Utah Consumer Privacy Act (UCPA)
The Utah Consumer Privacy Act (UCPA) is a state privacy law that grants consumers rights over their personal data and requires organizations to implement defined transparency and data protection practices.
What is the Utah Consumer Privacy Act (UCPA)?
The Utah Consumer Privacy Act (UCPA)is a comprehensive state privacy law that governs how businesses collect, use, and share personal data of Utah residents.
The UCPA provides consumers with rights such as access, deletion, data portability, and the right to opt out of certain data processing activities, including targeted advertising and the sale of personal data.
Compared to other US state privacy laws, the UCPA is considered less prescriptive, with narrower applicability thresholds and fewer operational requirements.
Organizations subject to the law must provide clear disclosures, maintain reasonable security practices, and respect verified consumer requests.
Why the Utah Consumer Privacy Act matters
The UCPA impacts how businesses collect, manage, and disclose personal data for Utah residents, making it an important part of the expanding US privacy landscape.
Meeting UCPA requirements strengthens organizational transparency, reduces legal risk, and builds trust with consumers.
The law also aligns with emerging national privacy trends, signaling the need for consistent data governance practices across states.
How the Utah Consumer Privacy Act is applied in practice
- Updating privacy notices to reflect UCPA-required disclosures
- Implementing workflows to honor access, deletion, and portability requests
- Providing opt-out mechanisms for targeted advertising or data sales
- Updating vendor agreements to ensure proper data handling obligations
- Applying reasonable and appropriate security controls
- Assessing whether data practices involving children require enhanced safeguards
Related laws & standards
- General Data Protection Regulation (GDPR)
- California Privacy Rights Act (CPRA)
- India DPDPA
- Digital Operational Resilience Act (DORA)
- SOC 2
How OneTrust helps with the Utah Consumer Privacy Act
OneTrust helps organizations comply with UCPA by centralizing consumer rights request workflows, managing disclosures, automating data mapping, and supporting vendor governance.The platform enables consistent privacy operations across multiple state laws, reducing complexity and improving compliance readiness.
[Explore Solutions →]
FAQs about the Utah Consumer Privacy Act
The UCPA has narrower applicability thresholds and fewer requirements, such as no mandatory risk assessments, no data minimization mandates, and no expanded sensitive data rules found in CCPA.
Organizations that conduct business in Utah, target Utah residents, and meet revenue or data processing thresholds defined by the law.
No. The UCPA does not include mandatory privacy risk assessments, which distinguishes it from other state privacy laws.
