Utah Consumer Privacy Act

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 31 December 2023.

A comprehensive regime rule binding private bodies.

As of 23 August 2026.

What it requires

Provide Utah consumers a reasonably accessible, clear privacy notice describing the categories of personal data you process, the purposes, how consumers may exercise their rights, and any third parties you share data with, if you meet UCPA's 25 million dollar revenue and consumer-volume thresholds.
Let Utah consumers opt out of the sale of their personal data and of processing for targeted advertising.
Respond to a Utah consumer's request to access, delete, correct, or receive a portable copy of their personal data within 45 days, or notify the consumer of a single 45-day extension and the reason for it, and do not charge a fee for a consumer's first request in a 12-month period.
Establish reasonable administrative, technical, and physical security practices for personal data, and enter into a written contract with any processor before it processes personal data on your behalf.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Utah's omnibus consumer-data-privacy statute, enacted as S.B. 227 (Chapter 462, 2022 General Session). Applies only to a controller or processor doing business in or targeting Utah consumers with 25 million dollars or more in annual revenue and either 100,000 or more consumers processed a year, or 25,000 or more consumers processed while deriving over half of revenue from data sales.

Exempts government entities and their contractors, tribes, higher-education institutions, nonprofits, Health Insurance Portability and Accountability Act (HIPAA)-covered entities, and several other sectoral categories. Gives consumers access, deletion, correction, portability, and opt-out rights exercisable against the controller within 45 days, extendable once by 45 more days. The Attorney General has exclusive enforcement authority with a mandatory 30-day cure period, and the Act bars any private right of action.

When LexLint raises it

automated_outreach
crawls_web
deploys_chatbot
processes_biometrics
processes_voice
trains_models

Read the law

official Utah Code text, Utah State Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app