Utah
Utah Consumer Privacy Act (UCPA)
- Effective date
- December 31, 2023
- Enacted
- March 24, 2022
- Enforcement
- Utah Attorney General, following Division of Consumer Protection process
- Last reviewed
- October 3, 2026
Overview
At a Glance
Effective Date
December 31, 2023
Enforcement Authority
Utah Attorney General, following Division of Consumer Protection process
Consumer Request Deadline
45 days; one additional 45-day extension when reasonably necessary.
Cure Period
30-day cure period.
30-day cure period.
Universal Opt-Out / GPC
No
Private Right of Action
No
Sensitive Data Consent
No
Notice and opt-out model
Appeals Process
No
Applicability
Who Does This Law Apply To?
Applies only when a revenue threshold is met and the business also meets one of the data-volume/sale-revenue tests.
General Coverage Thresholds
- Annual revenue
- $25 million or more (required in addition to a volume threshold)
- Consumer volume
- 100,000+ Utah consumers per year
- Data sales
- Or 25,000+ consumers and over 50% of gross revenue from selling personal data
- Business nexus
- Conducts business in Utah or targets residents
Rights
Consumer Rights
Right to Opt Out of Sale
Opt out of sale of covered personal data as defined by the statute.
Right to Access
Confirm processing and access covered personal data, subject to statutory limits.
Right to Delete
Request deletion of covered personal data, subject to exceptions.
Right to Data Portability
Obtain covered personal data in a portable format where the statute provides.
Right to Opt Out of Targeted Advertising
Opt out of covered targeted or cross-context behavioral advertising.
Obligations
Business Obligations
- AppealsNot requiredNo general internal appeal process required by this omnibus law.
- Data securityRequiredMaintain reasonable administrative, technical, and physical safeguards as required by the statute.
- Privacy noticeRequiredProvide required privacy disclosures/notices.
- Sensitive dataState-specificSensitive-data processing generally requires notice and an opportunity to opt out rather than a broad opt-in-consent requirement.
- Data minimizationRequired / state-specificLimit or govern collection/use consistent with the statute's duties and disclosed purposes.
- Universal opt outNot requiredNo general universal opt-out mechanism requirement in the current omnibus law.
- Processor contractsRequiredUse contracts governing processors/service providers as required.
- Consumer request processRequiredProvide methods for consumers to exercise statutory rights.
- Data protection assessmentNot requiredNo general data protection assessment duty in this omnibus law.
Exemptions
Common Exemptions
Exemptions are state-specific and may apply at the entity level, data level, or both. Verify the official statute before relying on an exemption. Treatment commonly varies for government, regulated financial/health information, higher education, nonprofits, employment data, and B2B data.
This list is not exhaustive.
Enforcement
Enforcement & Penalties
Authority: Utah Attorney General, following Division of Consumer Protection process
Actual damages to the consumer plus up to $7,500 per violation in Attorney General enforcement.
Self-check
Could This Law Apply to My Business?
Your result
Answer the 4 questions to see a general, educational indication.
Sources
Sources & Verification
- View source
Utah Consumer Privacy Act (statute)
State legislature
- View source
iapp.org
Secondary reference
- View source
ncsl.org
Secondary reference
- View source
privacylawnetwork.com
Secondary reference
- View source
ketch.com
Secondary reference
Last reviewed: October 3, 2026· Verified against official sources
From understanding to action
Digital Data Rights helps you understand the privacy landscape.
DataRightsOS helps businesses put privacy processes into operation.
Educational information only, not legal advice. Summaries may omit details; verify against the statute, regulations and official guidance.