under the new Division.

New registration rules for Utah colleges

Beginning May 6, 2026, most postsecondary schools must register with the Division before operating in Utah. Nonaccredited schools renew each year; accredited schools renew every two years. The Division may require background checks, and schools pay any related costs and fees. Accredited schools can obtain a state authorization certificate; public colleges’ certificates do not expire. Some providers remain exempt (such as certain SARA distance‑education schools with no Utah presence). If an exemption ends, the school must file to register within 30 days. Voluntary registration removes the statutory exemption.

Clearer rules for ride-share companies

Beginning May 6, 2026, the law defines a transportation network company as one that uses an app to connect passengers with drivers, and it excludes taxicabs and motor carriers. It says the company generally does not own or manage drivers’ vehicles, except for some vehicles with level 4 or 5 automated driving systems. This sets which app‑based services fall under these rules.

Clear auto-renewal rules and penalties

An auto‑renewal clause is one that renews into a paid term longer than 45 days. Print notices must stand out; audio notices must be easy to hear and understand. The Division can fine up to $2,500 per violation, courts can order payments to harmed people, and breaking an order can cost up to $5,000 per violation. Starts May 6, 2026.

Clear limits for gym contracts

Fitness center contracts must be in writing. The gym must give you a full copy when you sign. Contracts cannot be longer than 36 months. Auto‑renewals are allowed only if the gym gives notice 30–60 days before renewal. Contracts must state rules, equipment limits, and cancellation and refund policies.

Clear privacy and sensitive data rules

A “consumer” is a Utah resident acting in a personal or household setting, not for work or business. A “sale” of data means giving your personal data to a third party for money, with several exclusions (like sharing with processors or affiliates). Sensitive data includes health, genetic, biometric ID, immigration or citizenship, sexual orientation, religion, race/ethnicity, and precise location. Precise location means accuracy within 1,750 feet or less. Rules start May 6, 2026.

Ride-share fare and driver insurance notices

Apps must show how fares are calculated, give the rate used, and let riders see an estimated fare before a trip. Companies must tell drivers what insurance the company provides, including liability limits, and warn about coverage gaps. If a vehicle has a lien, drivers must be told to notify the lienholder. Starts May 6, 2026.

Ride‑app safety, access, and receipts

Starting May 6, 2026, apps must show the driver’s photo before you get in and send an electronic receipt with trip details and an itemized fare after the ride. Companies must post or give drivers a non‑discrimination policy. Drivers must allow service animals and help riders with physical disabilities without extra fees. Apps must also let you tell the driver if you have skis, big luggage, or a child seat.

Stronger 3-day cancel rights on sales

Before trying to sell to you, a seller must say their name, phone, full mailing address, and email. You can cancel most purchases by 11:59 p.m. on the third business day after you get the goods. If the seller did not tell you about the right to cancel, you have 90 days. If the seller did not give contact info, you can cancel at any time. Sellers must refund you, with a fair charge only for services you used. Starts May 6, 2026.

Stronger donor protections for fundraising

Fundraisers must deposit each donation into a separate bank account in the charity’s name within 10 days. Only the charity can withdraw funds. Fundraisers and consultants may work only under a written agreement filed with their registration. Ads for charity sales must say the dollar amount or percent per purchase that goes to the charity. Campaign records must be kept for five years.

More places to get lenses and glasses

Beginning May 6, 2026, certain providers can sell or fit contact lenses and sell eyeglasses without an optometry license if they follow strict rules. Contact lens fitting requires national optician certifications, no refractions, a permanent business site, and a valid, unexpired prescription or an eye exam within six months. Providers must keep a copy of the prescription for at least seven years and meet listed documentation limits for older supervision arrangements.

Broader consumer enforcement and court refunds

Beginning May 6, 2026, the Division can fine up to $2,500 per violation and sue to stop unlawful conduct. Courts can order refunds, disgorgement, and must award attorney fees, court costs, and investigative fees when judgment is granted. Breaking an administrative or court order can bring civil penalties up to $5,000 per violation. On referral, prosecutors can also sue. For Chapter 13‑28, fines are $100–$5,000 per violation, and intentional violations after certified‑mail notice are class A misdemeanors with fines up to $10,000.

Enforcement for vehicle value protection

Beginning May 6, 2026, the Division enforces vehicle value protection agreement rules. The director can fine up to $2,500 per violating act, and courts can order refunds, injunctions, and fines up to $2,500 per violation. Breaking an order can bring civil penalties up to $5,000 per violation. Fines go to the Consumer Protection Education and Training Fund.

Harsher penalties for lawyer referral firms

Beginning May 6, 2026, the Division can fine up to $2,500 per violation and sue to enforce the law against lawyer referral consultants. Courts can order disgorgement and must award attorney fees, costs, and investigative fees when judgment is granted. Intentional violations after certified‑mail notice are class A misdemeanors with fines up to $10,000. Breaking an order can bring civil penalties up to $5,000 per violation.

Internet safety PSAs with match

If funded, the Division contracts for public service announcements that warn consumers about internet risks. The Division may pay only a nonprofit that spends two private dollars for every public dollar. Contracts must follow state procurement rules. This begins May 6, 2026.

More business-opportunity deals now covered

Beginning May 6, 2026, a deal is a regulated business opportunity if it requires at least $500 upfront to start a business and meets other criteria. This brings more high‑upfront‑cost offers under consumer protections.

Privacy limits on pawn shop records

Beginning May 6, 2026, pawn and secondhand transaction records in the state database are protected. Law enforcement and the Division may use them only for specific investigations and enforcement. Insurers must give a police report number to get information. Wrongful release or use is a class B misdemeanor and can bring a civil penalty up to $250.

Licensing and penalties for EWA providers

Starting May 6, 2026, earned wage access providers must register with the Division, pay application and renewal fees, name a Utah registered agent, and update filings within 30 days of changes. Principals must submit fingerprints and pass criminal background checks at the provider’s expense. Each prohibited act counts as a separate violation, and providers do not get a general exemption under the consumer sales law. Providers may block new requests if the consumer has unpaid proceeds from a prior transaction.

Stronger denial rules for risky registrants

The Division can start formal proceedings to deny, suspend, or revoke a registration if that action is in the public interest. Grounds include false or incomplete applications, fraud findings, certain theft or fraud convictions, misrepresentations, failure to provide requested information, or unpaid fines or fees. Effective May 6, 2026.

Telemarketers face stricter registration actions

The Division may deny, suspend, or revoke telemarketing registrations when it is in the public interest. Triggers include false or incomplete filings, violating rules, fraud‑related orders, theft or fraud convictions, misrepresentations, failing to provide information, or unpaid fines or fees. Starts May 6, 2026.

Consumer Protection Division staffing change

The director can hire staff and designate an investigator as a special function officer. If designated, that investigator is not eligible for the Public Safety Employee retirement system.

New filing rules for charities

Starting January 1, 2025, charitable nonprofits must file the information required in Section 13‑22‑110 with the Division unless exempt. Foreign charitable nonprofits that seek authority to operate must also file that information and include a certificate of existence dated within 90 days. Listed statutory exemptions still apply.

Ride‑app company registration and fines

From May 6, 2026, a transportation network company must register with the Division, pay a fee, list a registered agent, and file insurance and policy documents. Registration lasts one year and must be renewed at least 30 days before it expires. Companies must update their registration within 30 days of changes. The Division can deny, suspend, or revoke a registration for false filings, rule or law violations, certain fraud orders or convictions, or unpaid fines and fees, and can fine up to $2,500 per violation.

Ask your ISP to block harmful content

Starting May 6, 2026, you can ask your internet provider to block material harmful to minors. Providers must notify subscribers of this option and use a commercially reasonable filter. The attorney general must give 90 days to fix problems before fines. Intentional violations can bring $2,500 per violation, up to $15,000 per day; notification failures can be fined up to $10,000. Providers may charge a commercially reasonable fee for filtering.

Clearer ride-hail rules and no cash

Beginning May 6, 2026, a prearranged ride starts when the driver accepts the trip in the app and ends when the passenger exits. The law defines who is a transportation network driver, including when a level 4 or 5 automated system operates the vehicle for pay. Drivers cannot take off‑app ride requests or accept cash; all payments must go through the app.

Faster insurance help after ride incidents

Beginning May 6, 2026, companies and their insurers must give a vehicle’s liability insurer the incident time and driver log‑in/log‑out within 10 business days. If a car with a lien is repaired under a covered comp or collision claim, payment must go to the repairer or jointly to the owner and primary lienholder. Companies must keep trip records for five years and driver records for five years after the driver last works.

Legal funding capped at $500,000

“Legal funding” is defined as a payment of $500,000 or less in exchange for a share of possible lawsuit proceeds. This sets the size limit for deals covered by state rules. Starts May 6, 2026.

Mental health chatbots rules and fines

Chatbots that act like therapy or are sold as therapy are regulated. Scripted tools or simple referral bots are not covered. The Division can fine up to $2,500 per violation and courts can order payments to harmed users; up to $5,000 per violation if someone breaks an order. Fines go to the Consumer Protection Education and Training Fund. Rules start May 6, 2026.

New rules for home solar contracts

Beginning May 6, 2026, retailer‑owned residential solar power purchase agreements must require at least five years of payments. The law also defines a residential solar system as more than 1 kW on up to four residential units, used mainly for on‑site home consumption.

Stronger rules for telemarketing and phone sales

Beginning May 6, 2026, sellers must register or fit an exemption before telemarketing. They cannot mislead buyers and must refund valid cancellations within 30 days. The Division can fine up to $2,500 per violation, and courts can order refunds, disgorgement, and $2,500 fines. Breaking an order can bring civil penalties up to $5,000. Some sellers are exempt if they meet strict tests, like catalogs with 24+ pages and 250,000 annual mailings or long‑running in‑person retailers. For Chapter 13‑25a, fines run $100–$2,500 per violation (or $1,000–$2,500 for soliciting on‑call emergency providers), with class A misdemeanor exposure for intentional violations.

Clearer limits on lobbyist gifts

Beginning May 6, 2026, the law defines how to add up a lobbyist’s daily spending for one public official. It sets who can approve an official’s attendance at an event as an approved activity. Small gifts may be exempt: food and drink up to the daily reimbursement rate, and non‑food items under $10 with daily totals under $10. The law also lists other specific exemptions, like certain event food, plaques, printed materials, and approved‑activity travel.

Fitness centers face stricter enforcement

Beginning May 6, 2026, the Division can fine fitness centers up to $2,500 per violation and seek court orders for refunds and disgorgement. Willful violations are class B misdemeanors, with a second offense as a class A misdemeanor and a third as a third‑degree felony. The Division can deny, suspend, or revoke a registration for reasons like false applications, unpaid fees, lapsed bonds, fraud orders, or certain convictions.

When the state can publish complaints

Consumer complaints are protected records. The Division cannot publicly name someone under investigation unless the case becomes public in court or the person agrees. If 10 or more similar complaints are filed about the same person within 12 months, the Division may make those complaints public.

Tougher oversight of postsecondary schools

Beginning May 6, 2026, the Division can set school registration forms, student outcome disclosures, and financial proof, including bonds up to the tuition and fees a school expects in a year. Schools must register (or be exempt), tell the truth in filings, and refund valid student requests within 30 days. The Division can fine $250 per day for unregistered operation, $1,000 for certain violations, $2,500 for other nonintentional violations, and $5,000 for intentional ones. Intentional violations after notice are class B misdemeanors, and fines go to the Consumer Protection Education and Training Fund.

Free Policy Watch

You just read the policy. Now see what it costs you.

Pick a topic. PRIA runs your household against live legislation and sends you a free personalized readout.

Pick a topic to get started

My Taxes My Health My Budget My Money My Freedom

Or tell us something more specific

Sponsors & Cosponsors

Sponsor

Todd Weiler
Republican • Senate

Cosponsors

Ashlee Matthews
Democratic • House

Roll Call Votes

All Roll Calls

Yes: 119 • No: 1

Senate vote • 2/27/2026

Senate/ concurs with House amendment

Yes: 22 • No: 0

House vote • 2/26/2026

House/ substituted

Yes: 0 • No: 0