Utah
💡 Last Updated October 2025. Written with contributions from both human authors and LLMs. If you find incorrect or outdated information let us know at support@optery.com.
Utah's UCPA gives you the right to opt out of data brokers.
What the UCPA does for you
Under the Utah Consumer Privacy Act (UCPA), you have the right to know what personal data businesses collect about you, access and delete data you've provided them, opt out of the sale of your data and targeted advertising, and receive a portable copy of your data. You also have the right not to be discriminated against for exercising these rights. The law covers large businesses with at least $25 million in annual revenue that operate in Utah.
Your rights under the UCPA
Right to Know
You have the right to confirm whether a business is processing your personal data and to access that data. You can submit a request to any covered business asking them to tell you what personal data they hold about you.
Exceptions: Does not apply to deidentified, aggregated, or publicly available information; Does not apply to protected health information covered by HIPAA; Does not apply to employee data used in an employment context; Controller may decline if request is fraudulent and cannot be authenticated; Does not apply to pseudonymous data where identifying info is kept separately.
Source: Utah Code § 13-61-201(1)
Right to Delete
You have the right to delete personal data that you provided to a covered business. You can ask the business to remove information you gave them directly.
Exceptions: Only applies to data the consumer themselves provided to the controller (not data collected from third parties); Does not apply if deleting would require breaching a security system; Does not apply if the data is needed to comply with a legal obligation; Does not apply to data needed to complete a transaction or fulfill a contract; Does not apply to pseudonymous data where identifying info is kept separately.
Source: Utah Code § 13-61-201(2)
Right to Correct
Starting July 1, 2026, you will have the right to ask a covered business to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes for which it is processed.
Exceptions: This right takes effect July 1, 2026 under the amended version of Section 13-61-201; Takes into account the nature of the data and the purposes of processing.
Source: Utah Code § 13-61-201(4) (Effective 7/1/2026)
Right to Opt Out of Sales
You have the right to opt out of a covered business selling your personal data to third parties for money. If a business sells your data, it must clearly explain how you can opt out.
Exceptions: Does not apply to transfers to processors acting on the controller's behalf; Does not apply to transfers to affiliates; Does not apply to disclosures consistent with the consumer's reasonable expectations; Does not apply when the consumer directs the disclosure; Does not apply to mergers, acquisitions, or bankruptcy transfers.
Source: Utah Code § 13-61-201(4)(b)
Right to Opt Out of Processing
You have the right to opt out of a covered business using your personal data for targeted advertising — that is, ads selected based on your activity across different websites and apps over time.
Exceptions: Does not apply to ads based on activity within the controller's own website or affiliated sites; Does not apply to contextual advertising based on your current search or visit; Does not apply to ads in response to your own request; Does not apply to processing solely to measure or report advertising performance.
Source: Utah Code § 13-61-201(4)(a)
Right to Data Portability
You have the right to get a copy of the personal data you provided to a covered business in a portable, easy-to-use format. You can use this copy to transfer your data to another service, where technically feasible.
Exceptions: Only applies to data the consumer previously provided to the controller; Portability is only required to the extent technically feasible; Usable format is only required to the extent practicable; Data transfer without impediment applies only where processing is carried out by automated means.
Source: Utah Code § 13-61-201(3)
Right to Non-Discrimination
A covered business cannot punish you for exercising your privacy rights. They cannot deny you goods or services, charge you different prices, or give you a lower quality of service just because you asked them to delete your data or opted out of data sales.
Exceptions: A business may offer different prices or features if you opt out of targeted advertising; A business may offer discounts or rewards through a voluntary loyalty or club card program; A business is not required to provide a product or service if your data is necessary to provide it and you refuse to share it.
Source: Utah Code § 13-61-302(4)
Right to Limit Sensitive Data
Covered businesses must give you clear notice and an opportunity to opt out before processing your sensitive data — which includes things like your race or ethnicity, religion, sexual orientation, immigration status, health information, biometric data used to identify you, and precise location data.
Exceptions: Does not apply to sensitive data processed by video communication services for racial/ethnic origin; Does not apply to health data processed by licensed healthcare providers under Utah law; For children's data, must follow COPPA parental consent requirements instead.
Source: Utah Code § 13-61-302(3)
How to exercise your rights
- See which data brokers have your information. Optery scans 200+ brokers to show you what’s exposed. Start a free scan →
- Submit a UCPA deletion or opt-out request. Covered businesses have 45 days to respond (Utah Code § 13-61-203), with up to 45 additional days if they invoke the extension provision.
- Let Optery automate the whole process. We submit opt-out and deletion requests on your behalf, track compliance, and resubmit whenever brokers re-add your data. Sign up free →
Authorized agents
The UCPA does not mention authorized agents (Utah Code Ann. § 13-61-101 et seq.). This means data brokers are not required to honor privacy requests submitted by someone other than you personally. Optery can help you submit requests directly — we prepare everything for you; you hit send.
Enforcement and penalties
The UCPA is enforced by Utah Attorney General and Utah Division of Consumer Protection. The Utah Attorney General has exclusive authority to bring enforcement actions. Before suing, the AG must give a business 30 days' written notice to cure any violation. If the business fails to fix the problem (or repeats a cured violation), the AG can sue and recover actual damages to consumers plus up to $7,500 per violation. Consumers cannot sue businesses directly under this law.
Who does the UCPA apply to?
The UCPA applies to businesses (called 'controllers') that conduct business in Utah or target products/services to Utah residents, AND have annual revenue of at least $25 million, AND either: (1) process personal data of 100,000 or more Utah consumers per year, OR (2) derive more than 50% of gross revenue from selling personal data AND process data of 25,000 or more consumers. Nonprofits, institutions of higher education, government entities, covered healthcare entities, and certain regulated industries are exempt.
Frequently asked questions
What businesses does the UCPA cover?
The UCPA applies to businesses that do business in Utah or target Utah residents, have at least $25 million in annual revenue, AND either process data on 100,000 or more Utah consumers per year, OR derive more than 50% of gross revenue from selling personal data and process data on at least 25,000 consumers (Utah Code § 13-61-102). Nonprofits, universities, and government entities are generally not covered.
How do I submit a privacy rights request to a business?
You submit your request directly to the business using whatever method they have set up (Utah Code § 13-61-202(1)). The business must respond within 45 days, though they can extend that by another 45 days if they notify you and explain why (Utah Code § 13-61-203(2)). They may ask you for additional information to verify your identity before responding.
Can I sue a company that violates the UCPA?
No — the UCPA explicitly prohibits private lawsuits by consumers (Utah Code § 13-61-305). Only the Utah Attorney General can take legal action against a business. If you believe your rights have been violated, you can file a complaint with the Utah Division of Consumer Protection, which investigates complaints and may refer cases to the Attorney General (Utah Code § 13-61-401).
What is 'sensitive data' and how is it protected?
Sensitive data includes your racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, medical history or health conditions, genetic data, biometric data used to identify you, and precise geolocation data (Utah Code § 13-61-101(32)). Before processing your sensitive data, a business must give you clear notice and the opportunity to opt out — they cannot process it without giving you this choice (Utah Code § 13-61-302(3)).
Does the UCPA give me the right to correct my personal data?
A right to correct inaccuracies in your personal data was added to the UCPA but does not take effect until July 1, 2026 (Utah Code § 13-61-201(4), Effective 7/1/2026). Under the version in effect before that date, correction is not an available right. Once effective, you will be able to ask covered businesses to fix inaccurate information they hold about you.