What Is the Utah Consumer Privacy Act?
UCPA has a $25M+ revenue threshold plus processing thresholds described in the statute. Consumers have rights to confirm processing, delete, access, and opt out of targeted advertising and sale; effective July 1, 2026, they may also request correction of inaccuracies. The statute does not include the same profiling opt-out provisions found in some peer laws. Enforcement is exclusively by the AG; no private right of action. The current enforcement provision includes a cure rule subject to its notice and exception requirements.
At a glance
- Full name
- Utah Consumer Privacy Act
- Short code
- UCPA
- Effective date
- December 31, 2023
- Response reference
- 45 days in this snapshot
- Cure period
- 30 days in this snapshot
- Private right of action
- No
- Enforcement
- Utah Attorney General + Division of Consumer Protection
- Penalty reference
- Up to $7,500 per violation
- Statutory citation
- Utah Code § 13-61-101 et seq.
Who UCPA applies to
A business is covered if it meets the applicability thresholds set out in Utah Code § 13-61-101 et seq.. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Annual revenue of $25 million or more, AND either: (a) controls or processes personal data of 100,000+ Utah consumers in a calendar year, OR (b) derives over 50% of gross revenue from the sale of personal data AND controls or processes personal data of 25,000+ Utah consumers
Consumer rights under UCPA
Deletion, access, opt-out of sale and targeted ads
Right to request correction of inaccuracies (effective July 1, 2026)
No private right of action
Notable features (vs. CCPA)
UCPA has a comparatively limited rights and obligations structure: effective July 1, 2026, Section 13-61-201 also gives consumers a right to request correction of inaccuracies. The law does not require data protection assessments, has no universal opt-out mechanism requirement, and has no general provision for authorized agents. Utah's $25M revenue floor combined with its threshold structure means its coverage differs from CCPA and VCDPA.
Enforcement and penalty reference
Enforcing agency: Utah Attorney General + Division of Consumer Protection
Penalty reference: Up to $7,500 per violation
Cure period: The current Utah enforcement provision gives a controller or processor 30 days to cure after the Attorney General provides the required notice, subject to the statute and its exceptions. Recheck the current code before relying on that period.
Private right of action: UCPA has no private right of action. Enforcement flows through the Utah Division of Consumer Protection, which refers substantiated violations to the Utah Attorney General.
Where to file a complaint: Utah Attorney General
How to exercise your UCPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Utah residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Utah Attorney General complaint route at https://attorneygeneral.utah.gov/divisions-sections/consumer-protection. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a UCPA privacy request, $9 one-time
FAQ
Can Utah residents request correction of inaccurate personal data?+
Yes. Section 13-61-201 includes a right to request correction of inaccuracies effective July 1, 2026. The request remains subject to the UCPA's scope, authentication, exceptions, and the controller's applicable process.
Official sources & citations
Compare with sibling state laws
UCPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: