Law / United States / 
Utah
Notice of Intent to Sell Nonpublic Personal Information Act
Utah Code 13-37-101 to 13-37-203
In force since .
A privacy notice rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
As of .
What it requires
- If you are a commercial entity (a person with a physical office in Utah that transacts business there with Utah consumers) and you enter into a consumer transaction, obtain nonpublic personal information from the person as a result, and intend to or want the ability to disclose it to a third party for compensation that is the primary consideration for the disclosure, give the person the notice Utah Code 13-37-201 prescribes (Utah Code 13-37-201(1)).
- Give the notice before the earlier of the point at which you request the information or otherwise obtain it, in the words "We may choose to disclose nonpublic personal information about you, the consumer, to a third party for compensation.", orally only if the whole transaction is oral and otherwise in dark bold, and conspicuously enough that a reasonable person would perceive it before providing the information (Utah Code 13-37-201(2) and (3)).
- Do not disclose nonpublic personal information you obtained on or after as a result of a consumer transaction if you failed to give the notice (Utah Code 13-37-202(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Statutory damages
Utah Code 13-37-203(2): a commercial entity that violates the chapter is liable to the individual who brings the action for $500 for each time it fails to provide the required notice in relation to that person's information, and for court costs. The action is individual only, not a class action or representative action, and must be brought within one year from the day of the consumer transaction (13-37-203(3)).
- As of
- Currency
- USD
- Per person minimum
- 500
Who enforces it
Enforcement body
No regulator is named; the chapter is enforced by an individual civil action in federal or state court (Utah Code 13-37-203).
What this law does
A commercial entity must give a person a notice if it enters into a consumer transaction with that person, obtains nonpublic personal information concerning the person as a result of the transaction, intends to or wants the ability to disclose the information to a third party for compensation, and the compensation is the primary consideration for, and directly related to, the disclosure.
The notice must be given before the earlier of the point at which the person is requested to provide the information or the commercial entity otherwise obtains it, and must read substantially as follows: "We may choose to disclose nonpublic personal information about you, the consumer, to a third party for compensation."
The notice may be oral if the consumer transaction itself is entirely conducted orally, or in writing if written in dark bold, and must be sufficiently conspicuous that a reasonable person would perceive it before providing the information.
A commercial entity is a person that maintains a physical office in the state and in the ordinary course transacts business at the physical office with consumers located in the state, and does not include a governmental entity or an entity providing services on behalf of one.
The chapter does not apply to a commercial entity subject to a federal law or regulation that governs the disclosure of nonpublic information to a third party or to a covered entity as defined in the federal health privacy rules, and notice is not required where the disclosure is related to the third party providing services, property or another thing of value to the commercial entity and the compensation is received in consideration of that transaction.
A commercial entity may not disclose nonpublic personal information that it obtained on or after as a result of a consumer transaction if it fails to give the required notice. As a person's only remedy, the person may bring an individual action, not a class action, and a commercial entity that violates the chapter is liable for $500 for each time it fails to provide the notice and court costs, in an action brought within one year from the day of the consumer transaction. The chapter was enacted by Chapter 97, 2003 General Session, and was last amended by Chapter 542, 2025 General Session.
When LexLint raises it
When your app profile says your app crawls the web, trains models or deploys a chatbot.