Utah Consumer Privacy Act C-302-3: Give clear notice and an opportunity to opt out before processing sensitive data; follow COPPA for known children

Before processing sensitive data collected from a consumer the controller must present clear notice and an opportunity to opt out (Utah does not require opt-in consent), and must process a known child's data in line with COPPA.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Controller and processor duties (Part 3) – Utah Consumer Privacy Act

C-301 Bind processors by contract and have them assist with security and breach notification
C-302-1 Publish a clear privacy notice and disclose how to opt out of sale and targeted advertising
C-302-2 Maintain reasonable administrative, technical and physical data security
C-302-4 Do not discriminate against consumers for exercising rights or use contract terms that waive them
C-303 Keep pseudonymous and deidentified data protected and honour contractual commitments on it
C-304 Be able to prove that processing under an exemption qualifies

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Utah Consumer Privacy Act controls