DPO SchoolDPO School

Utah Consumer Privacy Act

Utah privacy law (UCPA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, medical history and health information, identifying genetic or biometric data, and specific geolocation within 1,750 feet. Utah uses an opt-out model: before processing sensitive data, the controller must give clear notice and an opportunity to opt out. A known child's data (under 13) must be processed under COPPA.

Key points

  1. Sensitive data definition, with carve-outs for video communication services and licensed health care providers.

    Section: § 13-61-101(32)

  2. Specific geolocation means accuracy within 1,750 feet.

    Section: § 13-61-101(33)

  3. Clear notice and an opportunity to opt out before processing sensitive data (not opt-in consent).

    Section: § 13-61-302(3)(a)

  4. Known child data processed in line with COPPA; a child is under 13.

    Section: § 13-61-302(3)(b); § 13-61-101(8)

  5. Parents or legal guardians exercise rights for a known child.

    Section: § 13-61-202(2)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Utah statute

Reference material, not legal advice.