Law note · Utah
Utah Consumer Privacy Act
Utah's omnibus consumer-data-privacy statute, enacted as S.B. 227 (Chapter 462, 2022 General Session). Applies only to a controller or processor doing business in or targeting Utah consumers with 25 million dollars or more in annual revenue and either 100,000 or more consumers processed a year, or 25,000 or more consumers processed while deriving over half of revenue from data sales.
Exempts government entities and their contractors, tribes, higher-education institutions, nonprofits, HIPAA-covered entities, and several other sectoral categories. Gives consumers access, deletion, correction, portability, and opt-out rights exercisable against the controller within 45 days, extendable once by 45 more days. The Attorney General has exclusive enforcement authority with a mandatory 30-day cure period, and the Act bars any private right of action.
What it asks of an app
- Provide Utah consumers a reasonably accessible, clear privacy notice describing the categories of personal data you process, the purposes, how consumers may exercise their rights, and any third parties you share data with, if you meet UCPA's 25 million dollar revenue and consumer-volume thresholds.
- Let Utah consumers opt out of the sale of their personal data and of processing for targeted advertising.
- Respond to a Utah consumer's request to access, delete, correct, or receive a portable copy of their personal data within 45 days, or notify the consumer of a single 45-day extension and the reason for it, and do not charge a fee for a consumer's first request in a 12-month period.
- Establish reasonable administrative, technical, and physical security practices for personal data, and enter into a written contract with any processor before it processes personal data on your behalf.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Utah Code text, Utah State Legislature