Utah UCPA: Consumer Privacy Act Explained

Executive Summary

The UCPA (effective December 31, 2023) is the lightest comprehensive state privacy law: Virginia's skeleton with the demanding parts removed.
It applies only to businesses with both $25M+ annual revenue and either 100,000+ Utah consumers' data or 25,000+ with over 50% revenue from selling data, the dual requirement exempts most mid-market companies.
Consumers get access, deletion, portability, and opt-outs of targeted advertising and sale, but no correction right and no profiling opt-out.
Sensitive data requires only notice and an opportunity to opt out, not opt-in consent, and there are no data protection assessment or universal opt-out requirements.
Enforcement runs through a double filter: consumer complaints to the Division of Consumer Protection, referral to the AG, then a mandatory 30-day cure period before any action at up to $7,500 per violation.

Utah wrote the state privacy law for people who did not want one: dual applicability gates that exempt most companies, opt-out (not consent) even for sensitive data, no assessments, no signals, and a cure period welded to the front of every enforcement action. Its significance is mostly comparative, it defines the floor of the American framework, and Iowa and a few later states built on its chassis. If your program satisfies Virginia, Utah is already done.

Law	UCPA, Utah Code 13-61-101 et seq.
Effective	December 31, 2023
Applies if	$25M+ revenue AND volume threshold (conjunctive)
Max penalty	$7,500 per violation, after mandatory 30-day cure
Regulator	Utah AG
Statute	Utah Code 13-61

What still has to be true in Utah

The notice must be accurate. Utah’s privacy-notice duty (categories, purposes, third-party sharing, rights mechanics) is enforceable on its own, and inaccurate notices are also FTC Act and state UDAP exposure. The recurring failure is unlisted ad-tech sharing, visible to anyone who reads the network tab.

Opt-outs must work. Targeted advertising and sale opt-outs need functioning intake and suppression even without GPC recognition. Since Colorado, Texas, and Connecticut mandate signal handling anyway, most controllers run one national GPC pipeline that over-complies here.

Security is unwaived. Reasonable administrative, technical, and physical safeguards, and Utah’s separate breach-notification statute (Utah Code 13-44) still applies with AG notice duties for larger incidents.

Watch the deltas, not the law. Utah rarely amends, but its exemptions do not travel: the same data flows may need consent in Colorado, assessments in Connecticut, and honoring GPC in Texas. The state comparison and multi-state strategy guide map where Utah’s floor diverges from everyone else’s requirements.

Verify the two things Utah does demand, honest notices and working opt-outs, against your site’s actual behavior with a free scan.

Frequently Asked Questions

Are we even covered by the UCPA?

Only if you clear both gates: $25 million or more in annual revenue AND either 100,000+ Utah consumers' personal data processed annually or 25,000+ consumers with more than half your revenue from data sales. The conjunctive test (revenue and volume) is unique among early state laws and exempts high-traffic startups and low-revenue publishers that Colorado or Connecticut would capture. Standard entity exemptions (GLBA, HIPAA, government, tribes) apply on top.

Which consumer rights does Utah omit?

Compared with Virginia: no right to correct inaccurate data, no opt-out of profiling, and no appeal-process mandate for denied requests. Access, deletion (limited to data the consumer provided), portability, and opt-outs of targeted advertising and sale remain. For a multistate program these gaps mean Utah is automatically satisfied by any Virginia-compliant rights pipeline.

How does Utah handle sensitive data?

Notice-and-opt-out, not consent: you must present clear notice and an opportunity to opt out before processing sensitive data (race, religion, health, sexual orientation, citizenship, genetic/biometric data, specific geolocation). Children's data still requires COPPA-grade parental consent. This is the key doctrinal difference from every other comprehensive state law, all of which require opt-in consent for sensitive categories.

What compliance documents does the UCPA not require?

No data protection assessments, no universal opt-out signal recognition, no consent refreshes, and no mandated DSAR appeals. Required: privacy notice (categories, purposes, rights mechanics, sharing practices), processor contracts with confidentiality and security terms, and reasonable data security. Utah compliance is essentially transparency plus security plus two opt-outs.

What is the enforcement risk, realistically?

The lowest in the country by design: complaints funnel through the Division of Consumer Protection, the AG must give 30 days' written notice and opportunity to cure, and only uncured violations proceed, at up to $7,500 per violation, with no private right of action. That said, Utah participates in the bipartisan multistate 'Consortium of Privacy Regulators' formed in 2025, so egregious practices caught in coordinated sweeps can still surface here.

Regulatory Crosswalk

Virginia VCDPAIowa ICDPACCPA

Organizations subject to this regulation often operate under these overlapping frameworks. BD Emerson maps controls across frameworks to reduce duplicated compliance effort.

Evaluate your compliance posture now

BD Emerson's automated scanner audits your public-facing properties against your applicable regulations in minutes, not weeks.

Run Free Scan Speak to an Expert