Utah Consumer Privacy Act (UCPA) Compliance

Summary

This practice note provides an overview of the scope, key terms, rights granted, obligations imposed, and enforcement measures available under the Utah Consumer Privacy Act (UCPA), Utah Code Ann. § 13-61-101 et seq. Utah was the fourth state to enact comprehensive privacy legislation on March 24, 2022, behind California (California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Cal. Civ. Code § 1798.100 et seq.); Virginia (Virginia Consumer Data Protection Act (VCDPA), Va. Code Ann. § 59.1-575 et seq.); and Colorado (Colorado Privacy Act (CPA), Colo. Rev. Stat. §§ 6-1-1301 through 6-1-1313). Like its predecessors, the UCPA offers broad personal data protections for consumers and imposes compliance obligations on those entities that control or process significant amounts of information. However, Utah is considered the most business-friendly of its peers. The UCPA becomes effective December 31, 2023.