Utah UCPA — Utah Consumer Privacy Act

Why does it matter?

The UCPA is the lightest of the state consumer privacy acts, and a program built for a heavier one can over-deliver here while still missing Utah's specifics. Sensitive data needs clear notice and an opt-out, not consent (13-61-302(3)). A sale means an exchange for monetary consideration only (13-61-101). There is no assessment duty, no appeal duty and no profiling opt-out, but since July 1, 2026 there is a right to correct (13-61-201(4)). Enforcement runs through the Division of Consumer Protection to the Attorney General, who may recover actual damages plus up to $7,500 per violation after a 30-day notice and cure (13-61-402).

Key benefits include:

• Two tests, both required

Annual revenue of $25,000,000 or more and either 100,000 consumers' data in a calendar year or 25,000 consumers' data with over 50 percent of gross revenue from sales (13-61-102(1)).

• Sensitive data: notice and opt-out

A controller may not process sensitive data collected from a consumer without first presenting clear notice and an opportunity to opt out, or, for a known child, complying with COPPA (13-61-302(3)).

• No assessments, no appeals

Chapter 61 contains no data protection assessment section and no appeal section; a refusal is explained within 45 days and the consumer's recourse is a Division complaint (13-61-203(3) and 13-61-401).

• A two-step enforcement path

The Division receives and investigates complaints and refers substantial evidence to the Attorney General, who has exclusive authority and must give 30 days' written notice before acting (13-61-401 and 13-61-402).

• The right to correct since July 1, 2026

HB 418 of 2025 added subsection (4) to 13-61-201: a consumer may ask a controller to correct inaccuracies, taking into account the nature of the data and the purposes of processing.

How does it work?

A consumer exercises a right by a request through the means the controller prescribes; a parent acts for a known child (13-61-202). The rights in 13-61-201 are to confirm processing and access the data, delete data the consumer provided, obtain a portable and readily usable copy of data the consumer provided, correct inaccuracies, and opt out of targeted advertising or the sale of personal data. The controller acts and informs the consumer within 45 days, may extend once by 45 days with notice and reasons, explains any refusal within 45 days, answers free once in 12 months, and may charge or refuse for excessive, repetitive or harassing requests on which it bears the burden (13-61-203).

Section 13-61-302 sets the controller's duties: a reasonably accessible and clear privacy notice listing the categories processed, the purposes, how to exercise a right, and the categories shared and the categories of third parties, plus a clear and conspicuous disclosure of how to opt out of sales and targeted advertising. The controller keeps reasonable administrative, technical and physical data security practices, gives sensitive-data notice and opt-out, does not discriminate against a consumer who exercises a right, and cannot enforce a contract term that waives a right. Processors follow instructions, help with security and breach notification under 13-44-202, and sign a contract covering instructions, nature, purpose, data types, duration, confidentiality and subcontractor flow-down (13-61-301).

Enforcement begins at the Division of Consumer Protection, which runs the complaint system, investigates and refers matters where the director finds substantial evidence (13-61-401). The Attorney General then gives written notice of each provision allegedly violated and the basis; no action may begin if the controller or processor cures within 30 days and states in writing that the violation is cured and will not recur. After a failed cure or a repeat, the Attorney General may recover actual damages to the consumer and up to $7,500 per violation, with liability shared by comparative fault (13-61-402). Recoveries fund the Consumer Privacy Account (13-61-403); there is no private right of action (13-61-305), and the chapter preempts local ordinances (13-61-103).

Key Elements

• Applicability (13-61-102)

Business in Utah or products targeted to residents, $25,000,000 annual revenue, and a 100,000-consumer or 25,000-consumer-plus-50-percent-sales threshold; from January 1, 2027 also motor vehicle manufacturers using a vehicle data collection system.

• Definitions (13-61-101)

Consumer (resident outside employment or commercial contexts), sale (monetary consideration only, with seven exclusions), sensitive data (origin, religion, sexual orientation, citizenship or immigration status, medical information, identifying genetic or biometric data, specific geolocation within 1,750 feet), targeted advertising, deidentified and pseudonymous data.

• Consumer rights (13-61-201)

Confirm and access, delete data the consumer provided, portable copy, correct inaccuracies (from July 1, 2026), and opt out of targeted advertising and sales.

• Requests and responses (13-61-202 and 13-61-203)

Controller-prescribed means, 45 days plus one 45-day extension, reasons for refusal within 45 days, one free response per 12 months, fee or refusal for excessive requests, authentication before compliance.

• Controller duties (13-61-302)

Five-item privacy notice, opt-out disclosure for sales and targeted advertising, scaled data security practices, sensitive-data notice and opt-out, non-discrimination, void waivers.

• Processors (13-61-301)

Adherence to instructions, assistance with security and 13-44-202 breach notification, a contract signed before processing that fixes the instructions, the nature and purpose, the data types, the duration, each party's rights, confidentiality and subcontractor terms; role is a fact-based determination.

What does it cover?

Chapter 61 applies to controllers and processors that do business in Utah or target Utah residents and meet both the $25,000,000 revenue test and one of the consumer-count tests in 13-61-102(1); from January 1, 2027 it also covers motor vehicle manufacturers whose vehicles collect personal data. It does not apply to governmental entities and their contractors, tribes, institutions of higher education, nonprofit corporations, HIPAA covered entities and business associates, air carriers, or to protected health information, research data, FCRA consumer reporting, GLBA financial institutions and data, Driver's Privacy Protection Act, FERPA and Farm Credit Act data, employment and benefits records, or purely personal processing (13-61-102(2)). COPPA parental consent satisfies the chapter's parental consent duty (13-61-102(3)).

What are its objectives?

SB 227's highlighted provisions state what the act does.

Give consumers the right to access and delete personal data held by covered businesses and to opt out of its collection and use for certain purposes.

Require covered businesses to safeguard personal data, explain how it is used and comply with rights requests.

Create a right to know what personal data a business collects, how it uses it and whether it sells it.

Let the Division of Consumer Protection accept and investigate complaints about processing.

Authorize the Attorney General to take enforcement action and impose penalties.

Framework in Context

The UCPA is one of the statutes the Division of Consumer Protection administers under Utah Code 13-2-1, a list that since HB 418 of 2025 also includes the Utah Digital Choice Act (Chapter 75), which requires social media services to provide a user's social graph in a portable format on a 13-61-201 request and to open interoperability interfaces from July 1, 2026. Sections 13-61-201(6) and 13-61-301 tie the act to Utah's breach notification law in Chapter 44. The controller and processor vocabulary matches the other state consumer privacy acts, so a shared request workflow works, but Utah's revenue gate, its notice-and-opt-out rule for sensitive data and the absence of assessment and appeal duties are its own.

Common Framework Mappings

The frameworks below are the ones a Utah program is usually mapped to, so that a single notice, request process and processor contract set covers Utah alongside them.

Mapped frameworks include:

APEC PF

CCPA/CPRA

CPA (CO)

CTDPA

GDPR

ISO 27701

NIST Privacy Framework v1.0

VCDPA