Utah Consumer Privacy Act (UCPA)

Key definitions in UCPA

The Utah Privacy law introduces several critical terms that businesses and consumers need to understand, as defined in Section 13-61-101 of the Utah Code.

1. Consumer: An individual who is a Utah resident, acting in an individual or household context. This definition excludes individuals acting in an employment or commercial context.
   
2. Personal data: Information that is linked or reasonably linkable to an identified or identifiable individual. This excludes de-identified data, aggregated data, or publicly available information.
   
3. Sensitive data: A subset of personal data revealing information such as racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, medical history, genetic or biometric data (for identification purposes), or specific geolocation data.
   
4. Controller: An individual or entity that determines the purposes and means of processing personal data.
   
5. Processor: An individual or entity that processes personal data on behalf of a controller.
   
6. Sale: The exchange of personal data for monetary consideration by the controller to a third party. This excludes disclosures to processors, affiliates, or when the consumer directs the controller to disclose the data.
   
7. Consent: An affirmative act by a consumer that unambiguously indicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer.
   
   

Who must comply with UCPA?

UCPA applies to for-profit businesses that:

• Conduct business in Utah or target Utah residents, and
• Have annual revenue of at least $25 million, and
• Either:
  • Control or process personal data of 100,000 or more consumers annually, or
  • Derive over 50% of gross revenue from the sale of personal data and control or process data of 25,000 or more consumers.

"(a) 'Consumer' means an individual who is a resident of the state acting in an individual or household context. (b) 'Consumer' does not include an individual acting in an employment or commercial context.”

- Section 13-61-101(10) of the UCPA

UCPA exemptions

The UCPA exempts certain entities and data, including:

• Nonprofit organizations
• Higher education institutions
• Entities covered by the Gramm-Leach-Bliley Act (GLBA)
• Health records subject to the Health Insurance Portability and Accountability Act (HIPAA)

Additionally, the UCPA does not apply to data processed in an employment or commercial (B2B) context.

Key provisions of UCPA

‍UCPA consumer rights & protections

Under the UCPA, Utah residents are granted the following rights over their personal data:

1. Right to access – Consumers can request to know what personal data a business collects about them.
2. Right to delete – Consumers may request that businesses delete their personal data.
3. Right to opt out – Consumers can opt out of targeted advertising and the sale of their personal data.
4. Right to data portability – Consumers can obtain a copy of their data in a readily usable format.

Controller and processor obligations

• Data security – Businesses must implement reasonable security measures.
• Transparency – Businesses must provide clear privacy notices detailing data collection and usage.
• Contracts – Controllers must have agreements with processors to ensure compliance.

Sensitive data processing

Businesses must provide notice and an opt-out option before processing sensitive data, including racial or ethnic origin, religious beliefs, sexual orientation, and health data.

Is UCPA opt-in or opt-out?

The Utah Consumer Privacy Act (UCPA) follows an opt-out model, allowing businesses to process personal data unless consumers opt out of data sales and targeted advertising. For sensitive data, businesses must provide notice and an opt-out option before processing. Unlike some laws, UCPA does not require opt-in consent or recognition of universal opt-out signals.

The price of non-compliance

Non-compliance with the Utah Consumer Privacy Act can lead to significant financial and legal consequences for businesses. 

UCPA fines & penalties

The Utah Attorney General is responsible for enforcing UCPA. Non-compliance may result in:

• Fines up to $7,500 per violation
• A 30-day cure period for businesses to remedy violations before enforcement action is taken

Unlike CCPA, there is no private right of action, meaning consumers cannot sue businesses directly for violations.

The impact of UCPA on businesses

What businesses need to know about UCPA

UCPA compliance affects businesses by requiring them to update their privacy policies, implement consumer rights request mechanisms, and improve data security measures. 

However, due to its lighter compliance burden compared to CCPA or CPRA, businesses may find it easier to adapt to UCPA requirements.

Key business considerations include:

• Lower compliance costs than California or Virginia laws
• Limited consumer rights reduce operational burden
• No requirement for data protection assessments
• More business-friendly enforcement mechanisms

What are the UCPA requirements for businesses?

To comply with UCPA, businesses must:

• Provide clear privacy notices disclosing data collection and processing practices
• Allow consumers to opt out of targeted advertising and data sales
• Implement reasonable security measures to protect personal data
• Respond to consumer rights requests within 45 days (with a possible 45-day extension if needed)

‍

‍

The impact of UCPA on consumers

Understanding Utah consumer rights

The Utah data privacy law enhances consumer data protection by granting Utah residents specific rights over their personal information. Key impacts on consumers include:

1. Enhanced data control: Consumers can access, delete, and obtain copies of their personal data held by businesses.
   
   
2. Opt-out options: Individuals can opt out of the sale of their data and its use for targeted advertising, reducing unwanted marketing.
   
   
3. Increased transparency: Businesses must provide clear privacy notices detailing data collection and sharing practices, enabling informed consumer choices. 

How UCPA compares to other U.S. data privacy laws

The UCPA aligns with several existing U.S. state privacy laws but also presents distinct features on scope, consumer rights, data controller obligations and penalties. 

UCPA vs other state privacy laws

‍

‍

What makes UCPA stand out?

UCPA is less restrictive than some other state privacy laws. It lacks provisions for a private right of action and does not include certain GDPR-inspired requirements, such as data minimization and purpose limitation.

Key distinctions include:

• No private right of action – Only the Utah Attorney General has enforcement authority.
• Opt-out for targeted advertising and data sales – Businesses are required to provide opt-out mechanisms, but consent is not required upfront.
• Lower applicability thresholds – UCPA applies to businesses that process data from at least 100,000 consumers or derive 50% of gross revenue from selling consumer data.

What are the differences between UCPA and GDPR?

The Utah Consumer Privacy Act (UCPA) differs from GDPR in key ways: UCPA applies only to businesses meeting revenue or data thresholds, while GDPR covers all organizations processing EU residents' data. UCPA follows an opt-out model for data sales, whereas GDPR requires a legal basis for processing. GDPR also mandates a Data Protection Officer (DPO) for some businesses, which UCPA does not.

How to ensure UCPA compliance

If you’ve read this far, you know that building a privacy-compliant business is important, but also far from easy. Here are eight key steps every business should take to ensure they don’t fall foul of regulators:

What is UCPA compliance

UCPA compliance means businesses follow the Utah Consumer Privacy Act by honoring consumer rights (access, deletion, and opt-outs for data sales and targeted ads), providing clear privacy notices, securing personal data, and ensuring reasonable data protection. The Utah Attorney General enforces violations, with fines of up to $7,500 per violation.

How to comply with UCPA

To comply with UCPA, you must:

1. Assess applicability – Determine if your business meets UCPA compliance thresholds.
2. Update privacy policies – Clearly disclose data collection and usage.
3. Implement opt-out mechanisms – Provide consumers with an easy way to opt out of targeted advertising and data sales.
4. Develop processes for consumer rights requests – Establish methods for responding to data access and deletion requests within 45 days.
5. Enhance data security measures – Implement reasonable security protocols to protect consumer data.

How Ketch can simplify UCPA compliance

With the Ketch Data Permissioning Platform, you can:

• Use our “clicks-not-code” interface to create policies for how data is handled throughout your data ecosystem, leveraging our templates for Utah-specific compliance
• Create customized, jurisdictionally-aware privacy notices for your customers
• Deploy Ketch data mapping and discovery tools to find and classify sensitive and personal data in every internal and external system
• Assign data processing purposes (like analytics or targeted advertising) and permissions to data, so you know exactly how your data may be used, sold, and/or shared
• Use our drag-and-drop DSR workflow tool to create automated, end-to-end DSR fulfillment processes that replace internal stakeholder tasks with automated execution of access and deletion requests 

‍

‍

When you automate these processes, you enable your internal stakeholders: 

• Your developers and marketers can do their jobs without fretting about regulations
• Your legal team can set guidelines for notice and consent, secure in the knowledge that any changes they make will ripple through your whole data ecosystem (including vendors or third-party companies using your data!)

Final thoughts: Preparing your business for UCPA

With the UCPA now in effect, businesses must proactively align their data privacy practices with the law's requirements. This involves not only compliance efforts but also fostering a culture of data protection and consumer respect. Staying informed about regulatory updates and engaging in continuous improvement will be crucial as data privacy laws evolve.

Contact Ketch today to streamline your compliance and future-proof your privacy strategy. 

Read further: 2025 U.S. State Privacy Laws: what you need to know

FAQs about the Utah privacy regulation