---
title: "Utah privacy law (UCPA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/utah/applicability"
source: "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Utah Consumer Privacy Act

# Utah privacy law (UCPA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The act applies to controllers and processors that do business in Utah or target Utah residents, have annual revenue of $25 million or more, and either process personal data of 100,000 or more consumers in a calendar year or derive over 50% of gross revenue from selling personal data while processing data of 25,000 or more consumers. Nonprofit corporations, higher education, HIPAA covered entities and business associates, and financial institutions governed by the GLBA are exempt as entities. From 1 January 2027 motor vehicle manufacturers that collect personal data through vehicle systems are covered regardless of these tests.

## Key points

1. Both tests must be met: annual revenue of $25,000,000 or more, and a volume test.

   Section: [§ 13-61-102(1)(b), (c)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

2. Volume test: 100,000 or more consumers in a calendar year, or over 50% of gross revenue from sale plus 25,000 or more consumers.

   Section: [§ 13-61-102(1)(c)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

3. Entity exemptions: government and its contractors, tribes, higher education, nonprofit corporations, HIPAA covered entities and business associates, air carriers.

   Section: [§ 13-61-102(2)(a) to (f), (q)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

4. GLBA: financial institutions and affiliates governed by Title V are exempt as entities, as is data handled under it.

   Section: [§ 13-61-102(2)(k)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

5. Employment data and individuals acting in an employment or commercial context are outside the act.

   Section: [§ 13-61-101(10)(b); § 13-61-102(2)(o)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

6. From 1 January 2027, motor vehicle manufacturers selling or leasing vehicles in Utah that collect personal data through a vehicle data collection system are covered.

   Section: [§ 13-61-102(1)(b) (eff. 1 January 2027)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

## Sources

- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S102\_2024050120240501.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S102_2024050120240501.html)
- [Utah Code § 13-61-102 (current and 1 January 2027 versions)](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S102_2026050620270101.html)
- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S101\_2026050620260506.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S101_2026050620260506.html)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Utah statute](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

Reference material, not legal advice.

## Other topics for Utah

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/utah/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/utah/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/utah/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/utah/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/utah/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Utah](https://dposchool.com/state-privacy-laws/state/utah) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/utah/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents