Utah, United States
Consumer privacy law
Utah UCPA: Who it covers and what websites must do
Utah’s Consumer Privacy Act applies only when a business meets both a $25 million revenue test and a data test. If it applies, your website needs opt-outs for targeted advertising and sale, notice and an opt-out for sensitive data, and a request process that now includes correction.
At a glance
- Who it can apply to
- Controllers and processors doing business in or targeting Utah with annual revenue of $25 million or more that also process data of 100,000+ Utah consumers a year, or 25,000+ with over 50% of revenue from data sales. Nonprofits are exempt.
- What it is
- A state consumer privacy law: the Utah Consumer Privacy Act (Utah Code Title 13, Chapter 61), in force since 31 December 2023 and enforced by the Attorney General.
- Choices to offer
- Opt-outs for targeted advertising and sale. For sensitive data, clear notice and an opportunity to opt out before processing, not general opt-in. Known children’s data follows COPPA.
- Website actions
- Apply the revenue test and a data test, then check exemptions.
- Disclose and test the targeted advertising and sale opt-outs.
- Give notice and an opt-out before processing sensitive data.
- Answer access, deletion, portability and correction requests within 45 days.
- Primary sources
- Utah Code, Title 13, Chapter 61: Utah Consumer Privacy Act; Utah Division of Consumer Protection: UCPA
- Last reviewed
Does the UCPA apply to your business?
Work through these steps in order. The UCPA applies only if you answer yes to steps 1–3 and no exemption applies.
- Utah connection: do you conduct business in Utah, or offer a product or service targeted to Utah residents?
- Revenue: is your annual revenue $25,000,000 or more? Revenue alone never brings you into scope.
- Data: in a calendar year, do you control or process personal data of 100,000 or more Utah consumers, or derive over 50% of gross revenue from selling personal data while handling data of 25,000 or more consumers?
- Exemptions: are you an exempt organisation, or is the data itself exempt?
The applicability section exempts, among others, nonprofit corporations, institutions of higher education, governmental entities, tribes, HIPAA covered entities and business associates, GLBA-regulated financial institutions and air carriers. Exempt data includes protected health information and employee or job applicant data.
A consumer is a Utah resident acting in an individual or household context. Count Utah residents whose data you process, not page views, and keep a dated note of the figures behind your decision.
What must a covered website offer?
Your privacy notice must be reasonably accessible and clear, and cover the categories of personal data, purposes, how to exercise rights, and the categories of data shared and of third parties receiving it.
If you sell personal data or engage in targeted advertising, you must clearly and conspicuously disclose how consumers can opt out. In Utah a sale requires monetary consideration, while targeted advertising is a separate activity, so “we do not sell data” does not settle the advertising opt-out.
Example: a covered retailer uses an ad network to reach visitors on unrelated websites. When a Utah customer opts out of targeted advertising, check both the browser tag and any audience upload that uses their data. Order processing can continue.
The UCPA does not mention browser opt-out signals such as Global Privacy Control. Honouring GPC for Utah visitors is your choice, not a UCPA requirement.
How does Utah treat sensitive data?
Sensitive data covers data revealing racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or medical history and health information; genetic or biometric data processed to identify a person; and specific geolocation accurate within 1,750 feet (about 530 metres). Under the controller duties, you must give clear notice and an opportunity to opt out before processing it.
That is the main Utah difference. Other states require prior opt-in consent for the same kind of data:
| State | Before processing sensitive data | Known children’s data |
|---|---|---|
| Utah | Before processing sensitive dataClear notice and an opportunity to opt out | Known children’s dataProcess in line with COPPA |
| Virginia | Before processing sensitive dataPrior consent (opt-in) | Known children’s dataParental consent under COPPA |
| Colorado | Before processing sensitive dataPrior consent (opt-in), also before selling it | Known children’s dataParental consent, plus rules for all under-18s |
If you run one experience for several states, you may choose opt-in for everyone. Describe that as your own policy rather than as a Utah requirement.
Which rights must you support?
Utah consumers can:
- confirm whether you process their personal data, and access it;
- delete personal data they provided to you;
- get a portable copy of personal data they previously provided;
- ask you to correct inaccurate personal data;
- opt out of targeted advertising and the sale of personal data.
1 July 2026 change: a 2025 amendment to Utah Code § 13-61-201 (Laws of Utah 2025, chapter 468) added the right to correct inaccuracies, taking into account the nature of the data and the purposes of processing. Add correction to your privacy notice and request form if they list only the original rights.
Utah has no profiling opt-out and no required appeal process, and deletion covers only data the consumer provided. You can offer more, but present extra rights as your policy, not as UCPA requirements.
Under the response rules, act on a request within 45 days. You can extend once by 45 days for complex or numerous requests if you tell the consumer before the first period ends. If you decline, give your reasons within 45 days. The first request in a 12-month period is free.
Website checklist
- Scope record: note your revenue figure, the data test you meet and any exemption, with the date.
- Opt-out test: opt out of targeted advertising as a test user; ad tags and audience uploads should stop for that user.
- Sensitive data: the notice and opt-out should appear before any form or feature collects sensitive data.
- Rights form: it should offer correction alongside access, deletion, portability and the opt-outs.
- Response clock: log a test request and confirm it is answered within 45 days.
FAQ
Does the UCPA require consent for every cookie?
No. It has no general opt-in rule for cookies. Assess what personal data each tool processes and why, and check other laws that apply to your visitors.
Does sharing data with an advertising partner count as a sale?
Only if it is an exchange for monetary consideration. Utah also excludes disclosures to processors and affiliates and, considering the context, disclosures that match the consumer’s reasonable expectations. Targeted advertising is assessed separately.
Does a targeted advertising opt-out mean all ads must disappear?
No. Ads based on activity on your own or affiliated sites, contextual ads, ads in response to a request and ad measurement alone are not targeted advertising under Utah’s definition.
Who enforces the UCPA, and is there a cure period?
The Division of Consumer Protection handles complaints and refers cases to the Attorney General, who alone can enforce the law. The Attorney General must first give 30 days’ written notice and cannot sue if you cure the violation and confirm this in writing. There is no private right of action.
What if we are just below the thresholds?
The UCPA does not apply, but other laws, contracts and platform policies may. Reassess when revenue or data volumes grow, or if you start selling personal data.