---
title: "Utah privacy law (UCPA): consumer rights"
canonical: "https://dposchool.com/state-privacy-laws/state/utah/consumer-rights"
source: "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Utah Consumer Privacy Act

# Utah privacy law (UCPA): consumer rights

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Consumers may confirm and access their data, delete data they provided, obtain a portable copy, and opt out of targeted advertising and sale; since 1 July 2026 they may also ask for inaccurate data to be corrected. There is no right to opt out of profiling and no statutory appeal process. Controllers act within 45 days, extendable once by 45 days, and the first request in 12 months is free.

## Key points

1. Confirm and access personal data.

   Section: [§ 13-61-201(1)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

2. Delete only data the consumer provided to the controller.

   Section: [§ 13-61-201(2)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

3. Portable copy of data the consumer provided, processed by automated means.

   Section: [§ 13-61-201(3)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

4. Correction of inaccuracies, from 1 July 2026.

   Section: [§ 13-61-201(4)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

5. Opt out of targeted advertising and sale; no profiling opt-out.

   Section: [§ 13-61-201(5)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

6. Act and inform within 45 days; one 45-day extension with notice and reasons.

   Section: [§ 13-61-203(2)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

7. No fee for the first request in 12 months; fee or refusal for excessive, repetitive or harassing requests.

   Section: [§ 13-61-203(4)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

8. No appeal process is required; the controller must only give reasons for not acting within 45 days.

   Section: [§ 13-61-203(3)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

## Sources

- [Utah Code § 13-61-201 (version effective 1 July 2026)](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html)
- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S203\_2022050420231231.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S203_2022050420231231.html)

[Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access)
- [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion)
- [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Utah statute](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

Reference material, not legal advice.

## Other topics for Utah

- [Applicability](https://dposchool.com/state-privacy-laws/state/utah/applicability)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/utah/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/utah/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/utah/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/utah/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Utah](https://dposchool.com/state-privacy-laws/state/utah) / Consumer rights

Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/utah/applicability)

Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/utah/sensitive-data)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents