Privacy Laws
Utah
UT
Utah Consumer Privacy Act
UCPA
Most business-friendly of the early state privacy laws. Requires both revenue threshold AND consumer threshold. Opt-out model for sensitive data rather than opt-in.
Effective Date
2023-12-31
Enforcement
Attorney General + Division of Consumer Protection
Consumer Threshold
100,000 consumers
Revenue Threshold
$25,000,000
Key Requirements
Privacy notice with required disclosures
Right to access personal data
Right to delete personal data
Right to data portability
Right to opt-out of sale and targeted advertising
Opt-out for sensitive data (not opt-in)
Processor contracts required
Security practices
Penalties
Up to $7,500 per violation.
Cure Period
30-day cure period
E-commerce Relevance
Higher bar: must meet $25M revenue AND consumer thresholds. More business-friendly than other states.