Utah Consumer Privacy Act (UCPA) (Utah)
Utah has enacted the Utah Consumer Privacy Act (UCPA) (Utah). The law is currently in effect. It applies to controls or processes personal data of >=100,000 consumers or >=25,000 consumers and derives >50% of gross revenue from sale of personal data and annual revenue >=$25m. Consumers have the right to delete their data, opt out of data sales, opt out of targeted advertising. Violations can result in penalties of up to $7,500 per violation.
Important Notes
No right to correct or appeal. No data minimization or DPA requirements. 30-day cure period. Penalty up to $7,500 per violation.
Privacy Compliance Tools — Partner Services
Need help achieving Utah compliance? These tools help businesses manage consent, honor consumer requests, and maintain audit-ready records.
Sponsored. DataTactic may earn a referral fee from these partners. This does not affect our data or editorial content.
What is the Utah and who does it apply to?
The Utah Consumer Privacy Act (UCPA) (Utah) is Utah's comprehensive consumer privacy law, effective 2023-12-31. Controls or processes personal data of >=100,000 consumers OR >=25,000 consumers AND derives >50% of gross revenue from sale of personal data AND annual revenue >=$25M
What rights do Utah consumers have under Utah?
Under the Utah, Utah consumers have the right to: access their personal data, request deletion of their data, obtain a portable copy of their data, opt out of the sale of their personal data, opt out of targeted advertising.
Does Utah require consent for sensitive data?
The Utah does not require opt-in consent for sensitive data — instead it uses an opt-out model. Businesses must provide mechanisms for consumers to opt out of sensitive data processing.
What are the penalties for violating Utah?
Violations of the Utah can result in civil penalties of up to $7,500 per violation and up to $7,500 per willful violation. There is no private right of action — enforcement is exclusively by the state Attorney General.
Does Utah require a data protection assessment?
The Utah does not require data protection assessments, which makes it less operationally demanding than laws like the VCDPA or Colorado CPA.
Is there a universal opt-out requirement under Utah?
The Utah does not currently require recognition of universal opt-out mechanisms. Businesses are not required to honor browser-based opt-out signals.
How long does a business have to respond to a consumer request under Utah?
Businesses must respond to consumer privacy requests within 45 days under the Utah. An extension of up to 45 additional days is available with notice to the consumer.
Official Source
Utah Attorney General
More Utah Resources
Data Methodology
DataTactic researchers verify privacy law data directly against official government sources — Utah Attorney General publications, state statutes, and agency websites. Each data point is cross-referenced against primary sources before publication. Records are reviewed and updated when laws or requirements change.
Last verified: 2026-06-01 · DataTactic provides reference information only. This is not legal advice. Consult a qualified attorney for compliance guidance.