Utah Privacy Law

The Utah Consumer Privacy Act (UCPA) was signed into law on March 24, 2022, and became effective on December 31, 2023. Utah adopted the most business-friendly approach of the early state privacy laws, requiring both revenue and consumer thresholds to be met (using AND logic rather than OR), and providing fewer consumer rights than most other state privacy laws. The UCPA provides Utah consumers with rights to access, delete, and obtain a portable copy of their personal data, as well as the right to opt out of the sale of personal data and targeted advertising. Notably, the UCPA does not include a right to correction or an appeals process, making it one of the more limited state privacy laws from a consumer rights perspective. The law applies to controllers and processors that conduct business in Utah or target Utah consumers, have annual revenue of $25 million or more, AND meet one of two data processing thresholds: controlling or processing personal data of 100,000 or more consumers, or controlling or processing personal data of 25,000 or more consumers while deriving over 50% of gross revenue from the sale of personal data. The UCPA includes a 30-day cure period and penalties of up to $7,500 per violation, enforced by the Utah Attorney General. In March 2026, Governor Cox signed HB 357, which extends the UCPA to motor vehicle manufacturers that collect, transmit, or store personal data through vehicle data collection systems — regardless of the standard revenue and consumer count thresholds. Starting with 2029 model year vehicles, manufacturers must provide in-vehicle privacy controls enabling consumers to view data collection categories, opt out of data sales and targeted advertising, and delete readily accessible data.