Utah
Utah Consumer Privacy Act (UCPA)
| Passed | March 24, 2023 |
| Effective Date | December 31, 2023 |
| Who it applies to |
Entities that conduct business in Utah or produce products or services targeted to Utah residents and have an annual revenue of $25,000,000 or more, and either (1) control or process the personal data of 100,000 or more consumers annually; or (2) derive over 50 percent of their gross revenue from the sale of personal data and control or process the personal data of 25,000 or more consumers. Exempt entities include nonprofits, government agencies, indigenous tribes, air carriers, and financial institutions subject to the Gramm-Leach-Bliley Act (GLBA). |
| Penalties | Up to $7,500 per violation |
What’s notable about it:
Utah’s is probably one of the least strict of the 12 comprehensive state privacy laws. The UCPA has a high application threshold, and like Iowa’s ICDPA, it neither offers consumers the right to correct inaccurate personal data nor requires consent before processing sensitive data.
It also does not require data controllers to conduct and document data protection impact assessments of each of its processing activities involving personal data.