---
title: "Utah privacy law (UCPA): controller duties"
canonical: "https://dposchool.com/state-privacy-laws/state/utah/controller-duties"
source: "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Utah Consumer Privacy Act

# Utah privacy law (UCPA): controller duties

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers must publish a reasonably accessible and clear privacy notice covering categories of data, purposes, how to exercise rights, and data and recipients shared with, and disclose sale or targeted advertising with the opt-out method. They must keep reasonable security and may not discriminate for exercising rights. The text contains no data protection assessment duty, no duty to honor universal opt-out signals and no express data minimisation duty.

## Key points

1. Privacy notice contents.

   Section: [§ 13-61-302(1)(a)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

2. Clear and conspicuous disclosure of how to opt out of sale and targeted advertising.

   Section: [§ 13-61-302(1)(b)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

3. Reasonable administrative, technical and physical security practices.

   Section: [§ 13-61-302(2)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

4. No discrimination for exercising rights; loyalty programs allowed.

   Section: [§ 13-61-302(4)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

5. Contract terms waiving or limiting rights are void.

   Section: [§ 13-61-302(6)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

6. No data protection assessments and no universal opt-out signal duty in the chapter.

   Section: [§§ 13-61-301 to 13-61-305](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

7. From 1 January 2027, vehicle makers must offer in-vehicle privacy controls for model year 2030 or later.

   Section: [§ 13-61-502 (eff. 1 January 2027)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

## Sources

- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S302\_2022050420231231.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S302_2022050420231231.html)
- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S502\_2026050620270101.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S502_2026050620270101.html)

[Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Utah statute](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

Reference material, not legal advice.

## Other topics for Utah

- [Applicability](https://dposchool.com/state-privacy-laws/state/utah/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/utah/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/utah/sensitive-data)
- [Processors](https://dposchool.com/state-privacy-laws/state/utah/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/utah/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Utah](https://dposchool.com/state-privacy-laws/state/utah) / Controller duties

Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/utah/sensitive-data)

Next: [Processors](https://dposchool.com/state-privacy-laws/state/utah/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents