Utah Consumer Privacy Act
Utah privacy law (UCPA): applicability
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The act applies to controllers and processors that do business in Utah or target Utah residents, have annual revenue of $25 million or more, and either process personal data of 100,000 or more consumers in a calendar year or derive over 50% of gross revenue from selling personal data while processing data of 25,000 or more consumers. Nonprofit corporations, higher education, HIPAA covered entities and business associates, and financial institutions governed by the GLBA are exempt as entities. From 1 January 2027 motor vehicle manufacturers that collect personal data through vehicle systems are covered regardless of these tests.
Key points
Both tests must be met: annual revenue of $25,000,000 or more, and a volume test.
Section: § 13-61-102(1)(b), (c)
Volume test: 100,000 or more consumers in a calendar year, or over 50% of gross revenue from sale plus 25,000 or more consumers.
Section: § 13-61-102(1)(c)
Entity exemptions: government and its contractors, tribes, higher education, nonprofit corporations, HIPAA covered entities and business associates, air carriers.
Section: § 13-61-102(2)(a) to (f), (q)
GLBA: financial institutions and affiliates governed by Title V are exempt as entities, as is data handled under it.
Section: § 13-61-102(2)(k)
Employment data and individuals acting in an employment or commercial context are outside the act.
From 1 January 2027, motor vehicle manufacturers selling or leasing vehicles in Utah that collect personal data through a vehicle data collection system are covered.
Sources
Compare applicability across all states
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Utah statute
Reference material, not legal advice.