1. (1) A governmental entity's government website shall include notice to a user of:

   1. (a) the identity of the governmental entity responsible for the government website;
   2. (b) how to contact the governmental entity that is responsible for the government website;

   3. (c) the method by which a user may:

      1. (i) seek access to the user's personal data or user data;
      2. (ii) request to correct or amend the user's personal data or user data; and
      3. (iii) file a complaint with the data privacy ombudsperson; and
   4. (d) how an at-risk employee may request that the at-risk employee's personal information be classified as a private record under Section 63G-2-302.

2. (2) In addition to the website privacy notice requirement described in Subsection (1)(a), a government website that collects user data shall include in the website privacy notice the following information:

   1. (a) any website tracking technology that is used to collect user data on the government website;
   2. (b) what user data is collected by the government website;
   3. (c) all intended purposes and uses of the user data;

   4. (d) the classes of persons and governmental entities:

      1. (i) with whom the governmental entity shares user data; or
      2. (ii) to whom the governmental entity sells user data; and
   5. (e) the record series in which the user data is included.

3. (3) A notice described in Subsection (1) or (2) shall be provided by prominently posting on the homepage of the government website:

   1. (a) the notice; or
   2. (b) a link to a separate webpage containing the notice.
4. (4) A governmental entity may not collect user data on a government website unless the governmental entity has complied with the requirements in this section.

Enacted by Chapter 475, 2025 General Session