Utah
Utah Consumer Privacy Act
Utah’s consumer privacy law. It gives Utah residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since December 31, 2023
- Citation
- Utah Code § 13-61-101 et seq.
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses with revenue over $25 million that also handle data of 100,000+ Utah residents a year (or 25,000+ if they earn revenue from selling data).
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access and delete the data they gave you, get a copy, and opt out of targeted ads and the sale of their data.
- Give notice and a way to opt out before using sensitive data.
- Respond to correction requests (since Jul 1, 2026).
Who has to comply
The Utah Consumer Privacy Act took effect on December 31, 2023. It applies only to larger businesses: annual revenue of $25 million or more, and either personal data of 100,000 or more Utah consumers in a calendar year, or data of 25,000 or more consumers while getting over 50% of gross revenue from selling personal data.
Nonprofits are exempt, as are government bodies, tribes and colleges. HIPAA health information and Gramm-Leach-Bliley data are exempt too.
Visitors’ rights and your deadlines
- Rights to confirm and access their data, delete the data they gave you, get a portable copy of that data, and opt out of targeted advertising and sale.
- New from July 1, 2026 (HB 418): a right to have inaccurate data corrected.
- No right to opt out of profiling.
- Respond within 45 days, extendable once by 45 more.
- If you decline, tell the consumer why.
Opt-out signals and sensitive data
Utah doesn’t require businesses to honor universal opt-out signals such as Global Privacy Control; consumers send requests by the means the business provides. A legislative committee listed authorizing them as a recommendation in August 2026.
Sensitive data, including racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, and specific geolocation, needs clear notice and a chance to opt out, not opt-in consent. Children’s data must be handled under COPPA.
Your privacy notice
Give a reasonably accessible and clear privacy notice covering the categories of data you process, why, how consumers use their rights, and the categories of data you share with third parties. If you sell data or use it for targeted advertising, disclose that and how to opt out.
Enforcement
The Division of Consumer Protection takes complaints and refers them to the Attorney General, who alone enforces the law; there’s no private right of action. The Attorney General must give at least 30 days’ notice to cure before suing. Penalties are up to $7,500 per violation, plus actual damages.
A July 2025 report counted 32 consumer complaints. In June 2025 Utah sued Snap, saying it violated the Act by not telling consumers about its data collection and processing.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
A plain-English summary, last reviewed October 25, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does Utah’s privacy law apply to small businesses?
Only if annual revenue is $25 million or more and the business also meets one of the data volume tests.
Do I have to honor Global Privacy Control in Utah?
The law doesn’t require it. Honoring it anyway is simple with a consent tool.
Can Utah consumers correct their data?
Yes, since July 1, 2026.
Is there a cure period in Utah?
Yes. The Attorney General must give 30 days’ written notice before bringing an action.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
