The Utah Consumer Privacy Act (UCPA, Utah Code § 13-61-101) has simpler cookie requirements than most other US state privacy laws.

This page covers one piece of the picture. For the full scope of the UCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the UCPA and cookies.

No GPC requirement. No opt-in model for sensitive data. No mandatory link text. It is opt-out for targeted advertising and data sales, with clear disclosure in the privacy notice.

But simple does not mean careless. Any site using a Meta Pixel, Google Ads, or any pixel that sends data to external advertising networks is operating targeted advertising under the UCPA and must offer opt-out.

This article focuses on what the UCPA requires from a Cookies Policy: what the document must contain and how opt-out must work.

The cookie banner is the consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the consent notice itself.

Utah Code § 13-61-302(1)(a) requires the privacy notice to include the purposes for which categories of personal data are processed. For cookies, this translates into describing the purpose of each tracker category with enough clarity for the consumer to understand what is happening.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data including pages visited and session duration, to identify content improvement opportunities. Data is not sold to third parties."

"Advertising cookies: collect behavioral identifiers shared with advertising platforms for targeted advertising on non-affiliated websites. Consumers may opt out via the mechanism described in the privacy notice."

The Policy must list the tracker categories operating on the site:

Necessary cookies: essential for basic functionality. Authentication, session, shopping cart. Do not constitute targeted advertising or data sale. Must be documented.

Analytics cookies: measure browsing behavior. Depending on the tool, may constitute targeted advertising if data is sent to third parties who use it for targeting on other sites.

Advertising cookies: feed ad pixels and build behavioral profiles for targeted advertising on non-affiliated sites. Almost always constitute "targeted advertising" under the UCPA. Require opt-out.

Functional cookies: remember user preferences. Generally do not constitute targeted advertising or data sale.

Third-party cookies: fired by external services. Correct tag categorization is what makes accurate documentation possible.

Utah Code § 13-61-101(34) defines targeted advertising as ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or online applications.

What does not constitute targeted advertising:

Ads based on activities within the controller's own site or affiliated sites.

Ads based on the context of the current search query or current visit.

Ads directed to a consumer in response to a request for information, product, service, or feedback.

Processing data solely to measure advertising performance, reach, or frequency.

Retargeting campaigns using consumer behavior data from other sites almost always constitute targeted advertising under the UCPA.

Utah Code § 13-61-101(31) defines sale as the exchange of personal data for monetary consideration to third parties.

Key difference from the CPRA: the UCPA uses only "sale" for monetary consideration. It does not include the concept of "sharing" for behavioral advertising without direct payment, as the CPRA does. This means exchanging data for advertising services, without direct payment, may not constitute "sale" under the UCPA, while it would constitute "sharing" under the CPRA.

Not a sale: disclosure to processors, disclosure to affiliates, disclosure consistent with reasonable consumer expectations given the context, consumer-directed disclosure, and M&A transfers.

The Policy must identify the categories of third parties receiving data via cookies (§ 13-61-302(1)(a)(v)).

This includes digital advertising platforms, analytics tools, and any other partner receiving user data via cookies.

The UCPA does not require the Cookies Policy to specify data retention periods. This is a requirement that laws like the CPRA have, but the UCPA does not.

Including retention information is a best practice and facilitates compliance with other jurisdictions, but it is not required by Utah law.

Utah Code § 13-61-302(1)(b) requires that, if the business sells data or uses data for targeted advertising, it informs the consumer clearly and conspicuously and describes how to exercise the opt-out.

The UCPA does not specify the exact format of the opt-out mechanism. It may be:

A link or button in the cookie notice or banner.

A footer link leading to a preferences page.

An online form described in the privacy notice.

What the UCPA does not require: a specific text for the opt-out link (unlike the CPRA which requires "Do Not Sell or Share My Personal Information"). The controller has freedom to define the opt-out presentation.

A well-configured consent management platform ensures that when the user exercises opt-out, all advertising pixels and trackers automatically stop firing.

Utah Code § 13-61-101(32) defines sensitive data to include, among others, specific geolocation data and biometric data for identification.

If the site collects precise geolocation (within 1,750 feet) via cookies or tracking technology, that is sensitive data under the UCPA.

For sensitive data, the UCPA requires (§ 13-61-302(3)):

Presenting the consumer with a clear notice before processing.

Offering the consumer the opportunity to opt out of the processing.

This differs from the opt-in required by other laws. Under the UCPA, the business may begin processing sensitive data after presenting the notice, unless the consumer refuses.

The Cookies Policy must identify which types of cookies may collect sensitive data and describe the corresponding opt-out mechanism.

Utah Code § 13-61-101(9) defines consent as an affirmative act by a consumer that unambiguously indicates their voluntary and informed agreement to allow processing of personal data.

For non-necessary cookies, the correct standard is opt-out: targeted advertising technologies may be active by default, but the consumer must have an easy opt-out mechanism.

For sensitive data collected via cookies, the UCPA requires a clear notice and opt-out opportunity before processing.

What is not adequate: processing data for targeted advertising without any opt-out mechanism described in the privacy notice.

Unlike the CPRA (California) and CTDPA (Connecticut), the UCPA does not mention the obligation to honor universal opt-out signals such as the Global Privacy Control (GPC).

However, implementing the GPC is a best practice: it covers requirements in other jurisdictions where visitors may be located, and demonstrates a privacy commitment that goes beyond the minimum required.

Situations requiring an update:

Adding a new advertising pixel or tracker.

A new analytics tool sending data to third parties for targeting.

A new partner receiving behavioral data from site users.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms.

Continuous data mapping is what keeps the cookie inventory synchronized with the document.

The Attorney General must guarantee 30 days to cure before initiating any action (§ 13-61-402(3)). An inadequate Cookies Policy can be corrected within that period if the business has its processes structured.

If the violation continues after 30 days, penalties can reach US$ 7,500 per violation, with each affected consumer potentially constituting a separate violation.

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The cookie notice configured through AdOpt blocks non-necessary trackers, presents categories with clear descriptions, offers opt-out from targeted advertising, and logs every interaction for audit purposes.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Cookies Policy for your site that complies with the UCPA? Talk to our team.

Visible link in the site footer and in the cookie banner.

Listing of cookie categories with a description of what each does on the site.

Specific purpose for each category, without vague descriptions (§ 13-61-302(1)(a)(ii)).

Identification of cookies constituting targeted advertising (§ 13-61-101(34)).

Identification of cookies constituting data sale (§ 13-61-101(31)).

Categories of third parties receiving data via cookies (§ 13-61-302(1)(a)(v)).

Opt-out mechanism for targeted advertising and data sales, clear and conspicuous (§ 13-61-302(1)(b)).

Clear notice and opt-out for sensitive data collected via cookies (§ 13-61-302(3)).

Accessible language, without legal jargon.

No impediments to exercising opt-out.

1. Does the UCPA require specific text for the targeted advertising opt-out link?
No. Unlike the CPRA, which requires the specific text "Do Not Sell or Share My Personal Information," the UCPA only requires the business to inform the consumer clearly and conspicuously about how to exercise the opt-out (§ 13-61-302(1)(b)). The controller has freedom to define the text and format of the opt-out mechanism, as long as it is accessible and clear.

2. Do analytics cookies constitute targeted advertising under the UCPA?
It depends. If analytics data stays internal or is sent to the provider only to generate reports without use for targeting on other sites, it generally does not qualify as targeted advertising. If the tool sends data used for ad segmentation on other non-affiliated sites, it may. The UCPA's criterion is "data obtained from the consumer's activities over time and across non-affiliated websites or online applications" (§ 13-61-101(34)).

3. Does the UCPA require sites to honor the Global Privacy Control (GPC)?
No. The UCPA does not mention the obligation to honor universal opt-out signals like the GPC. This distinguishes Utah from California (CPRA) and Connecticut (CTDPA), where the GPC is recognized as a valid opt-out. However, implementing the GPC is a best practice for sites that also serve consumers in those other jurisdictions.

4. How does the UCPA treat cookies that collect precise geolocation data?
Specific geolocation data (within 1,750 feet) is sensitive data under the UCPA (§ 13-61-101(32)(a)(iii) and 33). To process it, the business must present the consumer with a clear notice and offer an opt-out opportunity before starting processing (§ 13-61-302(3)). Unlike other laws that require active prior consent (opt-in), the UCPA uses an opt-out model even for sensitive data.

5. Is data selling via cookies under the UCPA different from the CPRA?
Yes, significantly. The CPRA includes the concept of "sharing" for cross-context behavioral advertising even without direct payment. The UCPA uses only "sale," which requires monetary consideration (§ 13-61-101(31)). This means sharing data with advertising networks without direct payment may not constitute "sale" under the UCPA, while it would constitute "sharing" under the CPRA. For sites serving consumers in both states, the CPRA's broader definition should be used as the reference.

Ready to build a Cookies Policy for your site that complies with the UCPA? Talk to our team.