By Daniel de Almeida Afonso · Last updated: October 20, 2026
The Utah Consumer Privacy Act (UCPA) has been in force since December 31, 2023, and it is one of the lightest comprehensive privacy laws in the United States. It applies only to businesses with at least $25 million in annual revenue that also meet a data-volume test. It does not require cookie consent or opt-in consent for sensitive data. Instead, it requires a clear privacy notice, a working opt-out for targeted advertising and sales, and a response to consumer requests within 45 days. As of October 20, 2026, a consumer right to correct inaccurate data has been in force since July 1, 2026, and new motor vehicle rules start on January 1, 2027.
This guide is general information, not legal advice. It rests on the statute (Utah Code Title 13, Chapter 61), the enrolled amending bills on le.utah.gov and an August 2026 Division of Consumer Protection presentation.
What is the Utah Consumer Privacy Act?
The UCPA is Utah's state privacy law. Governor Spencer Cox signed it (S.B. 227) on March 24, 2022, and it took effect on December 31, 2023. It gives Utah residents rights over their personal data and sets duties for the businesses that control or process it. Utah was the fourth state to pass a comprehensive privacy law, after California, Virginia and Colorado.
The UCPA follows the Virginia model but is lighter in several places, covered below. For where Utah sits among the other states, see our US state privacy law tracker, and for the Virginia law it was modeled on, see our Virginia CDPA guide.
Does the UCPA apply to your business?
The law applies to a controller or processor that does business in Utah, or produces a product or service targeted at Utah residents, and that meets both of these conditions (Utah Code 13-61-102):
- It has annual revenue of $25,000,000 or more.
- It either controls or processes the personal data of 100,000 or more consumers during a calendar year, or it earns more than 50% of its gross revenue from selling personal data and controls or processes the data of 25,000 or more consumers.
The revenue test applies in both cases. A small business with a huge audience is outside the law, which is a major difference from states with no revenue floor.
A "consumer" is a Utah resident acting in an individual or household context. Employee, applicant and contractor data tied to a person's role is exempt.
Who is exempt. The statute also excludes:
- Government bodies and contractors acting for them
- Tribes
- Institutions of higher education
- Nonprofit corporations
- Covered entities and business associates under HIPAA, and protected health information
- Data covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, FERPA, the Driver's Privacy Protection Act and the Farm Credit Act
- Human subjects research data
- Air carriers
- Deidentified data, aggregated data and publicly available information
Motor vehicle makers are a new, separate category. From January 1, 2027, H.B. 357 (2026) applies the law to a motor vehicle manufacturer that sells or leases vehicles in Utah and collects, transmits or stores personal data through a vehicle data collection system. The $25 million revenue test does not apply to that category.
What are the key terms?
Personal data is information linked or reasonably linkable to an identified or identifiable individual. Names, emails, IP addresses, device identifiers and browsing history can all qualify when they can be tied to a person.
Sensitive data is narrower than in most states. It covers data revealing racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or medical history, health condition or treatment. It also covers genetic or biometric data used to identify a person, and specific geolocation data accurate to within 1,750 feet. Data processed by licensed health care providers, and racial or ethnic origin data processed by a video communication service, are carved out of the definition.
A controller decides why and how personal data is processed. A processor handles data on the controller's behalf. For example, if you install an analytics tool on your site, you are usually the controller and the analytics vendor is your processor. California calls processors "service providers."
Sale means exchanging personal data for monetary consideration with a third party. Unlike California, the Utah definition does not extend to "other valuable consideration." Disclosures to processors and affiliates, and several others such as merger transfers, are not sales.
Targeted advertising means showing an ad selected from a person's activity over time and across unaffiliated websites or apps. Advertising based on activity on your own site, on the context of the current page or query, or used only to measure ad performance, reach or frequency is excluded.
What are consumers' rights under the UCPA?
Under Utah Code 13-61-201, as amended by H.B. 418, a consumer can:
- Confirm and access. Learn whether a controller is processing their data and get access to it.
- Delete. Delete personal data that the consumer provided to the controller. The right covers data the consumer provided, not every record you hold about them.
- Port. Get a copy of the data they previously provided, in a portable and readily usable format that can be sent to another controller where processing is automated.
- Correct. Ask the controller to fix inaccuracies, taking into account the nature of the data and the purposes of the processing. This right took effect on July 1, 2026. Older guides, including earlier versions of this one, say Utah has no right to correct. That is out of date.
- Opt out of targeted advertising or the sale of their personal data.
You also cannot deny goods or services, change prices or lower quality because someone exercised a right, though you may offer a different price to a consumer who opted out of targeted advertising or as part of a bona fide loyalty program.
Utah has no right to opt out of profiling or automated decisions, and no right to appeal a refusal. Those exist in some other states but not in the Utah statute.
How must you handle consumer requests?
- Intake. Consumers submit requests by the means you prescribe. Parents and guardians act for known children.
- Deadline. You must act and tell the consumer what you did within 45 days of receiving the request. You can extend once by another 45 days if reasonably necessary because of complexity or volume, but you must tell the consumer about the extension and the reasons before the first 45 days end.
- Refusals. If you decide not to act, you must explain why within 45 days.
- Cost. Information is free. You may charge a reasonable fee, or refuse, only if the request is excessive, repetitive, technically infeasible, manifestly unfounded or not really about exercising a right, and you must show that.
- Authentication. If you cannot authenticate a request with commercially reasonable efforts, you do not have to comply and can ask for more information.
What must controllers and processors do?
Controller duties (13-61-302):
- Give a clear, reasonably accessible privacy notice covering the categories of personal data processed, the purposes, how to exercise rights, the categories of data shared with third parties, and the categories of those third parties.
- Disclose opt-outs clearly and conspicuously if you sell personal data or use it for targeted advertising, including how the consumer can opt out. Utah does not prescribe the method, and it does not require a specific "Do Not Sell" link.
- Use reasonable security practices that fit the size of your business and the volume and nature of the data.
- Give notice and a chance to opt out before processing sensitive data. This is not an opt-in. For a known child, you follow the federal Children's Online Privacy Protection Act (COPPA) instead.
- Do not discriminate against people who exercise their rights, and do not use contract terms to waive their rights (such terms are void).
Processor duties (13-61-301): follow the controller's instructions and help it meet its obligations, including security and breach notification. Before processing starts, the two parties must sign a contract that sets out the instructions, the nature, purpose and duration of the processing, the type of data, a duty of confidentiality for each person involved, and a written subcontractor contract with the same obligations. Whether someone is a controller or a processor depends on the facts, not the label in the contract.
What Utah does not require. There is no mandatory data protection assessment, no data minimization or purpose limitation rule, no duty to appoint a privacy officer, and no state regulations. The Division of Consumer Protection and the Attorney General cannot issue privacy rules. Some guides list a privacy officer or staff training as UCPA duties; they are good practice, not statutory requirements.
Does the UCPA require cookie consent?
No. The UCPA does not mention cookies. It regulates personal data processing regardless of the technology, and its model is notice and opt-out, not opt-in. A Utah visitor does not have to click "Accept" before you load analytics or advertising cookies.
Here is what the law does require when you use cookies and similar trackers:
- Describe them in your privacy notice where they involve personal data: what categories you collect, why, and which categories of third parties receive the data.
- Offer an opt-out if the trackers feed targeted advertising or a sale. Cookies and pixels that send data to ad platforms for cross-site ad targeting are the usual case. Measurement that is only used to report ad performance, reach or frequency is excluded from the targeted advertising definition, but check your actual tag configuration rather than assuming.
- Get parental consent for known children, using the COPPA verifiable consent methods. The UCPA defines consent as an affirmative act that unambiguously shows voluntary and informed agreement, but that definition matters in practice mainly for children's data.
A banner with an opt-out choice is a common way to meet the opt-out duty, but no banner is mandatory. If you also serve visitors in the EU, the UK or other consent-based places, you will likely need a consent-first banner there anyway. For the opt-in versus opt-out distinction, see our guide to opt-in and opt-out consent.
Universal opt-out signals are not required in Utah. The statute does not mention signals such as Global Privacy Control, and the Utah AG and Division of Consumer Protection report of 2025 lists "authorize universal opt-out mechanisms" among suggested changes, which indicates it is not currently required. California and Colorado do require honoring such signals, so many multi-state sites honor them everywhere. Utah does not force that choice.
How does the UCPA compare with other states?
Three differences matter most in practice:
- Sensitive data. Utah requires notice and an opt-out. Virginia, Connecticut and Colorado require opt-in consent first.
- Universal opt-out signals. California and Colorado require businesses to honor them. Utah does not.
- Revenue floor and assessments. Utah has a $25 million revenue test and no data protection assessment duty. That makes it narrower and lighter than Virginia-model laws that rely on data volume alone.
For the details of each law, see our guides to Virginia, Connecticut, Colorado and California.
Who enforces the UCPA, and what are the penalties?
Only the state enforces it. The Division of Consumer Protection takes complaints and investigates, then refers matters with substantial evidence to the Utah Attorney General, who has exclusive authority to bring an action (13-61-401 and 13-61-402).
- Cure period. At least 30 days before suing, the Attorney General must send written notice naming each provision allegedly violated and the basis. If you cure within 30 days and give a written statement that the violation is cured and will not recur, no action can start. The original statute has no sunset date for this cure right, and a 2026 law firm review still describes it as in place. I found no source reporting that it has expired.
- Penalties. If you fail to cure, or you violate again after curing, the Attorney General can recover actual damages to the consumer and up to $7,500 for each violation.
- No private right of action. Consumers cannot sue under the UCPA, or under any other law for a UCPA violation.
An August 2026 Division of Consumer Protection presentation to a legislative committee restates these rules and lists changes suggested in the 2025 state report: extend deletion to all personal data, review automated decisions, make sensitive data opt-in, add data minimization, and authorize universal opt-out mechanisms. These are suggestions, not law. I found no published UCPA enforcement action.
What has changed since 2023?
- 2024: The legislature amended the UCPA's definitions and applicability sections (Laws of Utah 2024, chapters 186 and 381). I did not review those bills in detail, so this guide uses the current text as reproduced in the 2026 enrolled bill. Despite what some guides say, S.B. 227 is the 2022 bill that created the UCPA, not a 2024 amendment.
- 2025, H.B. 418 (effective July 1, 2026): Added the right to correct inaccuracies. It also created the Utah Digital Choice Act (Chapter 75), which adds social graph portability and interoperability duties for social media companies. That Act is separate from the UCPA.
- 2026, H.B. 357 (effective January 1, 2027): Brings motor vehicle manufacturers within the law and, for vehicles of model year 2030 or later, requires in-vehicle controls to view data categories and third-party sharing, opt out of sale or targeted advertising, and delete readily accessible data. It exempts limited safety and operational data. The Division's August 2026 slide deck says model year 2029, but the enrolled bill I read says 2030.
How do you comply? A short checklist
- Confirm whether you are in scope and record the date you checked.
- Map the data you collect from Utah residents, including cookies, pixels, SDKs and the vendors that receive it.
- Update your privacy notice with the five required items and the opt-out instructions.
- Build an opt-out (link, preference center or banner choice) that really stops the ad and sale flows it covers.
- Show notice and an opt-out before processing sensitive data, and use COPPA-style consent for known children.
- Track the 45-day clock for requests, including correction, and sign processor contracts.
Frequently asked questions
Does the Utah Consumer Privacy Act require cookie consent?
No. Utah relies on notice and opt-out, not opt-in. You must disclose your data practices and offer an opt-out if cookies feed targeted advertising or sales. Parental consent is needed only for known children.
Does Utah require opt-in consent for sensitive data?
No. A controller must give clear notice and an opportunity to opt out before processing sensitive data. For a known child, COPPA's rules apply instead. Virginia, Connecticut and Colorado require opt-in consent.
Does Utah have a right to correct inaccurate data?
Yes, since July 1, 2026. H.B. 418 added the right to ask a controller to correct inaccuracies, taking into account the nature of the data and the purposes of the processing.
What are the penalties under the UCPA?
Up to $7,500 per violation, plus actual damages to the consumer, recoverable by the Attorney General only after the 30-day cure process fails. There is no private right of action.
Is there still a 30-day cure period in Utah?
Yes, based on the statute text and a 2026 law firm review. I found no sunset date.
Do I have to honor Global Privacy Control in Utah?
Not under the UCPA. You may still need to honor it for visitors in states that require it.
Does the UCPA apply to small businesses?
Generally no. It needs at least $25 million in annual revenue plus the consumer-count tests above. Motor vehicle manufacturers are the exception from 2027.
If you manage consent banners and opt-outs across several states, a consent management platform can help you apply the right rule by visitor location. Secure Privacy offers one.
