Does Utah have a comprehensive privacy law? Yes. The Utah Consumer Privacy Act (SB 227), signed on March 24, 2022, has been in effect since December 31, 2023.
- Status: In Effect
- Law: Utah Consumer Privacy Act (SB 227, 2022 General Session; Laws of Utah 2022, chapter 462; Utah Code Title 13, Chapter 61)
- Signed: March 24, 2022 · Effective: December 31, 2023
- Applies to: Controllers or processors that conduct business in Utah or target products or services to Utah residents, have annual revenue of $25,000,000 or more, and either control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of gross revenue from the sale of personal data while controlling or processing the personal data of 25,000 or more consumers (Utah Code 13-61-102); from January 1, 2027, also motor vehicle manufacturers that collect personal data through a vehicle data collection system (Laws of Utah 2026, chapter 193)
- Cure period: Yes; 30 days after the Attorney General’s written notice; no end date
- Enforcement: Attorney General (exclusive), on referral from the Division of Consumer Protection; actual damages and up to $7,500 per violation; no private right of action
- Last verified: November 4, 2026 · Official source: Utah Legislature, SB 227 (2022)
- Related: Utah Consumer Privacy Act (UCPA) guide
Utah’s comprehensive privacy law is the Utah Consumer Privacy Act (UCPA). It was passed as Senate Bill 227 in the 2022 General Session, signed by the Governor on March 24, 2022, and took effect on December 31, 2023. It is codified in Utah Code Title 13, Chapter 61.
The UCPA applies only to larger businesses. A controller or processor must do business in Utah or target Utah residents, have annual revenue of at least $25 million, and also meet a data threshold: personal data of 100,000 or more consumers in a calendar year, or more than half of gross revenue from selling personal data plus data of 25,000 or more consumers. Revenue alone is not enough. A 2026 amendment extends the law to motor vehicle manufacturers that collect personal data through vehicle data systems from January 1, 2027. The Attorney General enforces the law exclusively, must give 30 days’ written notice and a chance to cure before suing, and may recover actual damages and up to $7,500 per violation.
For details on consumer rights and business obligations, read our guide to the Utah Consumer Privacy Act (UCPA).