U.S. Consumer Data Privacy Law Guide: Utah

This state-specific guide covers data privacy law, rules, and regulations that professionals and clients often encounter or have questions about in Utah.

Overview

U.S. Consumer Data Privacy Law Guides

Key Contact

Vivien F. Peaden, AIGP, CIPP/US, CIPP/E, CIPM, PLS

T: 678.406.8722

Email Professional

Have Questions?
Let's Talk!

To contact a Baker Donelson Privacy Professional, click above to email us.

Last updated: December 2025

Please note this is a highlighted overview and not a complete overview of privacy laws for this state. If you would like a complete review of this state's privacy laws or a multi-state privacy compliance cheat sheet on specific topics, please contact Vivien Peaden at vpeaden@bakerdonelson.com.

Disclaimer: These materials do not constitute legal advice and should not be substituted for the advice of legal counsel.

The Utah Consumer Privacy Act (UCPA)

Effective Date: December 31, 2023, as amended by HB 418 in 2025, which enhances consumer control over personal data, particularly from social media companies. This new amendment will take effect on July 1, 2026.

1. Applicability Thresholds

Subject to certain entity-level and data-level exemptions, the UCPA applies to an individual or legal entity conducting business in Utah or producing products/services targeted to Utah residents (consumers) that:

having $25 million or more in revenue; and
controlling or processing:
- 100,000+ Utah consumers' personal data (during a calendar year); or
- 25,000+ Utah consumers' personal data and derive more than 50 percent of its revenue from the sale of personal data.

2. Key Definitions:

Sales of Personal Data: Narrowly defined as "the exchange of personal information for monetary consideration by a Controller to a third party," subject to certain exemptions.

3. Business Obligations:

The UCPA imposes additional obligations on persons who, alone or jointly with others, determine the purpose and means of processing personal information (Controller):

Data Processing Agreement (DPA): Processing activities by a supplier on the Controller's behalf (Processor) shall be governed by a DPA between the Controller and Processor.
Data Protection Assessment: None.
Privacy Notice: Yes, a Controller must provide consumers with a privacy notice that is reasonably accessible and clear, and disclose a list of required information.
Data Minimization and Purpose Limitation for Data Processing: The UCPA is a notable outlier that does not expressly provide for data minimization requirements.
Universal Opt-out Mechanism: None.

4. Consumer Rights:

Subject to certain exceptions, a Utah consumer has the right to:

Confirm whether a Controller is processing its personal data, and access the categories of data being processed;
Notably, the UCPA does not provide consumers the right to correct inaccuracies in their personal data;
Delete personal data in a readily usable format, which is narrowly scoped and limited to that provided by the consumer to the Controller;
Obtain a copy of their personal data, which is narrowly scoped and limited to that provided by the consumer to the Controller. However, effective July 1, 2026, a social media service shall provide Utah consumers the right to port their personal data in a readily usable format to transmit to another platform without impediment if the Controller processes the data by automated means; and
Opt out of data processing for targeted advertising and sales of personal data, but not for profiling.

5. Enforcement and Penalties:

Private Right of Action: None.

Penalties: Up to $7,500 per violation in civil penalties. The Utah attorney general may also recover actual damages to the consumer.

Cure Period: There is a 30-day cure period; unlike some states, this is a permanent cure period that does not have a cutoff date.