Key Facts
Overview
The UCPA is the most business-friendly US state comprehensive privacy law, requiring both a $25M+ revenue threshold and a data volume threshold. This dual-threshold approach means significantly fewer businesses fall under its scope compared to other state laws.
What This Means for Your Website
- Opt-in consent is needed for sensitive data processing
- Consumers can access, delete, and port their data, and opt out of sale and targeted advertising
- No right to correct data or opt out of profiling, narrower consumer rights than most states
- A permanent 30-day cure period applies before enforcement
Key Requirements
The Utah AG and Division of Consumer Protection enforce the UCPA with penalties up to $7,500 per violation. Consumer requests must be fulfilled within 45 days. The dual threshold ($25M+ revenue AND data volume requirements) creates the highest bar for applicability among US states.
How ConsentStack Handles This
ConsentStack detects Utah visitors and applies the UCPA's opt-out model with opt-in for sensitive data categories.
Penalties
Up to $7,500 per violation.
Key Requirements
- Privacy notice disclosing data practices
- Opt-in consent for sensitive data
- Consumer rights: access, delete, portability, opt out of sale and targeted advertising
- 45-day response window for consumer requests
- Reasonable data security practices
Notable Provisions
- Most business-friendly US state privacy law
- Dual threshold (revenue + data volume) is unique
- No right to correct data or opt out of profiling
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data, generally free of charge unless it is your second or later request in the same 12-month period.
Have a controller delete the personal data you provided to it; Utah's right does not reach data the controller obtained about you from other sources.
Obtain a copy of the personal data you previously provided to a controller in a format that is portable to the extent technically feasible, readily usable to the extent practicable, and lets you transmit it to another controller without impediment where the processing is automated.
Ask a controller to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing; this right took effect on July 1, 2026.
Opt out of the processing of your personal data for targeted advertising, meaning ads selected from your activities over time and across nonaffiliated websites or online applications.
Opt out of the sale of your personal data, which Utah defines as an exchange of personal data for monetary consideration by a controller to a third party.
Receive clear notice and an opportunity to opt out before a controller processes your sensitive data; this is a controller duty outside the request process, so no statutory response deadline applies.
A controller may not deny you goods or services, charge you a different price or rate, or give you lower quality because you exercised a right, though it may offer different terms after you opt out of targeted advertising or within a bona fide loyalty, rewards, premium features, discounts or club card program.
Submit a complaint about a controller's or processor's alleged violation to the Utah Division of Consumer Protection, which may investigate and refer the matter to the Attorney General for enforcement.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with UCPA
ConsentStack helps you implement Opt-out consent for Utah, United States automatically.