Utah Becomes Fourth US State To Enact Broad Consumer Data Privacy Law

On March 24, 2022, Utah Governor Spencer Cox signed into law the Utah Consumer Privacy Act (the UCPA or the Act), making Utah the fourth state in the US to enact major comprehensive data privacy legislation. Although the UCPA will not take effect until December 31, 2023, businesses should begin now to assess how the Act applies and map out a plan for compliance. Much like the California Consumer Privacy Act (CCPA), Virginia's Consumer Data Protection Act (VCDPA) and the Colorado Privacy Act (CPA), the UCPA will obligate businesses engaging in commerce in Utah to provide state residents with notices about the collection, use and disclosure of personal information as well as the right to opt out of such collection, use and disclosure. The Act is most similar to—albeit narrower than—the VCDPA, which is broadly more favorable to businesses than the CCPA and CPA. Notably, the UCPA is the first comprehensive privacy law to pass both chambers of a Republican-controlled state.