Utah Consumer Privacy Act Compliance with ConsentX

The Utah Consumer Privacy Act (UCPA) is Utah's comprehensive consumer privacy law. It became effective on December 31, 2023 and establishes rights for Utah consumers regarding their personal data.

Consumers generally have the right to confirm whether their personal data is being processed, access their personal data, request deletion of personal data they provided, obtain a copy of their personal data, request correction of inaccurate personal data, opt out of targeted advertising and opt out of the sale of personal data.

No. The UCPA generally follows an opt-out model. However, specific requirements apply to sensitive data, including providing clear notice and an opportunity to opt out. Other situations may require consent under the law or applicable regulations.

Sensitive data includes certain categories of information that can present heightened privacy risks, including information relating to racial or ethnic origin, religious or philosophical beliefs, sexual orientation, citizenship or immigration status, medical information, biometric data used for identification, and specific geolocation data.

Yes. Consumers have the right to opt out of processing their personal data for targeted advertising.

Yes. Consumers can opt out of the sale of their personal data.

The UCPA does not currently impose the same universal opt-out preference-signal requirements found in certain other U.S. state privacy laws. Organizations should therefore assess their UCPA obligations separately from requirements under other applicable state laws.

The UCPA regulates personal data processing rather than cookies as a standalone technology. Cookies, pixels, SDKs, advertising technologies, and other trackers may nevertheless process personal data or support targeted advertising, making tracking discovery and privacy preference management important parts of a broader compliance program.

Controllers generally must respond to consumer rights requests within 45 days of receiving the request, subject to applicable statutory conditions and exceptions.

Yes. Utah's privacy law was amended to provide consumers with a right to correct inaccurate personal data, with the relevant amendment taking effect on July 1, 2026.

The UCPA does not impose the same broad data protection assessment requirement found in several other U.S. state privacy laws. Organizations should still evaluate their processing activities, security practices, and risks as part of their broader privacy governance program.

ConsentX can help operationalize important privacy controls such as consent and preference management, tracker discovery, prior-script blocking, consumer rights workflows, and audit evidence. However, no software can independently guarantee legal compliance. Your organization's complete compliance program should be assessed against the UCPA and other applicable laws.