UTAH · STATE RESEARCH PROFILEUtah Consumer Privacy Act
UCPA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Revenue + numerical hybrid.
Core threshold: Annual revenue ≥$25M and either 100,000 consumers, or 25,000 consumers plus >50% gross revenue from sale
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Access | ✓ Included / qualified by statute |
| Deletion of data provided by consumer | ✓ Included / qualified by statute |
| Portability | ✓ Included / qualified by statute |
| Opt-out sale | ✓ Included / qualified by statute |
| Opt-out targeted advertising | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Clear notice + opportunity to opt out
Child means under 13; known-child sensitive-data processing follows COPPA.
Business obligations
Privacy notice, reasonable security, processor contracts, clear notice/opportunity to opt out for sensitive data and consumer-request mechanisms.
Enforcement
Authority: Utah Division of Consumer Protection / Attorney General
Private right of action: No
Penalty / remedy baseline: Up to $7,500 per violation plus actual damages after statutory enforcement process
What makes Utah different?
Utah is narrower than many peers: it has a $25 million revenue gate, fewer consumer rights, and generally uses notice plus opt-out rather than opt-in consent for sensitive data.
Developments to watch
The current code flags future changes effective in 2027. Those provisions are not presented here as current 2026 law.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.