This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
header image


Utah Consumer Privacy Act (UCPA)

Passed March 24, 2023
Effective Date December 31, 2023
Who it applies to

Entities that conduct business in Utah or produce products or services targeted to Utah residents and have an annual revenue of $25,000,000 or more, and either (1) control or process the personal data of 100,000 or more consumers annually; or (2) derive over 50 percent of their gross revenue from the sale of personal data and control or process the personal data of 25,000 or more consumers. Exempt entities include nonprofits, government agencies, indigenous tribes, air carriers, and financial institutions subject to the Gramm-Leach-Bliley Act (GLBA).

Penalties Up to $7,500 per violation

What’s notable about it:

Utah’s is probably one of the least strict of the 12 comprehensive state privacy laws. The UCPA has a high application threshold, and like Iowa’s ICDPA, it neither offers consumers the right to correct inaccurate personal data nor requires consent before processing sensitive data.

It also does not require data controllers to conduct and document data protection impact assessments of each of its processing activities involving personal data.

The Strict Spectrum

Less Strict