Comprehensive state privacy law
Utah privacy law
Utah Consumer Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Utah Code §§ 13-61-101 to 13-61-404 (Part 5, §§ 13-61-501 to 13-61-504, from 1 January 2027)
- Enacted
- March 24, 2022. Laws of Utah 2022, ch. 462 (S.B. 227)
- In force
- December 31, 2023
- Effective dates
- December 31, 2023: main provisions
- July 1, 2026: right to correct inaccurate personal data (Laws of Utah 2025, ch. 468, H.B. 418)
- January 1, 2027: motor vehicle manufacturers covered and Part 5 (motor vehicle data privacy) in force (Laws of Utah 2026, ch. 193, H.B. 357); in-vehicle privacy controls required for model year 2030 or later
- Enforcer
- Attorney General (exclusive), on referral from the Division of Consumer Protection
- Private right of action
- No. A violation is not a basis for a private right of action under the chapter or any other law (§ 13-61-305).
- Cure period
- 30 days. The Attorney General must give 30 days' written notice before suing. No action may be brought if the controller or processor cures within 30 days and states in writing that the violation is cured and will not recur. There is no end date. (§ 13-61-402(3))
- Rulemaking
- No. The chapter grants no rulemaking power. The Division of Consumer Protection receives and investigates complaints and refers matters to the Attorney General (§ 13-61-401).
Amendments
- Laws of Utah 2024, chs. 186 and 381 (in force May 1, 2024). Amended the definitions (§ 13-61-101) and applicability (§ 13-61-102). The bills and the changes were not separately verified.
- Laws of Utah 2025, ch. 468 (H.B. 418, Data Sharing Amendments) (in force July 1, 2026). Added a right to request correction of inaccurate personal data; the same act created a separate social media data portability and interoperability chapter.
- Laws of Utah 2026, ch. 95 (in force May 6, 2026). Amended the definitions in § 13-61-101 (appears to be a conforming change made by S.B. 38, Consumer Protection Modifications, which lists § 13-61-101 with effect 6 May 2026).
- Laws of Utah 2026, ch. 193 (H.B. 357, Amendments to Motor Vehicle Data Privacy) (in force January 1, 2027). Enacted, not yet in force. Applies the act to motor vehicle manufacturers that sell or lease vehicles in Utah and collect personal data through a vehicle data collection system, regardless of thresholds; requires in-vehicle privacy controls (view data and recipients, opt out of sale and targeted advertising, delete readily accessible data) for model year 2030 or later; exempts certain safety and operational data from § 13-61-302.
Topics
- ApplicabilityThe act applies to controllers and processors that do business in Utah or target Utah residents, have annual revenue of $25 million or more, and either process personal data of 100,000 or more consumers in a calendar year or derive over 50% of gross revenue from selling personal data while processing data of 25,000 or more consumers. Nonprofit corporations, higher education, HIPAA covered entities and business associates, and financial institutions governed by the GLBA are exempt as entities. From 1 January 2027 motor vehicle manufacturers that collect personal data through vehicle systems are covered regardless of these tests.
- Consumer rightsConsumers may confirm and access their data, delete data they provided, obtain a portable copy, and opt out of targeted advertising and sale; since 1 July 2026 they may also ask for inaccurate data to be corrected. There is no right to opt out of profiling and no statutory appeal process. Controllers act within 45 days, extendable once by 45 days, and the first request in 12 months is free.
- Sensitive dataSensitive data covers racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, medical history and health information, identifying genetic or biometric data, and specific geolocation within 1,750 feet. Utah uses an opt-out model: before processing sensitive data, the controller must give clear notice and an opportunity to opt out. A known child's data (under 13) must be processed under COPPA.
- Controller dutiesControllers must publish a reasonably accessible and clear privacy notice covering categories of data, purposes, how to exercise rights, and data and recipients shared with, and disclose sale or targeted advertising with the opt-out method. They must keep reasonable security and may not discriminate for exercising rights. The text contains no data protection assessment duty, no duty to honor universal opt-out signals and no express data minimisation duty.
- ProcessorsProcessors must follow the controller's instructions and help it meet its duties, including security and breach notice. Before processing, the parties must sign a contract setting out instructions, nature and purpose, data types, duration and rights and obligations. The contract must require confidentiality and written flow-down to subcontractors; Utah does not require deletion or return, audit or assessment terms.
- EnforcementThe Division of Consumer Protection takes and investigates complaints and refers matters to the Attorney General, who has exclusive enforcement authority. The Attorney General must give 30 days' written notice and a chance to cure; the cure period does not expire. For uncured or repeated violations the Attorney General may recover actual damages and up to $7,500 per violation; there is no private right of action.
Sources
- Utah Code Title 13, Chapter 61 (chapter, part and section pages, current and future versions)
- Utah Code § 13-61-201 (version effective 1 July 2026)
- Utah Code § 13-61-102 (current and 1 January 2027 versions)
- S.B. 227 (2022) status page
- H.B. 418 (2025) enrolled copy
- H.B. 357 (2026) enrolled copy
- S.B. 38 (2026) enrolled copy
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Utah statute
Reference material, not legal advice.