---
title: "Utah privacy law (UCPA): sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/utah/sensitive-data"
source: "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Utah Consumer Privacy Act

# Utah privacy law (UCPA): sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, medical history and health information, identifying genetic or biometric data, and specific geolocation within 1,750 feet. Utah uses an opt-out model: before processing sensitive data, the controller must give clear notice and an opportunity to opt out. A known child's data (under 13) must be processed under COPPA.

## Key points

1. Sensitive data definition, with carve-outs for video communication services and licensed health care providers.

   Section: [§ 13-61-101(32)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

2. Specific geolocation means accuracy within 1,750 feet.

   Section: [§ 13-61-101(33)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

3. Clear notice and an opportunity to opt out before processing sensitive data (not opt-in consent).

   Section: [§ 13-61-302(3)(a)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

4. Known child data processed in line with COPPA; a child is under 13.

   Section: [§ 13-61-302(3)(b); § 13-61-101(8)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

5. Parents or legal guardians exercise rights for a known child.

   Section: [§ 13-61-202(2)](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

## Sources

- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S101\_2026050620260506.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S101_2026050620260506.html)
- [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S302\_2022050420231231.html](https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S302_2022050420231231.html)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Utah statute](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html)

Reference material, not legal advice.

## Other topics for Utah

- [Applicability](https://dposchool.com/state-privacy-laws/state/utah/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/utah/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/utah/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/utah/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/utah/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Utah](https://dposchool.com/state-privacy-laws/state/utah) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/utah/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/utah/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents