Law / United States / 
Utah
Motor Vehicle Data Privacy
Utah Code 13-61-501 to 13-61-504
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- The in-vehicle privacy controls duty applies to a motor vehicle with a model year 2030 or later.
- As a motor vehicle manufacturer selling or leasing vehicles in Utah, once in effect, provide in-vehicle privacy controls letting a consumer view what personal data categories the vehicle collects and shares, opt out of sale or targeted-advertising processing, and delete readily accessible data stored locally on the vehicle.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- To whom, and by what evidence, must a motor vehicle manufacturer "demonstrate" under section 13-61-502(2) that a model "is not technologically capable" of providing the in-vehicle privacy controls?
What it makes you log
Logging duty
For a vehicle of model year 2030 or later the manufacturer must provide in-vehicle controls to view the categories of personal data collected and of third parties it is shared with, opt out of sale or targeted advertising, and delete readily accessible data, and must delete all personal data within five business days of a court order or a protective-order request (13-61-502). A manufacturer excused for a model it demonstrates is not technologically capable is making a showing to be excused and not keeping a record. Section 13-61-503 sets data minimization limits and section 13-61-504 has the Motor Vehicle Division post information on its website. The part names no record to be kept, no retention period, no audit and no territorial clause, so no hook is taken. It takes effect on .
- Kind
- None
- As of
What this law does
Enacted as a new Part 5 of UCPA by the 2026 General Session (Chapter 193), requires a motor vehicle manufacturer selling or leasing vehicles in Utah to provide, for model year 2030 and later vehicles, in-vehicle privacy controls letting a consumer view the categories of personal data the vehicle's data collection system collects and shares, opt out of sale or targeted-advertising processing, and delete readily accessible data, defined conjunctively as data the consumer directly input through the in-vehicle interface and that is stored locally on the vehicle.
Exempts data processed solely for vehicle safety, operation, or legal compliance, and data collected only for internal product improvement.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .