Utah Data Privacy Law (UCPA): What Utah Residents Need to Know

The Utah Consumer Privacy Act (UCPA) took effect on December 31, 2023, making Utah the fourth state with a comprehensive consumer privacy law. It is narrower than the laws in California, Colorado, and Connecticut — it skips the right to correct data and limits the deletion right — but it still lets Utah residents opt out of data sales and request deletion of data they have directly provided to companies.

What Is the Utah Consumer Privacy Act?

Governor Spencer Cox signed the Utah Consumer Privacy Act on March 24, 2022. It became effective December 31, 2023. The UCPA borrows structure from Virginia and Colorado but is more business-friendly in practice: it sets a higher applicability threshold and gives consumers fewer rights than any other comparable state law.

The UCPA applies to businesses that conduct business in Utah or produce products or services targeted to Utah residents, have annual revenue of $25 million or more, and either: control or process personal data of 100,000 or more Utah consumers annually, or control or process personal data of 25,000 or more Utah consumers and derive more than 50% of gross revenue from the sale of personal data.

The $25 million revenue floor is the biggest structural difference from Virginia, Colorado, and Connecticut. Smaller businesses covered by those states' laws may not be covered in Utah. For large data brokers with national operations, the threshold is almost always met.

Your Rights Under the UCPA

Utah residents have four rights under the UCPA. Unlike every other comparable state law, it doesn't include a right to correct inaccurate data:

One important limit in Utah's deletion right: it only covers data you providedto the controller — not all data the controller has obtained. California, Virginia, Colorado, and Connecticut all have broader standards. In practice, data brokers typically acquire your data from third-party sources, not from you directly, so this distinction narrows what you can actually demand removed under the UCPA alone.

This is one reason using an authorized agent that invokes CCPA — which has no such restriction — produces more complete results. GhostVault submits deletion requests under CCPA and other applicable state laws to maximize what has to be removed.

How the UCPA Compares to CCPA

What Data Brokers Must Do Under the UCPA

Covered businesses under the UCPA must fulfill several obligations:

• Publish a privacy notice that clearly describes the categories of personal data processed, the purposes of processing, the consumer rights available, and how consumers can exercise those rights.
• Process deletion and opt-out requests within 45 days, extendable by an additional 45 days with proper notice.
• Provide at least two clear methods for consumers to submit requests — including a toll-free number or email address dedicated to privacy requests.
• Implement reasonable security measures to protect personal data from unauthorized access, disclosure, and use.
• Limit data use to disclosed purposes and avoid processing data in ways that are incompatible with the stated reasons for collection.
• Provide an opt-out mechanism for data sales and targeted advertisingthat is clearly accessible and functional. Unlike California, Colorado, and Connecticut, this does not need to support automatic browser-based signals.

Step-by-Step: How to Submit a UCPA Deletion Request

1. 1. Find the data broker's privacy policy. Look in the site footer for a link to the privacy policy or "Your Privacy Rights." Utah businesses must publish a clear, accessible privacy notice that explains how to submit requests.
2. 2. Identify the request submission method. The UCPA requires covered businesses to provide at least two methods for submitting requests — typically a web form and an email address or toll-free phone number.
3. 3. Submit your request as a Utah resident. State your name, contact information, and that you are a Utah resident exercising your rights under the Utah Consumer Privacy Act. Request deletion of all personal data you have provided to the company, and also opt out of any sale of your personal data.
4. 4. Respond to any verification request. The company may request identity verification before processing. Provide the requested information promptly to avoid delays.
5. 5. Wait for the 45-day response window. Keep records of your submission date. If the company extends the response period, they must notify you within the initial 45-day window.
6. 6. File a complaint if necessary. If the company fails to respond or denies your request improperly, file a complaint with the Utah Division of Consumer Protection at consumerprotection.utah.gov, or contact the Utah Attorney General's office.

Utah's UCPA is a floor, not a ceiling. Most major data brokers serve consumers nationally and already process deletion requests under CCPA, which has broader deletion rights. Utah residents submitting requests through GhostVault get CCPA's wider scope, not just the UCPA's more limited version. Learn more about California CCPA rights or see how GhostVault automates the process.

Frequently Asked Questions