US — UtahUtah Consumer Privacy Act (UCPA): Complete Compliance Guide
Overview
The Utah Consumer Privacy Act (UCPA), enacted in 2022 and effective as of December 31, 2023, is a comprehensive data privacy law that grants consumers rights over their personal data and imposes responsibilities on businesses to safeguard and responsibly process that data. The UCPA aims to promote transparency in data usage, allowing consumers to access, delete, and opt out of the sale or processing of their data for targeted advertising. In 2025, the Utah legislature passed H.B. 418 (the Data Sharing Amendments), which takes effect on July 1, 2026. This amendment expands the UCPA by introducing the consumer's right to correct inaccuracies and mandating new data interoperability standards for social media companies.
Does the Utah Consumer Privacy Act Apply to Your Business?
The UCPA applies to businesses that meet at least one of its thresholds. Use this tool to check whether it applies to yours.
Utah Consumer Privacy Act Scope Checker
Answer three questions to determine whether the UCPA applies to your organization.
Note: the UCPA applies based on Utah residents' data, regardless of where your business is located.
Utah Consumer Rights Under the UCPA
The UCPA grants six individual privacy rights to Utah residents. Businesses must respond to authenticated requests within 45 days. A 45-day extension is available with written notice to the consumer.
Delete personal information we have collected about you
45-day response windowOpt-out of targeted advertisements so that you no longer receive personalized ads
45-day response windowRequest access to the information we have collected about you
45-day response windowRequest a copy of personal information we have collected about you
45-day response windowRequest that we stop selling your personal information
45-day response windowCorrect inaccurate or incomplete information we have collected about you
45-day response windowHow Clym Helps You Comply with the Utah Consumer Privacy Act
Configurable consent banner with a clear opt-out for targeted ads and data sales, and a full consent audit log.
Clym's Data Subject Request portal handles every UCPA request type, with built-in 45-day deadline tracking and escalation alerts.
Clym scans your site and generates your UCPA-compliant privacy notice, updated automatically when new trackers or data categories are detected.
Regulation Summary
- March 24, 2022: UCPA signed into law by Governor Spencer Cox.
- December 31, 2023: UCPA becomes effective.
- July 1, 2026: H.B. 418 amendments become effective, officially introducing the right to correct data and specific social media data portability requirements.
- Businesses that conduct operations in Utah or target Utah residents and meet the following criteria:
- Generate $25 million or more in annual revenue; and
- Either:
- Process data of 100,000 or more consumers annually, or
- Derive 50% or more of gross revenue from selling data of at least 25,000 consumers.
- Government entities and nonprofits.
- Entities governed by HIPAA, GLBA, or other federal regulations.
- Personal data used for employment or publicly available purposes.
- Transparency: Provide a clear privacy notice detailing data collection and sharing practices.
- Consumer Rights: Allow consumers to access, delete, or obtain copies of their data and opt out of targeted advertising and data sales.
- Data Security: Implement safeguards to protect personal data.
- Sensitive Data: Obtain explicit consent before processing sensitive personal data.
- Establish a designated request address for consumer inquiries.
- Respond to consumer requests within 45 days, extendable by an additional 45 days if necessary.
- Clearly disclose opt-out options and data practices.
- Controllers and processors must:
- Maintain contracts specifying data processing terms.
- Ensure data protection for shared or processed information.
- (For Social Media Companies only): Implement transparent, third-party-accessible interoperability interfaces to allow users to securely share their data across designated platforms.
- Access: Request a copy of personal data.
- Correction (New as of July 2026): Request that a controller correct inaccuracies in the consumer's personal data.
- Deletion: Request deletion of data provided by the consumer.
- Portability: Receive data in a portable format.
- Opt-Out: Refuse data sales or targeted advertising.
- Enforced by the Utah Attorney General.
- Cure Period: 30 days to address violations.
- Penalties: Up to $7,500 per violation, including actual damages.
- No private right of action.