Privacy Map

Utah. Comprehensive data protection. Act

UCPAUtah Consumer Privacy Act (Utah Code § 13-61-101 et seq.)

In force
Partly verifiedMedium confidence. Core thresholds from established knowledge.

§1Summary

Synopsis

Business-friendly comprehensive law giving rights of access, deletion, portability and opt-out of sale and targeted advertising. Does not require data protection assessments or opt-in for sensitive data (notice and opt-out instead).

Key themes
  • access
  • deletion
  • portability
  • opt-out of sale and targeted ads
  • sensitive data notice
Unique features

Requires both $25m revenue and a volume threshold; no right to correct; no assessments.

SaaS relevance

Applies only to businesses with $25m+ revenue that also process data of 100,000+ Utah consumers (or 25,000 with 50%+ revenue from sales).

§2Obligations

Extraterritorial
Yes
Breach notification
See Utah Code § 13-44-202 (separate statute)
DPO
No
Cross-border transfers
None
Maximum penalty
$7,500 per violation

§3Dates

Key dates
  • Adopted
  • In force
  • HB 357 (2026) extends the Act to motor vehicle manufacturers regardless of thresholds, effective 2027-01-01.

§4Text and authority

Text
Authority
Utah Division of Consumer Protection and Utah Attorney General

§5Where it applies

Domestic law of
Utah

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. Core thresholds from established knowledge.