Utah Consumer Privacy Act
Utah privacy law (UCPA): enforcement
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The Division of Consumer Protection takes and investigates complaints and refers matters to the Attorney General, who has exclusive enforcement authority. The Attorney General must give 30 days' written notice and a chance to cure; the cure period does not expire. For uncured or repeated violations the Attorney General may recover actual damages and up to $7,500 per violation; there is no private right of action.
Key points
Division of Consumer Protection receives and investigates complaints and refers matters.
Section: § 13-61-401
Attorney General has exclusive authority.
Section: § 13-61-402(1)
30-day notice and cure with a written statement; no sunset.
Section: § 13-61-402(3)(a), (b)
Actual damages to the consumer and up to $7,500 per violation.
Section: § 13-61-402(3)(d)
Liability shared among controllers and processors by comparative fault.
Section: § 13-61-402(5)
No private right of action.
Section: § 13-61-305
Sources
Compare enforcement across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Utah statute
Reference material, not legal advice.