Utah Data Privacy: A Plain-Language Overview
Utah Consumer Privacy Act (UCPA)
Status: Effective December 31, 2023; currently enforceable.
Utah has a comprehensive consumer privacy law effective as of the end of 2023. It regulates how private entities handle personal data, giving residents rights to access and delete their information. The law focuses on transparency and data minimization, requiring businesses to be clear about their data practices.
Rights residents generally have
- access to their personal data
- delete their personal data
- opt-out of the sale of personal data
- opt-out of targeted advertising
- correct inaccuracies in sensitive personal data
- data portability (receive data in a portable format)
Who it generally applies to
Generally applies to for-profit entities that do business in Utah and meet two of three thresholds: annual revenue of $25 million or more; handling personal data of 100,000 or more consumers (excluding payment card data); or deriving 50% or more of revenue from selling personal data or engaging in advertising.
What this means for B2B outreach
The law generally covers personal data of 'individuals acting in a personal or household context,' so it largely excludes data used strictly for employment or business-to-business (B2B) commercial transactions. However, general commercial emails must still comply with federal CAN-SPAM rules regardless of this state law.
Authoritative source: Utah Department of Commerce, Division of Consumer Protection. Always confirm current requirements there.
Marketing that respects privacy by design
We run permission-based, compliance-minded campaigns with real opt-out handling.
Talk to us