Utah UCPA
Amended Utah · In force Dec 31, 2023 · next deadline Jan 1, 2027 (in 3 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Business-friendly comprehensive privacy law with access, deletion, portability and opt-out rights (targeted advertising, sale); sensitive data needs notice and a chance to opt out rather than opt-in consent, and data protection assessments are not required. A right to correct was added from July 1, 2026, and from Jan 1, 2027 the law covers motor vehicle manufacturers regardless of thresholds.
- Who it applies to
- Controllers or processors conducting business in Utah or targeting Utah residents with annual revenue of $25,000,000 or more that either control or process personal data of 100,000+ consumers in a calendar year, or derive over 50% of gross revenue from selling personal data and control or process data of 25,000+ consumers (13-61-102). From Jan 1, 2027, also any motor vehicle manufacturer whose vehicles are sold or leased in Utah and that collects personal data through a vehicle data collection system. Exempts government, tribes, higher education, nonprofits, HIPAA entities, GLBA, and others.
- Penalties
- AG may recover actual damages and up to $7,500 per violation not cured (13-61-402(3)(d)). Mandatory 30-day notice-and-cure period; it does not sunset. The Division of Consumer Protection takes complaints and refers cases to the AG. No private right of action.
- Enforced by
- Utah Attorney General (exclusive), on referral from the Utah Division of Consumer Protection
- Official name
- Utah Consumer Privacy Act (SB 227, 2022)
- Citation
- Utah Code 13-61-101 et seq. (Laws 2022, ch. 462; amended 2025 ch. 468, 2026 ch. 193)
- Topics
- privacy
Research notes
Amendments are identified by session-law chapter from the Utah Code version notes. The bill numbers behind 2025 ch. 468 and 2026 ch. 193 were not confirmed. Utah's separate 2025 social media data portability/interoperability law (Digital Choice Act) is reported to take effect July 2026 but sits outside the UCPA and is not included here. SB 227 signing date is March 24, 2022 per contemporaneous reporting.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Utah UCPA
- What are the Utah UCPA compliance deadlines?
- Dec 31, 2023: UCPA takes effect. Jul 1, 2026: Right to correct takes effect. Jan 1, 2027: UCPA extends to motor vehicle manufacturers.
- When does Utah UCPA take effect?
- Utah UCPA took effect on Dec 31, 2023. The next milestone is Jan 1, 2027: UCPA extends to motor vehicle manufacturers.
- Who does Utah UCPA apply to?
- Controllers or processors conducting business in Utah or targeting Utah residents with annual revenue of $25,000,000 or more that either control or process personal data of 100,000+ consumers in a calendar year, or derive over 50% of gross revenue from selling personal data and control or process data of 25,000+ consumers (13-61-102). From Jan 1, 2027, also any motor vehicle manufacturer whose vehicles are sold or leased in Utah and that collects personal data through a vehicle data collection system. Exempts government, tribes, higher education, nonprofits, HIPAA entities, GLBA, and others.
- What are the penalties under Utah UCPA?
- AG may recover actual damages and up to $7,500 per violation not cured (13-61-402(3)(d)). Mandatory 30-day notice-and-cure period; it does not sunset. The Division of Consumer Protection takes complaints and refers cases to the AG. No private right of action.