What are the Utah UCPA compliance deadlines?

Dec 31, 2023: UCPA takes effect. Jul 1, 2026: Right to correct takes effect. Jan 1, 2027: UCPA extends to motor vehicle manufacturers.

When does Utah UCPA take effect?

Utah UCPA took effect on Dec 31, 2023. The next milestone is Jan 1, 2027: UCPA extends to motor vehicle manufacturers.

Who does Utah UCPA apply to?

Controllers or processors conducting business in Utah or targeting Utah residents with annual revenue of $25,000,000 or more that either control or process personal data of 100,000+ consumers in a calendar year, or derive over 50% of gross revenue from selling personal data and control or process data of 25,000+ consumers (13-61-102). From Jan 1, 2027, also any motor vehicle manufacturer whose vehicles are sold or leased in Utah and that collects personal data through a vehicle data collection system. Exempts government, tribes, higher education, nonprofits, HIPAA entities, GLBA, and others.

What are the penalties under Utah UCPA?

AG may recover actual damages and up to $7,500 per violation not cured (13-61-402(3)(d)). Mandatory 30-day notice-and-cure period; it does not sunset. The Division of Consumer Protection takes complaints and refers cases to the AG. No private right of action.

Utah UCPA

Amended Utah · In force Dec 31, 2023 · next deadline Jan 1, 2027 (in 2 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

Takes effectJan 1, 2027 · in 2 months · Source

UCPA extends to motor vehicle manufacturersMotor vehicle manufacturers whose vehicles are sold or leased in Utah and that collect personal data through vehicle data systems are covered regardless of the revenue and consumer thresholds (13-61-102, as amended by Laws 2026, ch. 193).

Already passed

Takes effectJul 1 · 4 months ago · Source

Right to correct takes effectConsumers may ask controllers to correct inaccurate personal data (13-61-201(4), as amended by Laws 2025, ch. 468).

Takes effectDec 31, 2023 · 2.8 years ago · Source

UCPA takes effectUtah Consumer Privacy Act obligations and consumer rights apply.

Summaries for reference, not legal advice. Check the official text.

What it does

Business-friendly comprehensive privacy law with access, deletion, portability and opt-out rights (targeted advertising, sale); sensitive data needs notice and a chance to opt out rather than opt-in consent, and data protection assessments are not required. A right to correct was added from July 1, 2026, and from Jan 1, 2027 the law covers motor vehicle manufacturers regardless of thresholds.

Who it applies to: Controllers or processors conducting business in Utah or targeting Utah residents with annual revenue of $25,000,000 or more that either control or process personal data of 100,000+ consumers in a calendar year, or derive over 50% of gross revenue from selling personal data and control or process data of 25,000+ consumers (13-61-102). From Jan 1, 2027, also any motor vehicle manufacturer whose vehicles are sold or leased in Utah and that collects personal data through a vehicle data collection system. Exempts government, tribes, higher education, nonprofits, HIPAA entities, GLBA, and others.
Penalties: AG may recover actual damages and up to $7,500 per violation not cured (13-61-402(3)(d)). Mandatory 30-day notice-and-cure period; it does not sunset. The Division of Consumer Protection takes complaints and refers cases to the AG. No private right of action.
Enforced by: Utah Attorney General (exclusive), on referral from the Utah Division of Consumer Protection
Official name: Utah Consumer Privacy Act (SB 227, 2022)
Citation: Utah Code 13-61-101 et seq. (Laws 2022, ch. 462; amended 2025 ch. 468, 2026 ch. 193)
Topics: Privacy

Verified 2026-09-22 le.utah.gov le.utah.gov le.utah.gov gunster.com

Research notes

Amendments are identified by session-law chapter from the Utah Code version notes. The bill numbers behind 2025 ch. 468 and 2026 ch. 193 were not confirmed. Utah's separate 2025 social media data portability/interoperability law (Digital Choice Act) is reported to take effect July 2026 but sits outside the UCPA and is not included here. SB 227 signing date is March 24, 2022 per contemporaneous reporting.

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months

EnactedCalifornia

California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months

In forceCalifornia

California social media account deletionSocial media platforms must offer a clear and conspicuous button to delete an account and must not obstruct deletion. A request to delete an account counts as a CCPA request to delete the user's personal information.In effect since Jan 1, 2026

EnactedColorado

Colorado AI ActColorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.Next: Jan 1, 2027 ADMT obligations apply · in 2 months

Questions about Utah UCPA

What are the Utah UCPA compliance deadlines?: Dec 31, 2023: UCPA takes effect. Jul 1, 2026: Right to correct takes effect. Jan 1, 2027: UCPA extends to motor vehicle manufacturers.
When does Utah UCPA take effect?: Utah UCPA took effect on Dec 31, 2023. The next milestone is Jan 1, 2027: UCPA extends to motor vehicle manufacturers.
Who does Utah UCPA apply to?: Controllers or processors conducting business in Utah or targeting Utah residents with annual revenue of $25,000,000 or more that either control or process personal data of 100,000+ consumers in a calendar year, or derive over 50% of gross revenue from selling personal data and control or process data of 25,000+ consumers (13-61-102). From Jan 1, 2027, also any motor vehicle manufacturer whose vehicles are sold or leased in Utah and that collects personal data through a vehicle data collection system. Exempts government, tribes, higher education, nonprofits, HIPAA entities, GLBA, and others.
What are the penalties under Utah UCPA?: AG may recover actual damages and up to $7,500 per violation not cured (13-61-402(3)(d)). Mandatory 30-day notice-and-cure period; it does not sunset. The Division of Consumer Protection takes complaints and refers cases to the AG. No private right of action.

Deadlines

What it does

Related