Utah Consumer Privacy Act (Utah Code 13-61-101 et seq.)
Below is what the official text of Utah Consumer Privacy Act (Utah Code 13-61-101 et seq.) states about whom it covers, when it applies to a business and since when. Where the pages we read do not say, the row says "not stated".
The wording shown is taken from the official page named in each row. The duties of a business and the contents of a privacy notice are in the paid checklist.
Typical situations, run through the same conditions as the check
- A for-profit US business with 150,000 people in Utah and $30 million revenue: Applies, or may apply: conditions to check.
- The same business with 8,000 people in Utah: Not triggered by these answers.
- A US business with no users in Utah: Not triggered by these answers.
Judged on 2026-10-06. Our law data was last verified on 2026-10-06; a law that took effect after that date is not in it. These situations leave other answers blank or neutral: use the check for your own.
What the official text states
| Question | What the official text states | Source |
|---|---|---|
| What it covers | Protects Utah consumers' personal data and binds controllers and processors that do business in Utah or target Utah residents and meet the revenue and volume tests.Official wordingThis chapter applies to any controller or processor who: | le.utah.gov read 2026-10-06 |
| When it applies to a business | Applies to a controller or processor that conducts business in Utah or produces a product or service targeted to Utah residents, has annual revenue of $25,000,000 or more, and either controls or processes personal data of 100,000 or more consumers in a calendar year, or derives over 50% of gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers. Conditions to check: Exempt (13-61-102(2)): governmental entities and their contractors, tribes, institutions of higher education, nonprofit corporations, HIPAA covered entities and business associates, financial institutions governed by GLBA and their affiliates, air carriers, and many data categories (PHI, FERPA, FCRA, employment-context data, purely personal or household processing). 'Conducts business in the state' and 'targeted' are not defined in the quote; we test whether you have users there, which is only a proxy. From 1/1/2027 a motor vehicle manufacturer that manufactures vehicles sold or leased in Utah and collects personal data through a vehicle data collection system is also covered (per the 1/1/2027 version in the compilation we read). Official wording(1) This chapter applies to any controller or processor who: (a) (i) conducts business in the state; or (ii) produces a product or service that is targeted to consumers who are residents of the state; (b) has annual revenue of $25,000,000 or more; and (c) satisfies one or more of the following thresholds: (i) during a calendar year, controls or processes personal data of 100,000 or more consumers; | le.utah.gov read 2026-10-06 |
| In force from | 2023-12-31 2022 S.B. 227 section 17: 'This bill takes effect on December 31, 2023.' Official wordingThis bill takes effect on December 31, 2023. | le.utah.gov read 2026-10-06 |
| Privacy notice | Included in the paid checklist. See the checklist | — |
| Consent and opt-out | Included in the paid checklist. See the checklist | — |
| Rights of individuals | Included in the paid checklist. See the checklist | — |
| Data protection officer | Not stated on the official pages we read. the text read does not say whether a data protection officer or privacy officer must be appointed | — |
| Breach notification | Not stated on the official pages we read. separate breach-notification statute not read | — |
| What the privacy notice must contain | Included in the paid checklist. See the checklist | — |
What we do not cover
These areas are outside this site, so nothing on this page says anything about them:
- Privacy laws for particular sectors (for example health care, banking and credit, education)
- Rules specific to children's online privacy
- Cookie and electronic-communications rules (including consent for cookies and marketing messages)
- Employee, job applicant and contractor data
- Rules on sending personal data to other countries
- US state data-breach notification laws (a separate set of state laws)
- US state privacy laws that are not yet in force, and state laws on particular topics (for example biometric or health data)
- Privacy laws of countries that are not listed here
- Planned changes to the laws listed here