Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
Regulations › US states › Utah

UCPA

Utah Consumer Privacy Act

In force privacy consumer rights
WhenIn effect since 31 December 2023
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.

One of the more business-friendly state laws, with narrower rights and higher thresholds.

The law in brief

The Utah Consumer Privacy Act (UCPA) is Utah's comprehensive consumer privacy law. It has been in effect since 31 December 2023. Like the other state laws built on the same model, it gives Utah residents rights over their personal data and puts duties on the businesses that decide how that data is used (controllers) and on the vendors that handle it for them (processors).

One of the more business-friendly state laws, with narrower rights and higher thresholds.

Who it applies to

  • Businesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
  • The thresholds usually turn on how many Utah residents' personal data a business handles in a year, and whether it earns revenue from selling personal data. Check the statute for the exact figures.
  • Like most state privacy laws, it exempts some organizations and data, commonly including data already covered by HIPAA or the Gramm-Leach-Bliley Act, and data about people acting in an employment or commercial capacity.

What it requires

A clear privacy notice

Publish a privacy notice describing the categories of personal data you process, why, what you share and with whom, how consumers can use their rights, and how to appeal.

Collect only what you need

Limit collection to what is adequate, relevant and reasonably necessary for the purposes you disclosed, and secure it with reasonable safeguards.

Sensitive data

Tell consumers before processing sensitive data, such as health, biometric, precise location or children's data, and give them a chance to opt out.

Contracts with processors

Bind each processor by contract to your instructions, confidentiality, deletion or return at the end of the service, and help with audits and assessments.

Honor opt-outs

Stop targeted advertising, sales and, where covered, qualifying profiling for consumers who opt out, and check whether the law requires you to honor universal opt-out signals such as Global Privacy Control.

People's rights

Utah residents can ask a business to confirm and access their personal data, delete it, and get a copy in a portable format, and can opt out of targeted advertising and the sale of their data. Unlike most state laws, UCPA does not include a right to correct data or to opt out of profiling. Businesses have 45 days to respond, which can be extended.

Enforcement and penalties

Enforced by the Utah Attorney General. Violations carry civil penalties set by the statute.

What to do first

  1. Check the thresholds against your Utah consumer numbers and any data sales.
  2. Map the personal and sensitive data you hold about Utah residents.
  3. Update your privacy notice and add the opt-out routes the law requires.
  4. Set up requests and appeals within the response deadlines.
  5. Put UCPA-ready terms in processor contracts.
  6. Build one program for all state laws, then add Utah's departures.

Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.

Recent developments

Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.

Sources