Utah Consumer Privacy Act: Check whether the law applies, then make the right choices available

Does UCPA apply to your business?

The law generally applies to a controller or processor doing business in Utah or targeting products or services to Utah residents that has annual revenue of at least $25 million and meets one of these conditions:

• Data volume: controls or processes personal data of at least 100,000 consumers during a calendar year.
• Data-sale business model: derives more than 50% of gross revenue from selling personal data and controls or processes personal data of at least 25,000 consumers.

The revenue condition and one of the additional conditions must be met. The Utah scope provision also lists exemptions, including specified entities and data.

A consumer is generally a Utah resident acting in an individual or household context, rather than employment or commercial activity. Count relevant consumers, not page views, and record the assumptions behind your assessment.

What your website should focus on

If your business is covered, review what personal data you collect, why you use it, who receives it and how consumers can act on their rights.

The main website priorities are an accessible privacy notice, opt-outs for sale and targeted advertising, appropriate handling of sensitive data and a working request process.

The Utah Division of Consumer Protection’s UCPA page is the official starting point. Avoid assuming that a familiar cookie category corresponds exactly to a statutory purpose.

Five things to get right

1. Explain the collection and sharing

Your notice should describe the categories of personal data processed, the purposes, how to exercise rights and the relevant categories of data and third parties involved in sharing.

Make that information understandable at the points where customers interact with you. A lead form and an ecommerce checkout may involve different information and recipients.

Keep the notice connected to your tool inventory. If the live website sends data to a recipient the notice does not account for, review both before continuing the integration.

2. Offer relevant advertising and sale opt-outs

Utah gives consumers a right to opt out of targeted advertising and the sale of personal data as defined by the law. Sale focuses on monetary consideration, while targeted advertising is a separate activity.

This means “we do not sell data” is not enough to conclude that no advertising opt-out is needed. Review how audience-building and advertising tools use the information.

Give visitors a clear way to exercise the applicable choice. Test whether it affects browser integrations, server-side events and relevant exports.

3. Handle sensitive data under Utah’s rules

Utah generally requires clear notice and an opportunity to opt out before processing sensitive data. This differs from states that generally require prior opt-in consent for that category.

The state’s consumer fact sheet explains the sensitive-data choice and core rights. Known children’s data requires separate attention, including the applicable COPPA standard.

For a multi-state website, you may decide to offer a consistent, more protective consent experience. If you do, describe it as your chosen approach rather than claiming Utah imposes exactly the same rule as every other state.

4. Implement the rights Utah actually provides

Consumers can confirm processing, access personal data, request deletion of data they provided and obtain a copy of data they previously provided, subject to the law’s conditions. Sale and targeted-advertising opt-outs are also included.

Do not import a general correction right, profiling opt-out or appeal requirement from another state and label it a UCPA requirement. You can offer additional rights voluntarily, but your published promise should be something you can honour.

Prepare a request process with appropriate authentication, a response timetable and a way to reach the relevant systems. The ordinary response period is 45 days, with a permitted extension under the statutory conditions.

5. Align security and supplier instructions

The privacy experience extends beyond the banner. Use appropriate safeguards and ensure processors follow the relevant instructions and contractual requirements.

Identify which suppliers hold data relevant to access or deletion requests. Keep the relationship clear enough that a request can be acted on without starting an investigation from scratch.

Review what happens when a contract ends. A supplier that no longer serves a business purpose should not continue receiving website events simply because a script was left installed.

A practical advertising example

A covered Utah retailer uses a third-party advertising service to reach visitors across unrelated websites. A customer opts out of targeted advertising.

The retailer should verify the relevant activity stops, including any audience uploads that use the same information for the same covered purpose. Essential order processing can be assessed separately.

If the retailer uses the same consent platform across multiple states, test Utah’s configured experience directly. A region setting can accidentally remove a needed opt-out or display an explanation that does not match how the site behaves.

What this means for a smaller business

A business below the UCPA thresholds should still check other applicable laws, customer commitments and contractual duties. Being outside this particular statute does not make every use of personal data unrestricted.

A useful first step is a short written scope decision, a current tool list and an accurate privacy notice. These also make reassessment easier if revenue grows or the business introduces a data-sale model.

Prioritise actual collection and sharing over unnecessary banner complexity. Customers benefit from clear information and controls that genuinely work.

Website checklist

• Check revenue: confirm the annual-revenue condition.
• Check the second test: assess consumer volume or the data-sale condition.
• Check exemptions: review relevant entity and data exclusions.
• Check notices: align categories, purposes, recipients and rights with reality.
• Test opt-outs: include targeted advertising and sale where applicable.
• Check sensitive data: provide the required notice and opportunity to opt out.
• Test requests: verify access, relevant deletion and portability workflows.
• Review growth: reassess scope and settings when the business or tools change.

FAQ