Utah Consumer Privacy Act

The Utah Consumer Privacy Act (UCPA) placed new obligations on businesses processing consumer data in Utah, while giving Utah citizens new data rights. Passed on March 25, 2022, the UCPA will go into force on December 31, 2023.

To fall under the UCPA, an organization must:

• Have an annual revenue of $25 million or more
• Conduct business in Utah or market to Utah residents

The organization must also:

• Process or control the data of at least 100,000 Utah residents OR
• Derive 50% or more gross revenue from selling personal data and control data for 25,000 or more consumers

Under the UCPA, Utah residents are granted certain data rights.

Right to access - Utah residents can request access to any personal data possessed by an organization.

Right to delete - Residents have the right to request that an organization delete their personal data. It should be noted though that, unlike other state privacy laws, a consumer may only request deletion for data they provided.

Right to data portability - Utah consumers may request a copy of their data in a readable, transmittable format.

Right to opt-out - Utah consumers have the right to opt out of targeted advertising, sale of personal data, and processing of sensitive data. However, they can’t opt-out of profiling based on automated decision making.

Learn more with our complete guide to the Utah Consumer Privacy Act.