Utah Consumer Privacy Act (UCPA): Key Points for Businesses

The UCPA went into effect on December 31, 2023, and it grants Utah residents control over their personal data.

Key Provisions

• Consumers have the right to access, delete, and opt-out of the sale or profiling of their personal data.
• Businesses must provide a clear and accessible privacy policy outlining data collection practices and consumer rights under the UCPA.
• Procedures must be established to handle consumer data requests.

Non-compliance Penalties

The Utah Attorney General enforces the UCPA.  Violations can result in fines for actual damages to the consumer and $7,500 per violation.

Key Distinction from California (CCPA):

The UCPA has a narrower scope than the CCPA. It focuses on access, deletion, and opt-out rights, and doesn't require opt-in consent for processing sensitive data (clear notice suffices).

Why It Matters

Understanding and complying with the UCPA is crucial for mid-sized businesses in Utah. This law is one of several evolving state privacy regulations, so staying informed and adapting data practices is essential.