Regulations › US states › Utah

UCPA

Utah Consumer Privacy Act

In force privacy consumer rights
WhenIn effect since 31 December 2023
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
95%

of Utah's 19 requirements are already met by California (CA). Here is what UCPA adds, biggest gaps first.

De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
UCPA adds3 Deidentified data needs public commitment and contracts; pseudonymous data exempt from access, deletion and portability if kept separate. Utah Code § 13-61-303 · source ↗

Already covered by CA: Thresholds, Exemptions, Sensitive data, Children and teens, Data minimization, Rights, Request deadline, Appeals, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.

A gap means UCPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL