Regulations › US states › Utah
UCPA
Utah Consumer Privacy Act
WhenIn effect since 31 December 2023
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsRequires $25M+ annual revenue and either 100,000+ consumers, or 25,000+ consumers with over 50…
Universal opt-outNo universal opt-out signal requirement
Cure periodPermanent 30-day cure period after AG written notice
Request deadline45 days, extendable once by 45 days
Maximum penaltyActual damages plus up to $7,500 per violation
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
0
Requires $25M+ annual revenue and either 100,000+ consumers, or 25,000+ consumers with over 50% revenue from data sales.Utah Code § 13-61-102(1) · source ↗
Exemptions
0
Broad entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and higher education.Utah Code § 13-61-102(2) · source ↗
Sensitive data and minors
Sensitive data
0
Clear notice and an opportunity to opt out before processing sensitive data; no opt-in consent.Utah Code § 13-61-302(3) · source ↗
Children and teens
1
Child under 13; known child data processed in line with COPPA parental consent.Utah Code §§ 13-61-101(8), 13-61-302(3) · source ↗
Data minimization
0
No data minimization duty beyond notice and security.Utah Code § 13-61-302 · source ↗
Consumers' rights
Rights
1
Access, delete (data provided by consumer), portability, correct, and opt out of targeted advertising and sale.Utah Code § 13-61-201 · source ↗
Right to correct added by HB 418 (2025), reported effective July 1, 2026 (TrueVault).
Business duties
Processor contracts
1
Contract with instructions, purpose, data types, duration, confidentiality, and subcontractor flow-down; no audit or assessment term.Utah Code § 13-61-301 · source ↗
Has flow-down but no audit term, so scored 1.
Privacy notice
1
Notice of categories, purposes, rights, third-party sharing, and how to opt out of sale and targeted ads.Utah Code § 13-61-302(1) · source ↗
Loyalty programs
1
Non-discrimination exception for bona fide loyalty, rewards or discount programs.Utah Code § 13-61-302(4) · source ↗
Subsection number not confirmed.
De-identified data
3
Deidentified data needs public commitment and contracts; pseudonymous data exempt from access, deletion and portability if kept separate.Utah Code § 13-61-303 · source ↗
Enforcement
Who enforces
2
Division of Consumer Protection takes complaints and investigates; Attorney General has exclusive enforcement authority.Utah Code §§ 13-61-401, 13-61-402 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws