On March 25, 2025, Utah Governor Spencer Cox signed HB 452, which establishes new rules for the use of artificial intelligence (AI) mental health chatbots accessible to any “Utah user,” defined as, “an individual located in the state at the time the individual accesses or uses a mental health chatbot.” Digital health companies and AI chatbot providers should take note of this new law to ensure compliance with its requirements.

HB 452 defines a “mental health chatbot” as an AI technology that meets two criteria. First, the technology must use generative AI “to engage in interactive conversations with a user of the mental health chatbot, similar to the confidential communications that an individual would have with a licensed mental health therapist.” Second, the “supplier” of the chatbot must represent, or a reasonable person would have to believe, that the chatbot “can or will provide mental health therapy or help a user manage or treat mental health conditions.”

Under HB 452, it is unclear whether the term “supplier” refers to the website operator or the chatbot vendor, but the statute cross-references the Utah Consumer Sales Practices Act, which defines “supplier” as a “seller, lessor, assignor, offeror, broker, or other person who regularly solicits, engages in, or enforces consumer transactions, whether or not he deals directly with the consumer.” Given the emphasis on “regularly soliciting, engaging in, or enforcing consumer transactions,” (emphasis added), the law would seem to be focused in particular on the consumer-facing website operator, but the addition of “whether or not he deals directly with the consumer” may create some ambiguity.

HB 452 restricts suppliers of mental health chatbots from the following:

• “selling” or “sharing” individually identifiable health information of a user or any content provided by a user, except when the information is provided to a health care provider with the consent of a Utah user or a health plan at the request of a Utah user. The supplier may share individually identifiable health information with service providers if such sharing is in compliance with the HIPAA Rule requirements, including by entering into a business associate agreement;
• advertising a specific product or service to a user, unless the supplier clearly and conspicuously identifies the advertisement as an ad, and discloses the third-party that is sponsoring the ad;
• engaging in targeted advertising based on any input from the user. The supplier may recommend that a user seek counseling, therapy, or other assistance from a licensed professional, including a specific licensed professional; and
• operating a mental health chatbot without clearly and conspicuously disclosing that the mental health chatbot is an AI technology and not a human (1) prior to the user accessing the mental health chatbot’s features for the first time; (2) any time the user has not accessed the mental health chatbot’s features for more than seven days; and (3) when a user asks whether AI is being used.

Violations of HB 452 are enforced by the Utah Division of Consumer Protection and can result in fines of up to $2,500 for each violation, disgorgement, and attorneys’ fees, among other remedies.

HB 452 provides suppliers of mental health chatbots an affirmative defense to allegations that they are providing mental health services without a license or engaged in unprofessional conduct if they do the following:

• maintain documentation that describes foundation models used in development, training data used, compliance with federal health privacy regulations, user data collection and sharing practices, and ongoing efforts to ensure accuracy, reliability, fairness, and safety; and
• maintain a written policy to be filed with the Utah Division of Consumer Protection that:
  • states the intended purpose, abilities, and limitations of the mental health chatbot;
  • describes how licensed mental health therapists are involved in the development and review process;
  • ensures the mental health chatbot is developed and monitored in a manner consistent with clinical best practices;
  • conducts testing, prior to making the mental health chatbot publicly available and regularly thereafter, to ensure that the output of the mental health chatbot poses no greater risk to a user than that posed to an individual in therapy with a licensed mental health therapist;
  • identifies reasonably foreseeable adverse outcomes to, and potentially harmful interactions with, users that could result from using the mental health chatbot;
  • provides a mechanism for a user to report any potentially harmful interactions from use of the mental health chatbot;
  • implements protocols to assess and respond to risk of harm to users or other individuals;
  • details actions taken to prevent or mitigate any such adverse outcomes or potentially harmful interactions;
  • implements protocols to respond in real time to acute risk of physical harm;
  • reasonably ensures regular, objective reviews of safety, accuracy, and efficacy, which may include internal or external audits;
  • provides users any necessary instructions on the safe use of the mental health chatbot;
  • ensures users understand they are interacting with AI;
  • ensures users understand the intended purpose, capabilities, and limitations of the mental health chatbot;
  • prioritizes user mental health and safety over engagement metrics or profit;
  • implements measures to prevent discriminatory treatment of users; and
  • complies with HIPAA as if it were a covered entity, as well as applicable consumer protection requirements under Utah state law.

Action Items

Companies should carefully review HB 452’s requirements to ensure that their mental health chatbots comply with the law’s new requirements. In particular, such companies should:

• determine whether they are subject to the law as a supplier of a mental health chatbot to Utah users (as such terms are defined by HB 452);
• review their advertising settings and consumer disclosures to ensure they meet the requirements of HB 452;
• ensure that the mental health chatbot includes appropriate consumer disclosures regarding the use of AI technology; and
• consider developing and filing with the Utah Division of Consumer Protection a policy for their mental health chatbots.

Wilson Sonsini routinely advises clients on data, privacy, and cybersecurity laws and regulations and counsels companies facing enforcement actions. For more information about the developments mentioned above, or any other advice concerning U.S. data, privacy, and cybersecurity regulation, please contact Maneesha Mithal, Andrea Linna, Hale Melnick, Nawa Lodin, Kristen Abram, or another member of the firm’s Data, Privacy, and Cybersecurity or Healthcare Regulatory practices.