The Utah Consumer Privacy Act (UCPA, Utah Code § 13-61-101) is the most straightforward state privacy law in its Privacy Policy requirements.

This page covers one piece of the picture. For the full scope of the UCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the UCPA and cookies.

No actively monitored contact channel like the OCPA requires. No mandatory retention periods like the CPRA. No detailed description of how each third party may process data like the OCPA requires. Five categories of information that must be in the document, and that is it.

But simple does not mean trivial. The law still requires real transparency about what is happening with Utah consumers' data.

This article focuses exclusively on what the UCPA requires from the Privacy Policy, based on the official text of the law.

The law uses the term "privacy notice." In practice, it is the Privacy Policy most sites already have.

Utah Code § 13-61-302(1)(a) requires the controller to provide consumers with a privacy notice that is "reasonably accessible and clear."

The notice must list the categories of personal data the controller processes (§ 13-61-302(1)(a)(i)).

Personal data under the UCPA is any information linked or reasonably linkable to an identified or identifiable individual. This includes identifiers such as name, email, IP address, browsing history, location data, and any data that allows tracking a person.

De-identified data, aggregated data, and publicly available information are excluded.

The notice must explain the purposes for which each category of data is processed (§ 13-61-302(1)(a)(ii)).

The UCPA does not explicitly list that purposes must be as specific as required by other laws like the VCDPA, but the requirement that the notice be "reasonably accessible and clear" implies that "improve services" is not sufficient. "Behavioral data to identify usability improvement opportunities" is the correct level.

The notice must describe how consumers can exercise the rights guaranteed by the UCPA (§ 13-61-302(1)(a)(iii)).

The four rights under the UCPA are:

Confirm and access: know whether the controller processes data and access that data.

Deletion: request deletion of data the consumer provided to the controller.

Portability: obtain a copy of the data in a portable format for transmission to another controller.

Opt-out: refuse processing for targeted advertising or data sales.

For each right, the notice must describe the request submission channel and the 45-day response deadline.

What the UCPA does not require to be described: a formal appeal process (the law has no such structured mechanism), a right to correct (the UCPA does not provide this right), and a right to opt-out of profiling (not covered by the law).

If the business shares data with third parties, the notice must list which categories of data are shared (§ 13-61-302(1)(a)(iv)).

This covers analytics tools, advertising platforms, CRMs, payment processors, and any external service that receives user data.

The UCPA uses the concept of "sale" of data, defined in § 13-61-101(31) as the exchange of personal data for monetary consideration to third parties. Sharing without monetary consideration does not constitute "sale" under the UCPA, unlike the CPRA which includes the concept of "sharing" for behavioral advertising even without payment.

Beyond the categories of data, the notice must identify the categories of third parties with whom data is shared (§ 13-61-302(1)(a)(v)).

Categories such as "audience analytics platforms," "marketing automation tools," and "payment processors" are valid examples.

The UCPA does not require the level of detail the OCPA demands (entity type and how each third party may process data). Identifiable categories are sufficient.

If the business sells data or uses data for targeted advertising, Utah Code § 13-61-302(1)(b) requires clear and conspicuous disclosure, along with the opt-out method.

Targeted advertising, per § 13-61-101(34), consists of ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or online applications. Ads based on activities within the controller's own site do not qualify.

If the site uses a Meta Pixel, Google Ads, or any pixel that sends data to external advertising networks, the business is operating targeted advertising and must disclose this explicitly.

This is the point that most differentiates the UCPA from other state laws. Utah Code § 13-61-302(3) requires that, before processing sensitive data, the controller:

Present the consumer with a clear notice; and

Offer the consumer the opportunity to opt out.

Prior consent is not required. The business may process sensitive data, provided it informs the consumer and gives them the option to refuse before starting.

Sensitive data under the UCPA includes: health and medical data, genetic and biometric data for identification, specific geolocation data, racial or ethnic origin, religious beliefs, sexual orientation, and citizenship or immigration status.

For data of known children (under 13), the business must comply with COPPA (§ 13-61-102(3)), which in practice requires verifiable parental consent.

The Privacy Policy must:

Identify whether the business processes sensitive data.

Describe how the sensitive data notice is presented to the consumer.

Explain how the consumer can exercise the opt-out from sensitive data processing.

For businesses that already have Privacy Policies written for other state laws, it is worth noting what the UCPA does not require:

No mandatory retention periods. The CPRA requires specifying how long each data category is retained. The UCPA has no such requirement.

No actively monitored contact channel. The OCPA requires an actively monitored email or online mechanism. The UCPA only requires the notice to describe how consumers can exercise their rights.

No detail about third parties. The OCPA requires describing how each third party may process data. The UCPA only requires categories.

No right to correct to describe. Since the UCPA does not provide this right, the policy does not need to describe it.

No formal appeal process. The UCPA has no structured appeal mechanism like the OCPA and CTDPA.

This makes the UCPA Privacy Policy the simplest to structure among current US state privacy laws.

Utah Code § 13-61-302(2) requires the controller to establish, implement, and maintain reasonable administrative, technical, and physical data security practices, proportionate to the size, scope, type, and volume of data processed.

The Privacy Policy should mention that the business implements appropriate security measures to protect consumers' personal data, even without needing to detail each specific measure.

Utah Code § 13-61-302(4) expressly prohibits the business from discriminating against consumers who exercise their rights. This includes denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where the consumer opted out of targeted advertising and the business adjusted the price accordingly, provided the price difference is reasonably related to the value the data provides the business.

The Privacy Policy must mention this non-discrimination policy.

Before initiating any action, the Utah Attorney General is required to notify the controller and grant 30 days to cure (§ 13-61-402(3)). This deadline is guaranteed permanently by the UCPA, unlike other laws that have eliminated it.

An outdated or incomplete Privacy Policy is one of the easiest violations to identify. Correcting it within 30 days after a notification is achievable with the right processes. But structuring the policy correctly from the start is always more efficient.

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The consent management platform ensures the opt-out mechanism works as described.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Policy for your site that complies with the UCPA? Talk to our team.

Visible and accessible link on all pages of the site.

Categories of personal data processed, with sufficient description for the consumer to understand (§ 13-61-302(1)(a)(i)).

Purposes of processing for each category (§ 13-61-302(1)(a)(ii)).

How to exercise the 4 rights guaranteed by the UCPA: confirm/access, deletion, portability, opt-out, with channel and 45-day deadline (§ 13-61-302(1)(a)(iii)).

Categories of personal data shared with third parties, if any (§ 13-61-302(1)(a)(iv)).

Categories of third parties with whom data is shared (§ 13-61-302(1)(a)(v)).

Disclosure of targeted advertising or data sale with accessible opt-out (§ 13-61-302(1)(b)).

Sensitive data treatment: clear notice and opt-out opportunity before processing (§ 13-61-302(3)).

Children's data treatment: COPPA compliance for children under 13 (§ 13-61-102(3)).

Non-discrimination policy for consumers exercising rights (§ 13-61-302(4)).

Free service for the first request per 12-month period (§ 13-61-203(4)(a)).

1. Does the UCPA Privacy Policy need to specify data retention periods?
No. The UCPA does not require the Privacy Policy to specify how long each data category is retained. This distinguishes the UCPA from the CPRA, which requires this information explicitly. The UCPA only requires the policy to describe the categories of data processed and the purposes, without detailing retention periods.

2. Do I need to describe the right to correct in the UCPA Privacy Policy?
No. The UCPA does not guarantee the right to correct inaccurate data, unlike the CPRA, OCPA, VCDPA, and CTDPA. The policy only needs to describe the four rights the law actually guarantees: confirm/access, deletion (limited to data provided by the consumer), portability, and opt-out from targeted advertising and data sales.

3. How does the UCPA treat sensitive data differently from other state laws?
Utah Code § 13-61-302(3) requires only a clear notice and an opt-out opportunity before processing sensitive data. Laws like the CPRA, OCPA, VCDPA, and CTDPA require active prior consent (opt-in) for sensitive data. This difference is fundamental: under the UCPA, the business can process sensitive data unless the consumer actively refuses. Under the other laws, the business can only process with the consumer's active consent.

4. Does the UCPA Privacy Policy need to describe an appeal process?
No. The UCPA does not define a formal appeal process for when the controller denies a consumer request. Unlike the OCPA (45 days for appeal), CTDPA (60 days), and VCDPA (60 days), the UCPA has no such structured mechanism. The Policy only needs to describe the four rights and the request submission channel.

5. What happens if the Privacy Policy is incomplete when the Attorney General investigates?
The AG sends notification identifying violations and gives 30 days to cure (§ 13-61-402(3)). This 30-day period is guaranteed permanently by the UCPA. If the business corrects the Policy and provides a written statement that the violation has been cured and will not recur, no formal action is initiated. If not corrected or if the statement is breached, the AG may seek penalties of up to US$ 7,500 per violation. An outdated Policy is one of the easiest violations to identify and to correct.

Ready to build a Privacy Policy for your site that complies with the UCPA? Talk to our team.