The Utah Consumer Privacy Act

On March 24, 2022, Utah Governor Spencer Cox signed the Utah Consumer Privacy Act ("UCPA") into law. The UCPA, which will become effective December 31, 2023, largely mirrors the Virginia Consumer Data Privacy Act ("VCDPA"), explained in more detail here, or Europe's General Data Protection Regulation ("GDPR").

The UCPA applies to businesses that control or process consumers' personal information if they:

1. (a) conduct business in Utah or (b) produce products or services that are targeted to residence of Utah;
2. Has an annual revenue of $25,000,000 or more; and
3. Satisfies one or more of the following thresholds:
   1. During a calendar year, controls or processes personal data of 100,000 or more consumers; or