UCPA Compliance: The Utah Consumer Privacy Act, Handled
Utah runs one of the most business-friendly privacy frameworks in the country. ConsentPixel makes compliance a one-pixel install.
The Utah Consumer Privacy Act (UCPA) gives Utah residents rights over their personal data under one of the most business-friendly privacy frameworks in the country. ConsentPixel — Privacy · Verified handles opt-outs, privacy documents, and audit-ready logs so UCPA compliance is one pixel away.
What is the UCPA?
The Utah Consumer Privacy Act took effect on December 31, 2023. It grants Utah residents rights over their personal data and imposes obligations on businesses that meet its thresholds. The UCPA is widely regarded as the most business-friendly of the US state privacy laws: narrower applicability, fewer obligations, and no private right of action.
The UCPA follows an opt-out model. Notably, it takes a lighter approach to sensitive data than most states — rather than requiring opt-in consent, it requires clear notice and an opportunity to opt out of sensitive-data processing. A 2025 amendment (HB 418) adds a right to correct inaccurate data, taking effect July 1, 2026.
Who must comply
- Controllers and processors that conduct business in Utah or target Utah residents, have annual revenue of at least $25 million, and meet at least one of:
- Control or process the personal data of 100,000 or more consumers in a year; or
- Derive over 50% of gross revenue from selling personal data and control or process the data of 25,000 or more consumers.
- The $25 million revenue floor means many smaller businesses fall outside the UCPA entirely.
- Standard exemptions apply (HIPAA, GLBA, nonprofits, higher education, government, and others).
What the UCPA requires
- Privacy notice: Provide a clear privacy notice describing data practices and consumer rights.
- Consumer rights: Honor access, deletion, portability, and opt-out of sale and targeted advertising. (A right to correct takes effect July 1, 2026.)
- Opt-out mechanisms: Provide clear ways to opt out of sale and targeted advertising.
- Sensitive data — notice & opt-out: Rather than opt-in consent, give clear notice and the opportunity to opt out of sensitive-data processing.
- Children's data: Process children's data in line with COPPA, including verifiable parental consent for those under 13.
- Security: Maintain reasonable data security practices.
The Utah Attorney General enforces the UCPA, with input from the Division of Consumer Protection. There is a 30-day cure period, civil penalties of up to $7,500 per violation, and no private right of action.
How ConsentPixel makes you UCPA-compliant
ConsentPixel — Privacy · Verified sits between your visitors and your trackers. It detects what's running, presents a geo-aware consent banner, enforces the visitor's choice, and keeps an immutable record of every decision. Here's how that maps to your obligations:Geo-aware opt-out model. Utah visitors get the opt-out experience the UCPA requires, including notice-and-opt-out for sensitive data categories rather than opt-in consent.
Auto-detecting scanner finds every cookie and tracker on your site, so your disclosures and consent categories are complete and accurate — not guesswork.
Signal passthrough drives Google Consent Mode v2, Microsoft UET, Meta Pixel, and IAB TCF 2.3 from a single consent event, so every platform respects the same choice.
GPC honoring recognizes Global Privacy Control opt-out signals and applies them automatically.
Document generator auto-creates Privacy Policy, Cookie Policy, Terms, and DPA documents to support your transparency obligations.
Immutable, tamper-evident logs record every consent decision — audit-ready proof of what each visitor saw and chose.
One pixel, under 5 minutes. Everything above ships from a single pixel install, with a public trust badge and verification page.
Why ConsentPixel
- Auto-detection ensures opt-outs actually suppress the right trackers.
- One pixel handles opt-outs, GPC, documents, and signals together.
- Audit-ready logs give defensible proof for AG enforcement.
- Multi-regulation: the same install covers stricter state laws your visitors may fall under.
Frequently asked questions
Does the UCPA apply to small businesses?
Generally no. The UCPA's $25 million revenue floor, combined with its additional data-volume thresholds, means many smaller businesses are outside its scope entirely.
Does the UCPA require opt-in consent for sensitive data?
No. Unlike most state laws, the UCPA requires clear notice and an opportunity to opt out of sensitive-data processing rather than prior opt-in consent. ConsentPixel supports this notice-and-opt-out approach.
Does the UCPA include a right to correct data?
Originally it did not, which set it apart from other state laws. A 2025 amendment (HB 418) adds a right to correct inaccurate data, effective July 1, 2026.
What are the penalties under the UCPA?
The Utah Attorney General can seek civil penalties of up to $7,500 per violation after a 30-day cure period. There is no private right of action.
Do I need to honor GPC under the UCPA?
ConsentPixel honors Global Privacy Control to support opt-out rights. Honoring universal signals is good practice and aligns with how ConsentPixel applies the right model per visitor across states.
The bottom line
Utah is the gentlest of the state laws — a high revenue floor, notice-and-opt-out for sensitive data, and (until mid-2026) no right to correct. If you're large enough to be in scope here, you're almost certainly subject to stricter states too, so build to the higher bar and Utah takes care of itself.
Make UCPA compliance a one-pixel job
Install ConsentPixel to serve Utah visitors the right opt-out model, generate your privacy documents, and keep audit-ready logs.
Scan your site free Start free trialThis page is informational and is not legal advice. The UCPA is a Utah state law; consult qualified counsel for advice on your specific obligations.