Utah Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines

What Utah’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed September 2026.

What You Need to Know

Utah's law is one of the most business-friendly laws passed to date. The law lacks many of the hallmarks of recent laws, including a data protection impact assessment requirement. It also relies on notice and opportunity to object for the processing of sensitive data. The law was amended to add the right to correct, effective July 1, 2026.

Official law text

Who the law applies to

Threshold	Requirement
Annual gross revenue	$25 million (+ another category)
Consumers whose data is processed	100,000 consumers 3.03% of state's 3.3 million population
Revenue from sale of personal data	Derives more than 50% of gross revenue from sale of personal data and controls or processes personal data of 25,000 or more consumers.

Consumer rights under Utah's law15

Right	Provided?
Know	Yes
Access	Yes
Obtain list of third parties to which personal data was disclosed	No
Data portability note Right applies only to data provided by the consumer to the controller.	Partial
Delete note Right applies only to data provided by the consumer to the controller.	Partial
Correct inaccuracies	Yes
Not be discriminated against for exercising rights note A controller may offer a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised the consumer’s right to opt out of targeted advertising or the offer is related to a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.	Partial
Opt-out of sale note A “sale” does not include a controller's disclosure of personal data to a third party if the purpose is consistent with a consumer's reasonable expectations.	Partial
Opt-out of targeted advertising/sharing	Yes
Opt-out of certain types of profiling	No
Opt-out of ADMT	No
Recognize opt-out signals	No
Revoke consent	No
Not process data in discriminatory manner	No
Appeal	No

Tracking Utah’s privacy law? We write about it as the law changes.

Categories treated as sensitive data9

Racial or ethnic origin
Religious beliefs
Mental or physical health condition
Medical history
Medical treatment or diagnosis by a health care professional
Sexual orientation
Citizenship or immigration status
Genetic or biometric data for purposes of uniquely identifying an individual
Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.

How sensitive data must be treated1

Provide Notice and Opportunity to Opt Out

Requirements for minors' data1

Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent

Other notable provisions6

Opt-out Request Can Be Verified
Data Processing Agreements
Privacy Policy
Implement Reasonable Data Security Measures
Attorney General Enforcement
Right to Cure
note
30 day right to cure that does not sunset.

Key dates2

Date	What happens
December 31, 2023	Utah's consumer data privacy law takes effect
January 1, 2027	Utah HB 357 (2026) amendments take effect

Questions about Utah’s privacy law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Utah’s privacy law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.