Privacy Law Library

Utah Consumer Privacy Act

UCPA

Comprehensive privacy

Utah's comprehensive consumer privacy law gives Utah residents rights to confirm and access, delete data they provided, obtain a portable copy, correct inaccuracies (since July 1, 2026), and opt out of sale and targeted advertising. Sensitive data uses notice plus opt-out rather than opt-in consent, and there is no statutory appeal right. From January 1, 2027, Part 5 adds in-vehicle privacy duties for motor vehicle manufacturers.

Where
Utah
Citation
Utah Code Title 13, Chapter 61 (13-61-101 to 13-61-504)
Status
In force
In force since
2023-12-31
Last amended
2026-07-01
Enforced by
Utah Attorney General (exclusive enforcement, 13-61-402(1)); the Division of Consumer Protection receives complaints and refers matters (13-61-401)
People can sue
No
Penalties
Actual damages plus up to $7,500 per violation, only for uncured or repeat violations, after a written notice and a 30-day cure period that has no sunset (13-61-402(3)).
Applies to
  • Controllers and processors that conduct business in Utah or target products or services to Utah residents, have annual revenue of $25,000,000 or more, and in a calendar year process personal data of 100,000+ Utah consumers, or of 25,000+ consumers while deriving over 50% of gross revenue from selling personal data (13-61-102(1))
  • From 2027-01-01: motor vehicle manufacturers whose vehicles are sold or leased in Utah and that collect, transmit, or store personal data through a vehicle data collection system, with no revenue or volume threshold (13-61-102(1)(b), as amended by 2026 H.B. 357)
  • Exempt: governmental entities and their contractors, tribes, higher education, nonprofits, HIPAA covered entities and business associates, GLBA financial institutions and data, FCRA, DPPA, FERPA and Farm Credit Act data, employment-context data, air carriers (13-61-102(2))

What a privacy notice must say

  • Provide a reasonably accessible and clear privacy notice listing categories of personal data processed, processing purposes, how consumers exercise rights, categories shared with third parties, and categories of third parties.Utah Code 13-61-302(1)(a)(i)-(v)
  • Clearly and conspicuously disclose how consumers may opt out of sale of personal data and of processing for targeted advertising.Utah Code 13-61-302(1)(b) · Only if: Controller sells personal data or engages in targeted advertising
  • Before processing sensitive data, present clear notice and an opportunity to opt out; for a known child, process under COPPA instead.Utah Code 13-61-302(3)(a)-(b) · Only if: Controller processes sensitive data
  • Publicly commit to keep deidentified data in deidentified form and not attempt reidentification, for the data to count as deidentified.Utah Code 13-61-101(14)(a)(ii)(B) · Only if: Controller treats data as deidentified
  • Disclose public-interest research processing in the privacy notice to rely on the research exemption.Utah Code 13-61-304(1)(j) · Only if: Controller relies on the research exemption

Rights it gives people

  • Consumers may request correction of inaccuracies in their personal data.Utah Code 13-61-201(4) · From 2026-07-01
  • Consumers may confirm processing and access, delete data they provided, obtain a portable copy, and opt out of targeted advertising or sale.Utah Code 13-61-201(1)-(3), (5)

Practices it requires

  • Motor vehicle manufacturers (model year 2030 or later) must provide persistent, clearly labeled in-vehicle controls to view data and third-party categories, opt out of sale or targeted advertising, and delete readily accessible data; delete all personal data within five business days after a court order or request with a protective order.Utah Code 13-61-502 · Only if: Motor vehicle manufacturer · From 2027-01-01
  • Authenticate and respond to requests within 45 days (one 45-day extension with notice); give reasons for refusal within 45 days; first request in 12 months is free.Utah Code 13-61-203
  • Do not discriminate against consumers for exercising rights (loyalty-program and targeted-advertising carve-outs); contract terms waiving rights are void.Utah Code 13-61-302(4), (6)
  • Processor contracts must set instructions, confidentiality, and subcontractor flow-down terms.Utah Code 13-61-301

Security duties

  • Maintain reasonable administrative, technical, and physical data security practices.Utah Code 13-61-302(2)

Sources

Checked against these sources on 2026-09-23 by research agent (Claude), primary sources.

Unverified: The UCPA enforcement report due to the Business and Labor Interim Committee before July 1, 2025 (13-61-404) was not located. | Utah Administrative Code rules were not reviewed.

Research reference, not legal advice.