What Is the Utah Consumer Privacy Act?
UCPA has higher thresholds than peer state laws: $25M+ revenue AND processing 100,000+ consumers' data annually (or 25,000+ while selling data). Consumers have rights to confirm processing, delete, access, and opt out of targeted advertising and sale. No right to correct. Notably lacks a profiling opt-out. Enforcement is exclusively by the AG; no private right of action. 30-day cure period applies.
At a glance
- Full name
- Utah Consumer Privacy Act
- Short code
- UCPA
- Effective date
- December 31, 2023
- Response deadline
- 45 days
- Cure period
- 30 days
- Private right of action
- No
- Enforcement
- Utah Attorney General + Division of Consumer Protection
- Maximum penalty
- Up to $7,500 per violation
- Statutory citation
- Utah Code § 13-61-101 et seq.
Who UCPA applies to
A business is covered if it meets the applicability thresholds set out in Utah Code § 13-61-101 et seq.. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Annual revenue of $25 million or more, AND either: (a) controls or processes personal data of 100,000+ Utah consumers in a calendar year, OR (b) derives over 50% of gross revenue from the sale of personal data AND controls or processes personal data of 25,000+ Utah consumers
Consumer rights under UCPA
Deletion, access, opt-out of sale and targeted ads
No right to correct (unique gap)
No private right of action
Notable features (vs. CCPA)
UCPA is generally considered the most business-friendly comprehensive state privacy law. It omits the right to correct, does not require data protection assessments, has no universal opt-out mechanism requirement, and has no provision for authorized agents. Utah's $25M revenue floor combined with its threshold structure means the law covers noticeably fewer businesses than CCPA or VCDPA.
Enforcement & penalties
Enforcing agency: Utah Attorney General + Division of Consumer Protection
Maximum penalty: Up to $7,500 per violation
Cure period: UCPA maintains a permanent 30-day cure period with no sunset — the most business-favorable among the post-CCPA laws.
Private right of action: UCPA has no private right of action. Enforcement flows through the Utah Division of Consumer Protection, which refers substantiated violations to the Utah Attorney General.
Where to file a complaint: Utah Attorney General
How to exercise your UCPA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 300+ known brokers and applies UCPA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a Utah resident (e.g., ZIP code, email associated with your record).
- 3
Under UCPA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the Utah Attorney General at https://attorneygeneral.utah.gov/divisions-sections/consumer-protection.
Use your rights
UCPA-compliant deletion emails, $5 one-time
OfflistMe drafts UCPA-compliant deletion emails for 300+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $5 →FAQ
Why doesn't Utah have a correction right?+
UCPA was drafted with business interests heavily represented and excluded several consumer rights common to peer laws. Correction is one. In practice, most brokers honor correction requests anyway under CCPA infrastructure.
Official sources & citations
Compare with sibling state laws
UCPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date — useful when tracking how this law influenced or was influenced by neighbouring legislation: