What is the Utah Consumer Privacy Act?

The Utah Consumer Privacy Act (UCPA) is Utah's comprehensive consumer privacy law. It became effective on December 31, 2023 and establishes rights for Utah consumers regarding their personal data.

What rights do consumers have under the UCPA?

Consumers generally have the right to confirm whether their personal data is being processed, access their personal data, request deletion of personal data they provided, obtain a copy of their personal data, request correction of inaccurate personal data, opt out of targeted advertising and opt out of the sale of personal data.

Does the UCPA require consent for all data processing?

No. The UCPA generally follows an opt-out model. However, specific requirements apply to sensitive data, including providing clear notice and an opportunity to opt out. Other situations may require consent under the law or applicable regulations.

What is sensitive data under the UCPA?

Sensitive data includes certain categories of information that can present heightened privacy risks, including information relating to racial or ethnic origin, religious or philosophical beliefs, sexual orientation, citizenship or immigration status, medical information, biometric data used for identification, and specific geolocation data.

Does the UCPA cover targeted advertising?

Yes. Consumers have the right to opt out of processing their personal data for targeted advertising.

Does the UCPA give consumers the right to opt out of data sales?

Yes. Consumers can opt out of the sale of their personal data.

Does the UCPA recognize a universal opt-out signal such as GPC?

The UCPA does not currently impose the same universal opt-out preference-signal requirements found in certain other U.S. state privacy laws. Organizations should therefore assess their UCPA obligations separately from requirements under other applicable state laws.

Does the UCPA apply to cookies and trackers?

The UCPA regulates personal data processing rather than cookies as a standalone technology. Cookies, pixels, SDKs, advertising technologies, and other trackers may nevertheless process personal data or support targeted advertising, making tracking discovery and privacy preference management important parts of a broader compliance program.

How quickly must businesses respond to UCPA consumer requests?

Controllers generally must respond to consumer rights requests within 45 days of receiving the request, subject to applicable statutory conditions and exceptions.

Does the UCPA include a right to correct data?

Yes. Utah's privacy law was amended to provide consumers with a right to correct inaccurate personal data, with the relevant amendment taking effect on July 1, 2026.

Does the UCPA require data protection assessments?

The UCPA does not impose the same broad data protection assessment requirement found in several other U.S. state privacy laws. Organizations should still evaluate their processing activities, security practices, and risks as part of their broader privacy governance program.

Can ConsentX make my organization UCPA compliant?

ConsentX can help operationalize important privacy controls such as consent and preference management, tracker discovery, prior-script blocking, consumer rights workflows, and audit evidence. However, no software can independently guarantee legal compliance. Your organization's complete compliance program should be assessed against the UCPA and other applicable laws.

Utah, United States

Utah Consumer Privacy Act Compliance with ConsentX

Simplify Utah Consumer Privacy Act Compliance

ConsentX helps businesses operationalize compliance with the Utah Consumer Privacy Act (UCPA) through privacy preference management, consent controls, tracker discovery, consumer rights workflows, and audit-ready privacy records.

The UCPA gives Utah consumers greater control over their personal data, including rights to access, delete, obtain a copy of their data, correct inaccurate data, and opt out of targeted advertising and the sale of personal data.

Region

Utah, United States

Status

In force since December 31, 2023

Group

United States

Who Does the UCPA Apply To?

The UCPA generally applies to businesses that conduct business in Utah or target products or services to Utah residents, meet the law's revenue threshold, and satisfy specified data-processing or revenue-from-data-sale thresholds.

The law generally applies to businesses with annual revenue of at least $25 million that either control or process personal data of 100,000 or more consumers during a calendar year, or derive more than 50% of gross revenue from selling personal data while processing data of at least 25,000 consumers, subject to statutory exemptions.

Key UCPA Obligations

Provide a reasonably accessible and clear privacy notice
Disclose categories and purposes of personal data processing
Provide consumer access, deletion, portability, and correction rights
Allow consumers to opt out of targeted advertising
Allow consumers to opt out of the sale of personal data
Provide notice and an opportunity to opt out of sensitive data processing
Maintain reasonable administrative, technical, and physical security safeguards
Respond to consumer privacy requests within the required timeframe
Avoid discrimination against consumers for exercising their privacy rights
Obtain appropriate consent where required, including for certain sensitive-data processing

How ConsentX Helps with UCPA Compliance

Transparent Privacy & Consent Management

Create clear privacy preference experiences that help consumers understand how their information and tracking technologies are used.

Sensitive Data Controls

Support privacy workflows for sensitive-data processing by providing appropriate notices, preference controls, and consent records where applicable.

Targeted Advertising Opt-Out

Give consumers an accessible way to manage preferences relating to targeted advertising and other applicable privacy choices.

Sale of Personal Data Controls

Centralize privacy preferences and opt-out workflows for consumers who choose to restrict the sale of their personal data.

Prior-Script Blocking

Prevent non-essential trackers and scripts from activating before the appropriate privacy preference or consent condition is satisfied.

xScan-AI Privacy Discovery

Identify cookies, trackers, scripts, and other technologies operating across your website to help teams understand their data collection and tracking environment.

Consumer Rights Management

Manage privacy requests through structured workflows for access, deletion, portability, and correction requests.

Consent Records & Audit Evidence

Maintain centralized records of privacy choices and consent events, creating an audit-ready evidence trail for compliance teams.

Geo-Aware Compliance

Apply privacy experiences and controls based on the visitor's location, helping organizations manage UCPA requirements alongside other U.S. state privacy laws.

Disclaimer: This page provides general information about the Utah Consumer Privacy Act and is not legal advice. UCPA requirements may vary based on an organization's business activities, data practices, consumers, applicable exemptions, and other laws. Organizations should obtain qualified legal advice to determine their specific compliance obligations.

UCPA Compliance, Made Practical

ConsentX turns privacy requirements into an operational workflow:

DiscoverNotifyCapture PreferencesEnforceRecordRespondAudit

Identify tracking technologies, present appropriate privacy information, give consumers meaningful choices, enforce those choices across your website, maintain evidence, and manage privacy rights requests from one platform.

Start Free Book a Demo