Utah Privacy Law (UCPA): Compliance Guide
The Utah Consumer Privacy Act, effective December 31, 2023, is the most business-friendly comprehensive state privacy law in the country. Its double gate — annual revenue above $25 million plus a consumer-volume prong — exempts most small and mid-size businesses outright, it skips the sensitive-data opt-in that Virginia and Colorado require, and only the Attorney General can enforce it. Covered businesses still owe Utah consumers a real opt-out for targeted advertising and data sales.
- Effective
- December 31, 2023
- GPC / universal opt-out
- Not required
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · Utah Consumer Privacy Act (UCPA)
Applicability
Who must comply with the UCPA
The Utah Consumer Privacy Act applies to businesses that meet the following criteria:
- Conducts business in Utah or targets products or services to Utah residents, and:
- Has annual revenue above $25 million, and:
- Controls or processes the personal data of 100,000 or more Utah consumers, or
- Derives 50% or more of revenue from the sale of personal data and controls or processes the data of 25,000 or more Utah consumers
Consumer rights
What Utah consumers can demand
- Right to access personal data
- Right to delete personal data
- Right to data portability
- Right to opt out of targeted advertising and the sale of personal data
Opt-out mechanics
Utah opt-out & GPC requirements
Like every US state privacy law, the UCPA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for Utah is “Your Privacy Choices”.
Global Privacy Control: Not required
The UCPA does not require honoring universal opt-out signals such as Global Privacy Control. The opt-out link remains the required mechanism.
Enforcement
UCPA penalties & enforcement
- Enforced exclusively by the Utah Attorney General — no private right of action
- Violations subject to state consumer protection law penalties
Cure period: Our reference lists no specific cure period for Utah; enforcement is Attorney-General only.
State quirks
What makes Utah different
Utah's structure is the outlier: businesses must clear both a $25 million revenue gate and a volume prong (100,000 consumers, or 25,000 with 50% of revenue from data sales), where most states treat revenue as an alternative path to coverage. There is no private right of action, no sensitive-data opt-in, and no GPC mandate. The 2026 amendments did strengthen correction rights — a modest tightening of an otherwise permissive framework.
No private right of action
Only the Utah Attorney General can enforce the UCPA — consumers cannot sue.
No sensitive-data opt-in
Unlike Virginia and Colorado, Utah does not require opt-in consent for sensitive data — the most business-friendly stance of any state on this point.
Correction rights enhanced in 2026
2026 amendments strengthened consumers' ability to correct inaccurate personal data.
Automation
How ConsentKit handles Utah
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so Utah visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- Utah visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Utah does not legally require honoring Global Privacy Control. ConsentKit applies automatic GPC honoring in the 12 states that mandate it; in Utah the opt-out link remains the visitor's control.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a Utah visitor makes a choice.
Utah visitors get the standard “Your Privacy Choices” opt-out link; ConsentKit records each choice with timestamp and jurisdiction metadata for your records.
FAQ
Utah UCPA FAQ
Does the UCPA apply to my business?
Only if you clear two gates at once: annual revenue above $25 million and a volume prong — 100,000 or more Utah consumers, or 25,000 or more with 50% or more of revenue from data sales. The double requirement exempts most small and mid-size businesses outright.
Does Utah require opt-in consent for sensitive data?
No. Unlike Virginia and Colorado, Utah lets sensitive data be processed without a separate opt-in — the most business-friendly stance of any state on this point.
Is Global Privacy Control required in Utah?
No. The UCPA has no universal opt-out signal mandate. The “Your Privacy Choices” opt-out link is the required mechanism for targeted advertising and sale opt-outs.
Who enforces the UCPA?
Only the Utah Attorney General — there is no private right of action, so consumers cannot sue. Violations are handled under state consumer protection law penalties.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the UCPA.
Comply with Utah's UCPA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.