Utah Governor Spencer Cox signed the Utah Consumer Privacy Act (UCPA) into law, making Utah the fourth US state to adopt comprehensive privacy legislation, following California in 2018, and Virginia and Colorado in 2021. The UCPA will become effective on December 31, 2023.
The UCPA applies to businesses who act either as “controllers” or “processors”, and who: (1) conduct business in Utah or target Utah residents; (2) have annual revenues of at least $25 million; and (3) either process the personal data of at least 100,000 Utah residents annually or process the personal data of at least 25,000 Utah residents per year while deriving over 50% of their gross revenue from the sale of such personal data. Certain types of data and certain entities are expressly stated to fall outside the scope of the UCPA, such as de-identified data, non-profit organizations, academic institutions, and government agencies.
Similar to the other state privacy laws, the UCPA gives Utah consumers the right to access the personal data collected about them, delete the data, obtain a copy of the data in a portable format, opt out of the sale of their personal data, and opt out of processing their personal data for targeted advertising.
Unlike the laws in Virginia and Colorado, which require consumers’ opt in consent to process their sensitive data, Utah controllers are only required to provide prior notice of that processing and allow consumers to opt out. The term “Sensitive Data” under the UCPA includes information about racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, health and medical treatment or conditions, biometric data, genetic data, and geolocation data.
CLICK HERE to read the Utah Consumer Privacy Act.
