Utah Consumer Privacy Act (UCPA) Reference Guide

Under § 13-61-102, a controller or processor doing business in Utah or targeting Utah consumers must have annual revenue of at least $25 million and satisfy either of two volume conditions: 100,000 or more consumers’ data during a calendar year; or 25,000 or more consumers’ data and more than 50% of gross revenue from data sales. These are conjunctive requirements, not three interchangeable triggers. Utah Code § 13-61-102: applicability

The applicability section excludes specified government bodies, tribes, higher education, nonprofits, HIPAA covered entities and business associates, and other listed entities or data. Coverage needs documented revenue, individual-consumer counts, entity status and legal interpretation; page traffic is not a substitute for those records. Utah Code § 13-61-102: applicability

Current § 13-61-201 lets a consumer confirm and access processing, delete personal data the consumer provided, obtain a portable copy of eligible data previously provided, request correction of inaccuracies and opt out of targeted advertising or sale. Correction became effective July 1, 2026. Utah’s narrower deletion and portability language should not be silently replaced with another state’s broader version. Utah Code § 13-61-201: rights effective July 1, 2026

The chapter also addresses privacy notices, security, sensitive-data processing and processor relationships. Legal and privacy teams should map each right to its eligible data and exception; engineering should verify that a request is reflected in the site and any relevant vendor flows. Utah Code, chapter 13-61: Utah Consumer Privacy Act

The UCPA’s opt-out right names targeted advertising and sale. To assess a cookie, pixel, conversion API or server event, record what data is sent, the advertising purpose, recipient, consideration and governing contract. The domain alone does not establish either statutory category; counsel must apply the chapter’s definitions and exceptions. Utah Code, chapter 13-61: Utah Consumer Privacy Act

Compare consent-banner and privacy-notice claims with what actually happens. If the site says a choice stops a class of processing, test what happens after that choice in the browser and server-side integrations. A technically consistent signal still does not establish organizational UCPA compliance. Utah Code, chapter 13-61: Utah Consumer Privacy Act

Current § 13-61-201 grants a consumer the right to opt out of sale or targeted advertising. The official UCPA provisions reviewed for this guide do not establish a general rule requiring recognition of every browser GPC signal. A GPC test remains useful to see what the website does and may matter under other applicable laws. Utah Code § 13-61-201: rights effective July 1, 2026

Test the UCPA request path separately from a browser-signal scenario. Observe whether the choice persists across page loads, reaches hard-coded tags and server-side events, and is communicated to relevant processors. Have counsel review whether the path and timing satisfy Utah’s current requirements. Utah Code, chapter 13-61: Utah Consumer Privacy Act

The UCPA began December 31, 2023. Section 13-61-201’s new correction language is effective July 1, 2026 and applies in the current version. An implementation checklist written before that date can miss a right that now needs a request workflow. Utah Code § 13-61-201: rights effective July 1, 2026

The official Utah Code also displays versions effective January 1, 2027. Those future text and citation changes should be checked at the switchover; they are not described here as already effective or as a separate law in force today. Utah Code, chapter 13-61: Utah Consumer Privacy Act

The Utah Department of Commerce provides a UCPA resource for residents and businesses. Enforcement and exemptions require legal review of the present code, especially where the organization handles several states and older documents summarize a superseded version of the consumer-rights section. Utah Department of Commerce: UCPA

Start with revenue, consumer volumes and the exemptions in § 13-61-102. Next, update notices and request systems to recognize correction from July 2026, along with access, deletion of consumer-provided data, portability and the sale and targeted-advertising opt-out. Utah Code § 13-61-102: applicability

Have counsel classify each ad-tech recipient and identify which data is within scope. Engineering should test the approved choice through tag managers, embedded scripts, APIs and downstream platforms like Google Ads and Meta and retain a dated result for remediation and later review. Utah Code, chapter 13-61: Utah Consumer Privacy Act

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

The official Utah Code and Department of Commerce are the primary sources. The July 1, 2026 rights PDF is used specifically to avoid an outdated claim that Utah lacks a correction right; applicability language is grounded in the cited § 13-61-102 version.

Prepared by Etalon Editorial Team. Last reviewed October 9, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exclusions, classifications, notices, requests, sensitive data, children, contracts, assessments and governance.