Utah Consumer Privacy Act
The Utah Consumer Privacy Act (Utah Code 13-61, effective 31 December 2023) covers businesses with $25 million revenue that process data of 100,000 Utah consumers or earn over half their revenue from selling data of 25,000. Consumers can access, delete, port and (since 1 July 2026) correct their data and opt out of sale and targeted advertising; controllers must give a privacy notice, keep reasonable security, give notice and an opt-out before processing sensitive data, bind processors by contract and not discriminate. Enforcement is by the Attorney General after a 30-day cure, up to $7,500 per violation. Motor vehicle privacy duties start on 1 January 2027.
Utah Consumer Privacy Act is a compliance framework from United States (Utah) with 3 domains and 10 controls that map to 1 other frameworks. The largest domains are Controller and processor duties (Part 3) – Utah Consumer Privacy Act (7 controls), Consumer rights and requests (Part 2) – Utah Consumer Privacy Act (2 controls), Motor vehicle data privacy (Part 5, from 1 January 2027) – Utah Consumer Privacy Act (1 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Consumer rights and requests (Part 2) – Utah Consumer Privacy Act
| Code | Title |
|---|---|
| utah-consumer-privacy-act::R-201 | Honour requests to confirm and access, delete, port, correct and opt out |
| utah-consumer-privacy-act::R-203 | Respond within 45 days (one 45-day extension), free once a year, with reasons for refusal |
Controller and processor duties (Part 3) – Utah Consumer Privacy Act
| Code | Title |
|---|---|
| utah-consumer-privacy-act::C-301 | Bind processors by contract and have them assist with security and breach notification |
| utah-consumer-privacy-act::C-302-1 | Publish a clear privacy notice and disclose how to opt out of sale and targeted advertising |
| utah-consumer-privacy-act::C-302-2 | Maintain reasonable administrative, technical and physical data security |
| utah-consumer-privacy-act::C-302-3 | Give clear notice and an opportunity to opt out before processing sensitive data; follow COPPA for known children |
| utah-consumer-privacy-act::C-302-4 | Do not discriminate against consumers for exercising rights or use contract terms that waive them |
| utah-consumer-privacy-act::C-303 | Keep pseudonymous and deidentified data protected and honour contractual commitments on it |
| utah-consumer-privacy-act::C-304 | Be able to prove that processing under an exemption qualifies |
Motor vehicle data privacy (Part 5, from 1 January 2027) – Utah Consumer Privacy Act
| Code | Title |
|---|---|
| utah-consumer-privacy-act::MV-502 | Motor vehicle manufacturers: in-vehicle privacy controls for model year 2030 vehicles and deletion on protective orders |
Maps to 1 other framework
Coverage is not the same as your position
This page shows what Utah Consumer Privacy Act overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Utah Consumer Privacy Act and who does it apply to?
Utah Consumer Privacy Act is a compliance framework from United States (Utah) with 3 domains and 10 controls. The Utah Consumer Privacy Act (Utah Code 13-61, effective 31 December 2023) covers businesses with $25 million revenue that process data of 100,000 Utah consumers or earn over half their revenue from selling data of 25,000. Consumers can access, delete, port and (since 1 July 2026) correct their data and opt out of sale and targeted advertising; controllers must give a privacy notice, keep reasonable security, give notice and an opt-out before processing sensitive data, bind processors by contract and not discriminate. Enforcement is by the Attorney General after a 30-day cure, up to $7,500 per violation. Motor vehicle privacy duties start on 1 January 2027. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Utah Consumer Privacy Act actually require?
Utah Consumer Privacy Act has 10 controls organised across 3 domains. The largest domains are Controller and processor duties (Part 3) – Utah Consumer Privacy Act (7 controls), Consumer rights and requests (Part 2) – Utah Consumer Privacy Act (2 controls), Motor vehicle data privacy (Part 5, from 1 January 2027) – Utah Consumer Privacy Act (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Utah Consumer Privacy Act do I already cover?
Utah Consumer Privacy Act maps to 1 other compliance frameworks. The top mapping partners are Virginia CDPA (59% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Utah Consumer Privacy Act?
Start your Utah Consumer Privacy Act compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Utah Consumer Privacy Act requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 10 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required