UCPA: Achieve compliance with the Utah Consumer Privacy Act
What is the UCPA?
The Utah Consumer Privacy Act (UCPA) came into effect in 2023 and is considered one of the more business-friendly U.S. state-level data privacy laws. It gives Utah residents greater control over their personal data and requires businesses to be transparent about data collection and use. It also gives individuals rights, including access, deletion, and opt-out from sale or targeted advertising using their personal data.
Common UCPA questions and answersCOMPLIANCE
How to comply with the Utah data privacy law?
To comply with the UCPA, businesses must provide clear, up-to-date privacy notices, disclose data collection and sharing practices, and enable Utah residents’ right to opt out of data sales and targeted advertising. They must also obtain parental consent before collecting or processing minors’ personal data.
RISKS
What are the consequences of UCPA noncompliance?
The Utah Attorney General has full enforcement authority of UCPA, and the Division of Consumer Protection administers consumer complaints and has the authority to investigate alleged violations. Damages and fines can be up to $7,500 per violation. The UCPA has a 30-day cure period that does not sunset.
your questions answered
Contact our expert team
We’re happy to answer questions about data privacy, compliant marketing operations, and the UCPA. Usercentrics’ Consent Management Platform helps you build trust and avoid penalties. Learn more today.
- Interested in how privacy compliance benefits user experience and your marketing strategies?
- Not sure if your business is privacy-compliant in Utah?
- Need clarity on what your company’s compliance responsibilities are?
- Looking to partner with us?
Learn more
Frequently asked questions
Under the Utah Consumer Privacy Act (UCPA), consumers are granted four main rights:
- Right to access: confirming whether a controller is processing their data, and the ability to request and receive that data
- Right to deletion: if the data subject directly provided the data to the controller, they can request its deletion
- Right to portability: obtain a copy of their personal data from the controller in a reasonably readily usable format, which can be transmitted to another controller
- Right to opt out: of processing for the sale of the personal data or targeted advertising
The Utah Attorney General enforces the Utah privacy law, and the Division of Consumer Protection administers consumer complaints and has authority to investigate alleged violations. There is a 30-day cure period with no sunset date.
In cases where punitive action is required, like if the controller or processor fails to resolve or repeats a violation after providing a written statement to the contrary, the Attorney General can initiate enforcement, including damages and fines up to USD 7,500 per violation.
UCPA compliance software enables companies that process personal data to meet requirements under the Utah data privacy law. These include providing consumers with information about data processing and exercising their rights, and obtaining user consent where required.
A consent management platform (CMP) is a type of UCPA compliance software. A CMP enables companies to become compliant with the Utah privacy law on websites and apps. A CMP presents information to users about what tracking technologies are used to collect personal information. This enables users to make granular consent choices. A CMP also securely stores and documents consent information over time, and users can update their choices.