Utah Enacts New Privacy Law

With the passage and signing of the Utah Consumer Privacy Act ("UCPA"), Utah joins the ranks of California, Virginia, and Colorado in enacting a comprehensive data privacy law. The UCPA will officially go into effect on December 23, 2023, and largely mirrors existing data privacy regimes in the United States, with a few notable exceptions.

The UCPA applies to businesses that meet minimum thresholds related to revenue and the number of Utah residents whose data they control or process. Specifically, the UCPA applies to (a) data controllers and processors (b) conducting business in Utah or targeting Utah consumers (c) with more than $25 million in annual revenue, and (d) who process or control personal data of 100,000 or more Utah residents or derive 50% of their business from the processing or controlling of the data of at least 25,000 Utah residents.