Utah Consumer Privacy Act (UCPA): An Overview

The Utah Consumer Privacy Act (UCPA) came into effect on December 31, 2023, and is one of the increasing number of statewide laws in the U.S. that aim to protect the rights of consumers whose data is processed by businesses.

When it was passed, the UCPA was the fourth piece of legislation of its kind in the US. Lawmakers were able to draw on earlier regulations, like the Colorado Privacy Act (CPA) and the Virginia Consumer Data Protection Act (VCDPA), which were both based on the first and most stringent U.S. privacy law: the California Consumer Privacy Act (CCPA).

With this foundation, the UCPA strikes a finer balance between consumer rights and business responsibilities. Overall, the narrower scope of its definitions and compliance requirements means that it can be seen as “lighter” and more business-friendly than the majority of other state-level data privacy laws in place. 

What Is the Utah Consumer Privacy Act?

The UCPA protects the privacy rights of Utah residents and establishes data privacy responsibilities for companies that operate in the state and process the data of individuals who live there.

It requires businesses that collect data to protect the confidentiality and integrity of that data to reduce the risk of harm associated with processing it. Organizations must also provide consumers with clear and accessible privacy notices and inform them about how they can opt out of the sale of their data.

Like other U.S. state laws, the UCPA uses an opt-out model for user consent in most cases, rather than the opt-in model in place for regulations such as the General Data Protection Regulation (GDPR). 

This means that consumers’ personal data can be collected, sold, or used for targeted advertising without first obtaining their opt-in, informed consent. The exception relates to children’s data: for a known child under 13, controllers must process sensitive data in accordance with the Children’s Online Privacy Protection Act (COPPA), which includes verifiable parental consent.

Unlike many similar data privacy laws, the UCPA does not generally impose data minimization or purpose limitation duties on controllers. Consumers instead exercise control through the notice, access, deletion, correction, and opt-out provisions. This means that individuals do have the right to know if a business is processing their personal data, to access, delete, and correct that data, and to opt out of its sale or use for targeted advertising.

Because the definition of sale covers only monetary exchanges, non-monetary data sharing is not a sale under the UCPA, which differs from the CCPA and California Privacy Rights Act (CPRA). Use of data for targeted advertising is addressed separately and remains subject to opt-out.

This definition doesn’t include non-monetary exchanges, which means that it doesn’t apply to data sharing among businesses, differentiating it from the CCPA and California Privacy Rights Act (CPRA).

Individuals do have the right to know if a business is processing their personal data, to access, delete, and correct that data, and to opt out of its sale or use for targeted advertising.

Updates to the UCPA

Two recent amendments change what the UCPA requires:

• Right to correct (H.B. 418, 2025): Since July 1, 2026, consumers can ask a controller to correct inaccuracies in their personal data, taking into account the nature of the data and the purposes of the processing.
• Motor vehicle manufacturers (H.B. 357, 2026): From January 1, 2027, the UCPA also applies to motor vehicle manufacturers that sell or lease vehicles in Utah and collect, transmit, or store personal data through a vehicle data collection system, whether or not they meet the revenue and data-volume thresholds. Manufacturers must also provide in-vehicle privacy controls for model year 2030 and later vehicles.

Separately, the Utah Artificial Intelligence Policy Act (UAIP), which took effect on May 1, 2024, places disclosure duties on businesses that use generative AI to interact with consumers. Following 2025 amendments, a business must disclose its use of generative AI when a consumer clearly and unambiguously asks, and individuals in regulated occupations must make a prominent disclosure only in high-risk interactions, such as those involving sensitive personal information or personalized advice. The UAIP is currently set to repeal on July 1, 2027.

The UAIP has also created an Office of Artificial Intelligence Policy that is tasked with setting up an Artificial Intelligence Learning Laboratory Program. The goal is that this AI Lab will support AI-related regulation and development within the state.

Definitions Under the Utah Consumer Privacy Act

The UCPA applies to controllers or processors of consumer data. It defines these terms as follows. 

Controller Under the UCPA

Controller means“a person doing business in the state who determines the purposes for which and the means by which personal data are processed, regardless of whether the person makes the determination alone or with others.” (Utah Code § 13-61-101(12))

Processor Under the UCPA

Processor means“a person who processes personal data on behalf of a controller.” (Utah Code § 13-61-101)

Consumer Under the UCPA

Consumer means “an individual who is a resident of the state acting in an individual or household context” who is not “acting in an employment or commercial context.” (Utah Code § 13-61-101(10))

Personal data Under the UCPA

“Personal data” refers to “information that is linked or reasonably linkable to an identified individual or an identifiable individual.” (Utah Code § 13-61-101)

There are specific forms of personal data that can make an individual directly identifiable (e.g., a name or email address), while others may not qualify on their own (e.g., an IP address). However, it’s important to note that non-identifying data may become identifying when it’s aggregated with other kinds of personal data.

Exclusions to the Definition of Personal Data

The UCPA sets out a number of exclusions in relation to personal data. This includes information that:

• Is publicly available 
• Has been de-identified or anonymized
• Relates to groups of consumers and has been aggregated to the extent that individuals cannot be identified

Sensitive Data Under the UCPA

Unlike some other data privacy laws, the UCPA does not require businesses to obtain consent for processing sensitive personal data. 

However, controllers do have to clearly notify consumers and provide the opportunity for them to opt out of having their sensitive personal data processed before such data is collected and processed. The Act (Utah Code § 13-61-101) defines “sensitive data” as follows:

• Racial or ethnic origin (unless processed by a video communication service)
• Religious beliefs
• Sexual orientation
• Citizenship or immigration status
• Medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional (unless processed by a person licensed to provide health care)
• Genetic or biometric data, if the processing is for the purpose of identifying a specific individual
• Specific geolocation data, meaning information that directly identifies an individual’s location, accurate within a radius of 1,750 feet or less

Who Must Comply with the Utah Consumer Privacy Act?

The UCPA applies to businesses that operate in Utah or target Utah residents, have annual revenue of USD 25 million or more, and meet one of two data-volume thresholds. It gives consumers rights and places obligations on those businesses.

The UCPA applies to businesses that:

• Operate in Utah, either by conducting business there or by producing a product or service that targets Utah residents
• Have annual revenue of USD 25 million or more
• Meet at least one of these data thresholds:
  • Control or process the personal data of 100,000 or more consumers during a calendar year
  • Derive more than 50 percent of gross revenue from the sale of personal data and control or process the personal data of 25,000 or more consumers

From January 1, 2027, the UCPA also applies to any motor vehicle manufacturer that sells or leases vehicles in Utah and collects, transmits, or stores personal data through a vehicle data collection system, regardless of revenue or data volume.

The UCPA differs from some of the other data privacy laws as entities have to meet multiple criteria for it to apply, which narrows its scope. For example, the revenue threshold excludes smaller businesses. Many of the more recently passed U.S. state-level privacy laws do not include a revenue-centric threshold, though Utah is one of the earlier ones that does.

Exemptions to Utah Consumer Privacy Act Compliance

The UCPA exempts certain organizations, certain categories of data, and employment-related data. Each is described below.

Organizational Exemptions

In addition to organizations that fall below the revenue or processing volume thresholds, the UCPA exempts a number of other entities, including:

• Institutions of higher education
• Nonprofit organizations
• Government entities and third parties acting on their behalf under contract
• Tribes
• Air carriers
• HIPAA covered entities and business associates
• Financial institutions and their affiliates governed by the Gramm-Leach-Bliley Act (GLBA)

Data Exemptions

The UCPA does not apply to information that is already subject to certain federal laws, including:

• Driver’s Privacy Protection Act (DPPA)
• Fair Credit Reporting Act (FCRA)
• Family Educational Rights and Privacy Act (FERPA)
• Farm Credit Act (FCA)
• Gramm-Leach-Bliley Act (GLBA)
• Health Insurance Portability and Accountability Act (HIPAA)

Employment Exemptions

Data processed or maintained during the course of an individual’s employment is exempt from the UCPA. 

This covers instances when an individual is applying for a job, being employed by a controller, processor, or third party, or acting as their agent or independent contractor, to the extent the collection and use of the data relate to the individual’s role (Utah Code § 13-61-102(2)(o)(i)). It also covers emergency contact information and data used to administer benefits for another individual.

Consumer Rights Under the Utah Consumer Privacy Act

Consumers have five primary rights under the UCPA: access, deletion, portability, correction, and opting out.

• Right to access, including confirming whether a controller is processing their personal data and accessing that data
• Right to deletion of personal data that the consumer provided to the controller
• Right to portability, obtaining a copy of the personal data the consumer previously provided to the controller, in a format that is:
  • Portable, to the extent technically feasible
  • Readily usable, to the extent practicable
  • Able to be transmitted to another controller without impediment, where the processing is carried out by automated means
• Right to correct inaccuracies in their personal data, taking into account the nature of the data and the purposes of the processing (effective July 1, 2026)
• Right to opt out of the processing of their personal data for targeted advertising or the sale of personal data

Key Differences with Other Privacy Laws

While these rights are similar to those given to consumers under other data privacy laws, both within the U.S. and globally, the UCPA does not create a right to appeal a controller’s denial of a request.

The UCPA also does not provide for a private right of action (the ability for an individual consumer to sue a controller for noncompliance or a data breach). Consumers also cannot use a violation of the UCPA to support a claim under other Utah laws.

What’s more, controllers under the Utah privacy law aren’t required to recognize “universal opt-out signals” as a method for consumers to opt out of data processing. This excludes Global Privacy Control (GPC) measures, where visitors can set their privacy choices once and have them respected across all other sites and properties on which they are active, instead of having to specify their choice at every online property they visit. 

What Are Controllers Required to Do under the Utah Consumer Privacy Act?

Under the UCPA, data controllers must outline exactly how consumers can submit a request and exercise their rights related to their data. They must also respond to any requests within 45 days. 

Transparency Under the UCPA

Controllers must provide consumers with a privacy notice or policy that is “reasonably accessible and clear.” This notice would typically appear on a business’s website and must include:

• Categories of personal data processed by the controller
• Purposes for which those categories are processed
• Categories of personal data the controller shares with third parties, if any
• Categories of third parties with whom the controller shares personal data, if any
• How consumers can exercise their rights

If a controller sells personal data or engages in targeted advertising, it must also clearly and conspicuously disclose how consumers can opt out of the sale or of processing for targeted advertising. A consent management platform (CMP) can help support these notice requirements by informing visitors about data collection and giving them a way to opt out. The Usercentrics Privacy Policy Generator can help you draft and maintain a privacy notice.

Consumer Requests Under the UCPA

Controllers may not charge a fee for responding to a consumer request unless it is the consumer’s second or subsequent request in the same 12-month period. A controller may also charge a reasonable fee, or refuse to act, if the request is:

• Excessive, repetitive, technically infeasible, or manifestly unfounded
• Submitted, in the controller’s reasonable belief, for a primary purpose other than exercising a right
• Intended, individually or as part of an organized effort, to harass, disrupt, or impose undue burden on the controller’s business resources

A controller that charges a fee or refuses to act bears the burden of showing that the request meets one of these criteria.

Controllers must take action and notify the consumer of their actions within 45 days of receiving a request. If the controller cannot or will not respond to or fulfill the consumer’s request, e.g., if the consumer’s identity cannot be reasonably verified, they must communicate this during that same 45-day period.

However, there are exceptions. The response period can be extended once, by another 45 days, if reasonably necessary, for example, if the request is very complex or the controller is dealing with a high number of requests. 

Where there is an extension, the consumer must be informed within the initial 45 days. The notification must include reasons for and the length of the delay.

Unlike some other laws, the UCPA does not have an appeal process for consumers whose requests are denied.

Data Security Under the UCPA

Controllers must “establish, implement, and maintain reasonable administrative, technical, and physical data security practices” that have been “designed to protect the confidentiality and integrity of personal data.” (Utah Code § 13-61-302(2)(a))

This applies both to the controller and any third party services they use.

Third-Party Data Processing Under the UCPA

Controller organizations may use third parties to process data on their behalf, so long as there is a contract in place. 

The contract must include data processing instructions and set out:

• Nature and purpose of the processing
• Type of data to be processed
• Duration of processing
• All parties’ rights and obligations, including a duty of confidentiality
• A provision that requires the processor to have a written contract with any subcontractor engaged to process personal data that mirrors the obligations on the processor

Under the UCPA, controllers don’t have to evaluate the risks of their data processing activities via data protection assessments. What’s more, a contract between a controller and processor does not need to stipulate that the processor must comply with any reasonable data privacy audits set in motion by the data controller.

Processing of Children’s Personal Data under the UCPA

The UCPA’s only consent-based requirement applies to the data of known children. Under the Act, a child is an individual younger than 13. For a known child, a controller must process sensitive data in accordance with the Children’s Online Privacy Protection Act (COPPA) and its implementing regulations. A controller satisfies any parental consent obligation under the UCPA by following COPPA’s verifiable parental consent mechanisms.

Nondiscrimination Under the UCPA

Controllers may not discriminate against any consumer who exercises their privacy rights. Examples of potential discrimination include:

• Denying goods or services
• Charging a different price or rate for goods or services
• Providing a different level of quality for goods or services

However, a controller is allowed to offer “a different price, rate, level, quality, or selection of a good or service to a consumer” (Utah Code § 13-61-302(4)(b)) if that consumer has opted out of targeted advertising, or if the offer relates to the consumer voluntarily participating in the controller’s loyalty program.

Enforcement of the Utah Consumer Privacy Act

The Utah Attorney General enforces the UCPA, working with the Division of Consumer Protection. Controllers have a 30-day opportunity to cure a noticed violation, and penalties are capped per violation.

Enforcement Authority

The Utah Attorney General has exclusive authority to enforce the UCPA. However, the Division of Consumer Protection is responsible for administering consumer complaints and has the authority to investigate alleged violations.

Investigations and Cure Period

Where authorities find reasonable cause or evidence of a violation, it’s referred to the Attorney General. If the Attorney General pursues the investigation, their office must provide the data controller or data processor with a written notice about the violation.

The UCPA provides the offending party with a 30-day “cure” period. This is a grace period during which the controller is given the opportunity to rectify any violation and provide a statement to the Attorney General about what has been done to resolve the violation and ensure it won’t be repeated. Unlike many U.S. data privacy laws, the UCPA’s cure period does not sunset.

Damages and Fines

In cases where punitive action is required, for example, if the controller or processor fails to resolve, or repeats the violation after providing a written statement to the contrary, the Attorney General can initiate an enforcement action. In that action, the Attorney General can recover actual damages to the consumer and an amount of up to USD 7,500 for each violation.

Consent Management and the Utah Consumer Privacy Act

The UCPA uses an opt-out model to regulate data collection and processing in the state of Utah. As a data controller in Utah, you’re not required to obtain consumers’ consent before collecting personal data, unless the data concerns a known child.

However, you are required to give consumers a clear notification that their data is being collected, inform them about their rights, and provide them with the means to opt out, either before or at the point of collection and processing.

A consent management platform (CMP) can help support UCPA obligations. A CMP can automate notices about data processing, tailor messaging for Utah visitors, and record their opt-out choices, which can also help support compliance with other U.S. privacy laws, such as the CCPA/CPRA and VCDPA.

Transparent notices and easy-to-use opt-out controls can also help build trust with your customers.

Navigating UCPA Compliance

While UCPA requirements are less demanding than those of similar laws, the potential fines and damage to brand reputation that can result from noncompliance mean that businesses must still be diligent.

Usercentrics can help support your compliance with laws like the UCPA. Our CMP supports notices and opt-out management, and our Privacy Policy Generator helps you draft privacy notices.

If you have questions or interest in implementing our CMP to help you achieve compliance with privacy laws in the US and around the world, talk to one of our experts.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.