Utah Becomes Fourth State To Enact A Comprehensive Data Privacy Law

On March 24, 2022, Utah Governor Spencer Cox signed the Consumer Privacy Act ("Act"), making Utah the most recent state to enact a comprehensive data privacy law. The Act takes effect on December 31, 2023.

The Act will apply to entities that: (i) conduct business or target consumers in Utah; (ii) generate $25 million or more in annual revenue; and (iii) either process or control: (a) the personal data of at least 100,000 Utah consumers; or (b) the personal data of at least 25,000 Utah consumers and derive at least half their gross revenue from selling personal data. Under the Act, consumers include individuals who are Utah residents and are acting in an individual or household context. The Act applies to residents acting in an individual or household context, not an employment or commercial context.