Utah is the most business-friendly state in the US privacy landscape.

The Utah Consumer Privacy Act (UCPA), Utah Code § 13-61-101 et seq., took effect on December 31, 2023. It is the leanest state privacy law among those approved so far in the US, with fewer obligations for businesses and stronger protection for the traditional business model.

But "lean" does not mean ignorable. The US$ 25 million revenue threshold creates a well-defined scope, and the Utah Attorney General has exclusive enforcement authority.

The Utah Consumer Privacy Act is Utah's state personal data protection law. It grants basic rights to state residents and creates obligations for businesses that process their data.

Enforcement follows a two-stage model: the Division of Consumer Protection receives and investigates consumer complaints. If it finds substantial evidence of a violation, it refers to the Utah Attorney General, who has exclusive authority to initiate enforcement actions.

There is no private right of action.

On December 31, 2023.

Under Utah Code § 13-61-102(1), the law applies to controllers or processors that:

Conduct business in Utah or produce products or services targeted to state residents;

Have annual revenue of US$ 25,000,000 or more; and

Meet at least one of the following thresholds:

Control or process personal data of 100,000 or more consumers during a calendar year; or

Derive more than 50% of gross revenue from the sale of personal data and control or process personal data of 25,000 or more consumers.

The key differentiator from other laws: the UCPA requires the business to satisfy the US$ 25 million revenue requirement AND at least one of the volume thresholds. Other state laws use one or the other. Here both are needed. This significantly reduces the number of businesses in scope.

Understanding the distinction between controller and processor is fundamental to defining responsibilities in the processing chain.

Under Utah Code § 13-61-102(2), the following are exempt:

Government entities and third parties contracted on their behalf.

Native American tribes.

Institutions of higher education.

Nonprofit corporations.

HIPAA covered entities and business associates.

HIPAA-protected health information and related health data in specific situations.

Regulated clinical research data.

Consumer credit data regulated by the Fair Credit Reporting Act.

Financial institutions and data regulated by the Gramm-Leach-Bliley Act.

Data regulated by the Driver's Privacy Protection Act.

Data regulated by FERPA.

Data regulated by the Farm Credit Act.

Employee, job applicant, and independent contractor data in an employment context.

Data processed for purely personal or household purposes.

Air carriers.

Under Utah Code § 13-61-101(24), personal data is any information linked or reasonably linkable to an identified individual or an identifiable individual.

Not personal data: de-identified data, aggregated data, and publicly available information.

The UCPA also defines pseudonymous data (§ 13-61-101(28)) as personal data that cannot be attributed to a specific individual without additional information kept separately and under appropriate technical and organizational measures. Pseudonymous data has limited protection under the UCPA.

Under Utah Code § 13-61-101(32), sensitive data includes:

Personal data revealing racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or information about medical history, physical or mental health condition, or medical treatment or diagnosis.

Processing of genetic personal data or biometric data, where the processing is for the purpose of identifying a specific individual.

Specific geolocation data.

Note on the UCPA's sensitive data model: unlike the CPRA and several other state laws, the UCPA does not require consent to process sensitive data. It only requires the business to present a clear notice and offer an opt-out opportunity before processing. This is one of the aspects that makes the UCPA more business-friendly than other state laws.

For data of known children (under 13), businesses must comply with COPPA requirements (§ 13-61-102(3)).

Under Utah Code § 13-61-101(33), specific geolocation data means information derived from technology, including GPS coordinates, that directly identifies an individual's specific location with a precision of 1,750 feet or less.

Under Utah Code § 13-61-201, Utah residents have four rights:

Right to confirm and access: confirm whether the controller is processing personal data and access that data (§ 13-61-201(1)).

Right to deletion: request deletion of personal data the consumer provided to the controller. Note: the UCPA limits the deletion right to data the consumer provided. Data the controller obtained from other sources does not need to be deleted under the UCPA (§ 13-61-201(2)).

Right to portability: obtain a copy of the data in a portable format where technically feasible, for transmission to another controller without impediment (§ 13-61-201(3)).

Right to opt-out: refuse processing of personal data for targeted advertising or sale of personal data (§ 13-61-201(4)).

No right to correct inaccurate data. The UCPA does not guarantee this right, unlike the CPRA, OCPA, VCDPA, and CTDPA.

No right to opt-out of profiling. The UCPA covers only targeted advertising and data sales.

No formal structured appeal process. The law does not define an appeal process for controller denials.

Under Utah Code § 13-61-203:

45 days to respond from receipt of the request.

Extension of +45 days when reasonably necessary due to complexity or volume, with notification within the initial period.

Free for the first request from each consumer per 12-month period (§ 13-61-203(4)(a)).

From the second request in the same 12-month period, the business may charge a reasonable fee or refuse if the request is excessive, repetitive, technically infeasible, manifestly unfounded, or if the controller reasonably believes the primary purpose is not exercising a right.

This is one of the most important points of the UCPA for businesses already compliant with other laws.

Under Utah Code § 13-61-302(3), the controller may not process sensitive data collected from a consumer without first:

Presenting the consumer with a clear notice; and

Offering the consumer the opportunity to opt out of the processing.

This opt-out model for sensitive data is substantially less restrictive than the opt-in (prior consent) model required by the CPRA, OCPA, CTDPA, and VCDPA. Businesses already compliant with the more restrictive laws will automatically be compliant with the UCPA on this point.

Under Utah Code § 13-61-302, the controller must:

Privacy notice: provide a reasonably accessible and clear privacy notice including: categories of personal data processed, purposes of processing, how consumers can exercise their rights, categories of data shared with third parties (if any), and categories of third parties with whom data is shared.

Data security: establish, implement, and maintain reasonable administrative, technical, and physical data security practices proportionate to the volume and nature of the data.

Disclosure of sale and targeted advertising: if the business sells data or uses data for targeted advertising, it must clearly and conspicuously inform the consumer and provide an opt-out mechanism.

Non-discrimination: may not discriminate against consumers who exercise their rights.

Processor contracts: before engaging processors, the controller must enter into contracts with specific requirements including processing instructions, confidentiality obligations, and subcontractor requirements.

Cookies that collect personal data or allow user identification fall within the UCPA's scope.

The site must display a clear cookie notice, provide an opt-out mechanism for targeted advertising and data sales, and describe in the privacy notice how consumers can exercise their rights.

Correct tag categorization is what makes it possible to identify which cookies constitute targeted advertising or data sales.

The UCPA defines targeted advertising in § 13-61-101(34) as ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications. Ads based on activities within the controller's own site do not qualify.

The UCPA does not require honoring the GPC. Unlike the CPRA (California) and CTDPA (Connecticut), the UCPA does not mention the obligation to honor universal opt-out signals such as the Global Privacy Control. However, implementing the GPC is a best practice that covers requirements in other jurisdictions.

Under Utah Code § 13-61-402, the Utah Attorney General has exclusive enforcement authority.

The process follows two stages:

Stage 1: the consumer files a complaint with the Division of Consumer Protection. The Division investigates and, if it finds substantial evidence of a violation, refers to the Attorney General.

Stage 2: the AG notifies the controller in writing, identifying violations and providing 30 guaranteed days to cure.

If the controller cures the violation within 30 days and provides a written statement that the violation has been cured and will not recur, no action is initiated.

If the violation continues or the controller breaches the provided statement, the AG may initiate action and recover:

Actual damages to the consumer.

Up to US$ 7,500 per violation.

The 30-day cure period is guaranteed permanently by the UCPA, unlike other laws such as the OCPA and CPRA that have eliminated the cure period. This makes UCPA enforcement more predictable for businesses.

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, and generates the auditable log needed in an Attorney General investigation.

The automatic scan identifies all active trackers on the site, feeding the data inventory required for the privacy notice. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Ready to bring your website into compliance with the Utah UCPA? Talk to our team.

Compliance with the UCPA rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

1. What makes the UCPA different from other US state privacy laws?
The UCPA is the most business-friendly state privacy law among those approved in the US so far. Key differences: requires both US$ 25M revenue AND at least one volume threshold (dual requirement), while other laws use one or the other; uses opt-out for sensitive data, while most other laws require opt-in (consent); no right to correct data; no right to opt-out of profiling; and maintains a guaranteed 30-day cure period permanently, while other laws are eliminating that period.

2. Why does the UCPA use opt-out for sensitive data instead of opt-in?
The UCPA reflects the Utah legislature's philosophy of creating a law that protects consumers without creating excessive barriers for businesses. The opt-out model for sensitive data (Utah Code § 13-61-302(3)) requires the business to inform the consumer and give them the opportunity to refuse, but does not require active prior consent. This is significantly less restrictive than the consent standard required by the CPRA, OCPA, and other laws.

3. Does the UCPA have a right to correct inaccurate data?
No. This is one of the most notable absent rights in the UCPA. The law only guarantees four rights: confirm/access, deletion (limited to data provided by the consumer), portability, and opt-out from targeted advertising and data sales. Correction of inaccurate data is not among them, distinguishing the UCPA from the VCDPA, OCPA, CTDPA, and CPRA.

4. What does the limited deletion right in the UCPA mean?
The UCPA's deletion right (§ 13-61-201(2)) applies only to personal data the consumer provided to the controller. Data the controller obtained from other sources, such as data brokers, third-party lists, or inferences created from other data, do not need to be deleted under the UCPA. This is a significant difference from the OCPA and CTDPA, which require deletion of data from any source.

5. What is the penalty for UCPA non-compliance?
The Attorney General can recover actual consumer damages and up to US$ 7,500 per violation. Before initiating any action, the AG is required to notify the controller and grant 30 days to cure (§ 13-61-402(3)). This 30-day period is guaranteed permanently by the UCPA. If the controller cures the violation and provides a written statement, no action is initiated. There is no private right of action for consumers (§ 13-61-305).

Ready to bring your website into compliance with the Utah UCPA? Talk to our team.