Introduction
The Utah legislature has passed Senate Bill 227, otherwise known
as the Utah Consumer Privacy Act (UCPA). Barring a veto from Utah
Governor Spencer J. Cox, who, as of March 15, 2022, officially has
the bill on his desk for action, Utah will become the fourth state
to pass a comprehensive privacy bill, following the likes of
California, Virginia, and Colorado. If enacted, the UCPA would
take effect on December 31, 2023.
Utah Consumer Privacy Act
Should the UCPA be enacted, it would apply to for-profit data
controllers and processors that (1) conduct business in Utah or
target Utah consumers, (2) generate $25 million in annual revenue,
and (3) either process or control personal data of 100,000 or more
Utah state residents, or process or control
personal data of at least 25,000 Utah residents and derive 50% or
more of their profits from the processing or controlling of that
data. Unlike the singular provisions in the California, Colorado,
and
