Utah has become the fourth state to adopt omnibus consumer privacy legislation – following California, Virginia, and Colorado. Businesses operating in or serving consumers in Utah will need to comply by December 31, 2023.
Scope
The Utah Consumer Privacy Act (UCPA) will apply to controllers or processors that meet the following:
- Do business in the state or produce a product or service targeted to consumers who are Utah residents
- Have annual revenue of $25 million or more
- Meet one of two threshold requirements
-
- Control or process personal data of 100,000 or more consumers during a calendar year; or
- Derive over 50 percent of the entity’s gross revenue from the sale of personal data and control or process the personal data of 25,000 or more consumers.
Exemptions
The UCPA exempts institutions of higher education and nonprofits, as well as covered entities and business associates pursuant to the Health Insurance Portability and Accountability Act and financial institutions governed by the Gramm-Leach-Bliley Act. Government entities and contractors are also exempt from the law, as are tribes and air carriers.
