The Utah Consumer Privacy Act applies only to businesses with $25 million or more in annual revenue that also control or process personal data of at least 100,000 Utah consumers, or 25,000 consumers if more than half of revenue comes from selling personal data.
What the Utah Consumer Privacy Act Requires
It is the lightest-touch comprehensive law: consumers get rights to access, delete, and port data and to opt out of targeted advertising and data sales, but there is no correction right, no data protection assessment requirement, and sensitive data processing requires clear notice and an opportunity to opt out rather than opt-in consent. Covered sites still need a compliant privacy notice.
Enforcement and Penalties
Enforcement runs through the Division of Consumer Protection to the Attorney General, with a 30-day cure period and penalties up to $7,500 per violation. There is no universal opt-out signal requirement and no private right of action, so the compliance lift here is mostly about notices and honoring the core rights requests.
Source: Utah State Legislature: SB 227, Utah Code 13-61
Report a violation: If you believe a business is violating this law, you can file a complaint with the Utah Division of Consumer Protection (Dept. of Commerce).
