DPO SchoolDPO School

Utah Consumer Privacy Act

Utah privacy law (UCPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may confirm and access their data, delete data they provided, obtain a portable copy, and opt out of targeted advertising and sale; since 1 July 2026 they may also ask for inaccurate data to be corrected. There is no right to opt out of profiling and no statutory appeal process. Controllers act within 45 days, extendable once by 45 days, and the first request in 12 months is free.

Key points

  1. Confirm and access personal data.

    Section: § 13-61-201(1)

  2. Delete only data the consumer provided to the controller.

    Section: § 13-61-201(2)

  3. Portable copy of data the consumer provided, processed by automated means.

    Section: § 13-61-201(3)

  4. Correction of inaccuracies, from 1 July 2026.

    Section: § 13-61-201(4)

  5. Opt out of targeted advertising and sale; no profiling opt-out.

    Section: § 13-61-201(5)

  6. Act and inform within 45 days; one 45-day extension with notice and reasons.

    Section: § 13-61-203(2)

  7. No fee for the first request in 12 months; fee or refusal for excessive, repetitive or harassing requests.

    Section: § 13-61-203(4)

  8. No appeal process is required; the controller must only give reasons for not acting within 45 days.

    Section: § 13-61-203(3)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Utah statute

Reference material, not legal advice.