DPO SchoolDPO School

Utah Consumer Privacy Act

Utah privacy law (UCPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must publish a reasonably accessible and clear privacy notice covering categories of data, purposes, how to exercise rights, and data and recipients shared with, and disclose sale or targeted advertising with the opt-out method. They must keep reasonable security and may not discriminate for exercising rights. The text contains no data protection assessment duty, no duty to honor universal opt-out signals and no express data minimisation duty.

Key points

  1. Privacy notice contents.

    Section: § 13-61-302(1)(a)

  2. Clear and conspicuous disclosure of how to opt out of sale and targeted advertising.

    Section: § 13-61-302(1)(b)

  3. Reasonable administrative, technical and physical security practices.

    Section: § 13-61-302(2)

  4. No discrimination for exercising rights; loyalty programs allowed.

    Section: § 13-61-302(4)

  5. Contract terms waiving or limiting rights are void.

    Section: § 13-61-302(6)

  6. No data protection assessments and no universal opt-out signal duty in the chapter.

    Section: §§ 13-61-301 to 13-61-305

  7. From 1 January 2027, vehicle makers must offer in-vehicle privacy controls for model year 2030 or later.

    Section: § 13-61-502 (eff. 1 January 2027)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Utah statute

Reference material, not legal advice.