UCPA applies to a controller or processor that conducts business in Utah or produces a product or service targeted to Utah residents, has annual revenue of $25,000,000 or more, and satisfies one or both of the following: during a calendar year, controls or processes personal data of 100,000 or more Utah consumers; or derives over 50 percent of gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more Utah consumers. Numerous exemptions apply including GLBA-regulated financial institutions, HIPAA-covered entities and business associates, FCRA-covered consumer reporting agencies, nonprofits, higher education institutions, and tribes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.