The Utah Consumer Privacy Act in practice

Utah's privacy law has applied since December 31, 2023, and it is still the narrowest comprehensive state privacy law in the US. It finally got a correction right on July 1, 2026. Motor vehicle makers come into scope on January 1, 2027. Here is what the law requires today and how to get a program ready for it without overbuilding.

The Utah Consumer Privacy Act (UCPA) is Utah Code Title 13, Chapter 61. It was enacted as Chapter 462 of the 2022 General Session and took effect December 31, 2023. Section numbers below refer to that chapter. Utah's legislature site was unreachable while we checked some of this, so the bill and code text was confirmed from archived copies of the official PDFs. This is not legal advice.

Who the UCPA applies to

Section 13-61-102 sets a test with three parts, and a controller or processor has to meet all three:

1. It conducts business in Utah, or produces a product or service targeted to Utah residents.
2. It has annual revenue of $25,000,000 or more.
3. It meets at least one volume threshold: during a calendar year it controls or processes personal data of 100,000 or more Utah consumers, or it gets over 50% of gross revenue from selling personal data and controls or processes data of 25,000 or more consumers.

The revenue floor is what sets Utah apart. Virginia and Colorado have no revenue test at all. A small ad-tech firm with $10 million in revenue and data on 500,000 Utahns is outside the UCPA but could be inside Virginia's law. A $30 million company with 100,000 Utah customers is inside. The statute doesn't say whether "annual revenue" means global or Utah-only revenue. Most counsel read it as total revenue, which is the safer assumption.

"Consumer" means a Utah resident acting in an individual or household context. Employees and B2B contacts acting in a commercial or employment context are excluded outright. That cuts the scope for many B2B SaaS companies a long way: if your Utah data is mostly business users' work email addresses, you may never reach 100,000 consumers.

The exemptions are broad. They cover government entities and their contractors, tribes, institutions of higher education, nonprofits, HIPAA covered entities and business associates, GLBA financial institutions and their affiliates, FCRA-regulated activity, and several categories of health and research data.

Consumer rights

Section 13-61-201, as amended, gives Utah consumers these rights:

• Confirm and access: whether the controller processes their personal data, and access to it.
• Delete: but only personal data the consumer provided to the controller. Data you bought, inferred or collected from third parties falls outside the deletion right. That is narrower than California, where deletion is also being widened (see the California page).
• Portability: a copy of data the consumer previously provided, in a portable and readily usable format where processing is automated.
• Correct: new as of July 1, 2026 (below).
• Opt out of targeted advertising and of the sale of personal data.

Rights Utah does not give: no opt-out of profiling, no appeal process, and no right to limit sensitive data beyond the notice-and-opt-out rule described below. "Sale" means exchanging personal data for monetary consideration only. Colorado and California also count other valuable consideration, so a data swap that is a sale there may not be one in Utah.

The correction right, added in 2025 and live since July 2026

As passed in 2022, the UCPA had no right to correct inaccurate data. Every other comprehensive state law had one, so this was the gap most often noted. It was closed by H.B. 418, "Data Sharing Amendments" (2025 General Session, Chapter 468). The bill amended 13-61-201 to add: "A consumer has the right to request that a controller correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data." The amendment took effect July 1, 2026.

The same bill created the Utah Digital Choice Act, a separate chapter of Title 13 that requires social media companies to support data portability and interoperability, including a user's "social graph." It is enforced by the Division of Consumer Protection, with its own penalties, and the legislature revisited it in 2026 (H.B. 408), so check its current text if it could reach you. Unless you run a social media service it won't apply to you, but it explains why H.B. 418 is often described as a "social media" bill.

Handling requests: deadlines and fees

Section 13-61-203 sets the mechanics:

• Act on a request and tell the consumer what you did within 45 days of receiving it.
• You may extend once by another 45 days when complexity or volume makes it reasonably necessary. You must tell the consumer about the extension, its length and the reason before the first 45 days end.
• If you decline a request, you must give the reasons within 45 days. Utah doesn't require an appeal process, so the response itself is where you explain the decision.
• The first request in a 12-month period is free. You can charge a reasonable fee, or refuse, for requests that are excessive, repetitive, technically infeasible, manifestly unfounded, or part of an effort to harass. You carry the burden of showing that.
• The 45-day clock pauses while a request you reasonably suspect is fraudulent can't be authenticated.

If you already run a request workflow for Virginia or Colorado, Utah fits into it with no new clock. See data subject request automation for the queue design. If you get requests from agent services, see requests from Mine, Privacy Bee and other agents. The UCPA says nothing about authorized agents.

Controller and processor duties

Privacy notice (13-61-302). It must be reasonably accessible and clear, and it must list the categories of personal data processed, the purposes, how to exercise rights, the categories shared with third parties, and the categories of those third parties. If you sell data or do targeted advertising, the opt-out must be disclosed clearly and conspicuously.

Sensitive data. Sensitive data includes racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, health information, biometric and genetic data used to identify someone, and specific geolocation. You can't process sensitive data collected from a consumer without first giving clear notice and an opportunity to opt out. Data about a known child (under 13) must be handled under COPPA. This is the main difference from Virginia and Colorado, which require opt-in consent.

Security. The law requires reasonable administrative, technical and physical safeguards, scaled to the size of the business and the volume and nature of the data.

Processor contracts (13-61-301). Before a processor starts work, the two sides must sign a contract that sets instructions, the nature and purpose of processing, data types, duration, and each party's rights and obligations. The contract must bind the processor's staff to confidentiality and flow the same obligations down to subcontractors. Most GDPR-style DPAs already cover this. See data processing agreements and sub-processor lists.

Nondiscrimination. You can't deny goods or services, or charge different prices, because a consumer exercised a right. Bona fide loyalty programs are carved out.

What's absent. Utah has no data protection assessment requirement, and no universal opt-out signal mandate. If Utah were your only state law, a lot of the usual privacy program machinery would be optional. In practice it never is.

Enforcement and the 30-day cure period

The UCPA is enforced in two stages:

1. The Division of Consumer Protection runs the complaint system and investigates (13-61-401). If the director finds reasonable cause to believe there is substantial evidence of a violation, the matter goes to the Attorney General.
2. The Utah Attorney General has exclusive enforcement authority (13-61-402). At least 30 days before suing, the AG must send written notice of each alleged violation and the basis for it. If you cure within 30 days and give an express written statement that the violation is cured and won't recur, the AG can't sue.

If you don't cure, or you cure and then violate again, the AG can recover actual damages to consumers and up to $7,500 per violation. Recoveries go into the Consumer Privacy Restricted Account. Section 13-61-305 rules out any private right of action. Unlike Colorado's cure period, which ended on January 1, 2025, Utah's has no end date.

We could not find any public UCPA enforcement action as of October 2026. Given the cure right, an early case is likely to be a notice letter that gets fixed rather than a published settlement.

How Utah compares with other state laws

The table compares Utah with three laws whose text we checked: Virginia's (Va. Code § 59.1-575 et seq.), Colorado's as enacted (SB21-190; Colorado has amended it since), and California's CCPA as amended by the CPRA.

In practice: if you already comply with Virginia or Colorado, Utah adds almost nothing. If you comply only with California, Utah's mechanics (45-day deadline, opt-outs, processor contracts) are already covered. What you need to check is that your sensitive-data notice actually offers a Utah opt-out, and that your request tooling recognizes Utah residents.

A preparation checklist

1. Run the applicability test properly. Check total revenue first. Then count unique Utah consumers (not B2B contacts or employees) in the last calendar year across product, marketing and support systems. Put the count and how you got it on file. Note that the 100,000 test counts data you control or process, not just data you sell.
2. Map where Utah data lives. You can't answer access or correction requests without knowing which systems hold the data. A lightweight inventory is enough to start. See data mapping and discovery and the data map template.
3. Tag "provided" vs. "obtained" data. Utah's deletion and portability rights only reach data the consumer gave you. If your systems record a source field, you can scope those responses precisely. If not, most companies simply delete everything, which is simpler and future-proof.
4. Turn on correction for Utah. If your request form or workflow hid "correct" for Utah residents before July 2026, remove that gate.
5. Review sensitive data flows. List where you process health, precise location, biometric or demographic data. Make sure a clear notice and an opt-out exist before processing. If you also operate in opt-in states, using consent everywhere is usually cleaner.
6. Update the privacy notice to cover every 13-61-302 element, with a visible opt-out link if you sell data or run targeted ads.
7. Paper your processors. Confirm that every vendor touching Utah consumer data is under a contract with the 13-61-301 terms.
8. Set the clock. Configure 45-day deadlines with an extension notice that goes out before day 45, and record reasons for every denial.
9. Prepare for a notice letter. Decide who receives AG correspondence and who can sign the written cure statement, and keep evidence that fixes are in place. Thirty days goes quickly.
10. Diary January 1, 2027 if you build or connect to vehicles: H.B. 357 brings manufacturers in regardless of size.

For the other regulators you're likely to deal with alongside Utah's Attorney General, see who regulates privacy where and the privacy regulators directory.