What UCPA actually requires
Utah's consumer privacy law, narrower in scope than California or Virginia. The UCPA focuses on transparency, opt-outs for the sale of personal data and targeted advertising, and basic rights of access and deletion. Enforced by the Utah Attorney General and the Department of Commerce.
Key requirements
- Provide a clear privacy notice covering the categories of data and purposes
- Offer an opt-out of targeted advertising and the sale of personal data
- Respond to consumer rights requests (access, deletion, portability) within 45 days
- Use reasonable data security practices appropriate to the data you hold
- Sign processing agreements with vendors that handle personal data
At a glance
Full name
Utah Consumer Privacy Act
Region
Utah, USA
Status
In force since December 2023
Who it affects
Controllers with annual revenue of at least USD 25 million that either process data of 100,000+ Utah residents per year, or process 25,000+ residents and derive 50%+ of revenue from selling personal data.
Penalties
Civil penalties of up to USD 7,500 per violation, payable to the Consumer Privacy Account. The law currently provides a 30-day right to cure.
How GrantCookie covers it
Compliant defaults
Opt-in by default, granular categories, and a reject button as prominent as accept — the configuration regulators expect.
Provable records
Every consent is timestamped and stored with the banner version, so you can show exactly what was agreed to.
Easy withdrawal
A persistent re-open control lets visitors change their mind at any time, exactly as the law requires.
This page is general guidance, not legal advice. Check your specific obligations with a qualified adviser.