Utah Consumer Privacy Act, publicly-available-information exemption and biometric data

Utah Code Ann. § 13-61-101(6), (29), (32)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 31 December 2023.

A personal data rule binding private bodies.

As of 29 August 2026.

What it requires

Do not treat personal data scraped from a data broker, aggregator, or re-hosted directory as publicly available under the Utah Consumer Privacy Act; the exemption requires a government record or the consumer's own lawful disclosure.
Do not treat a bare scraped photograph, video, or audio recording as biometric data on its own; it becomes biometric, and then sensitive, data once you process it to identify a specific individual.
There is no private right of action under this Act; only the Utah Attorney General enforces it, with a 30-day cure period.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 13-61-101(29) defines publicly available information with three prongs: information a person lawfully obtains from a governmental record, information a consumer or widely distributed media has lawfully made available to the general public, or information obtained from a person the consumer disclosed it to without restricting the audience, a near match to California's CCPA test and broader than Colorado's two-prong version.

Personal data scraped from a source that is neither a government record nor something the consumer themselves put out, such as a data broker or re-hosted directory, is not publicly available under this Act.

Biometric data under Section 13-61-101(6) means data from automatic measurement of an individual's unique biological characteristics used to identify a specific individual, and expressly excludes a physical or digital photograph, a video or audio recording, and data generated from either, the same structural exclusion Colorado uses.

Processing genetic or biometric data for the purpose of identifying a specific individual is sensitive data under Section 13-61-101(32)(a)(ii), triggering opt-in consent. Enforcement is Attorney-General-exclusive with a 30-day cure period and no private right of action; the Act took effect December 31, 2023.

When LexLint raises it

crawls_web
trains_models
processes_biometrics

Read the law

official text, Utah State Legislature (le.utah.gov)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app