---
title: "Utah privacy law (UCPA): enforcement"
canonical: "https://dposchool.com/state-privacy-laws/state/utah/enforcement"
source: "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Utah Consumer Privacy Act

# Utah privacy law (UCPA): enforcement

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Division of Consumer Protection takes and investigates complaints and refers matters to the Attorney General, who has exclusive enforcement authority. The Attorney General must give 30 days' written notice and a chance to cure; the cure period does not expire. For uncured or repeated violations the Attorney General may recover actual damages and up to $7,500 per violation; there is no private right of action.

## Key points

1. Division of Consumer Protection receives and investigates complaints and refers matters.

   Section: [§ 13-61-401](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

2. Attorney General has exclusive authority.

   Section: [§ 13-61-402(1)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

3. 30-day notice and cure with a written statement; no sunset.

   Section: [§ 13-61-402(3)(a), (b)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

4. Actual damages to the consumer and up to $7,500 per violation.

   Section: [§ 13-61-402(3)(d)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

5. Liability shared among controllers and processors by comparative fault.

   Section: [§ 13-61-402(5)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

6. No private right of action.

   Section: [§ 13-61-305](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

## Sources

- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S401\_2022050420231231.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S401_2022050420231231.html)
- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S402\_2022050420231231.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S402_2022050420231231.html)
- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S305\_2022050420231231.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S305_2022050420231231.html)

[Compare enforcement across all states](https://dposchool.com/state-privacy-laws/topic/enforcement)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Utah statute](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

Reference material, not legal advice.

## Other topics for Utah

- [Applicability](https://dposchool.com/state-privacy-laws/state/utah/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/utah/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/utah/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/utah/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/utah/processors)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Utah](https://dposchool.com/state-privacy-laws/state/utah) / Enforcement

Previous: [Processors](https://dposchool.com/state-privacy-laws/state/utah/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents