{ "jurisdiction_id": "US-UT", "jurisdiction": "United States – Utah", "url": "https://dataprotection.gi/jurisdictions/united-states-utah/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 43, "sub_modules": 57, "source_register": 46 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Core statute is in force, regulator identity and enforcement pathway are clearly documented and confirmed via primary regulator homepage and secondary legal-analysis sources.", "claims": [ { "statement": "The UCPA tasks the Division of Consumer Protection with administering a consumer-complaint system and investigating potential violations, with mandatory referral to the Attorney General where substantial evidence of a violation exists; the Attorney General holds exclusive enforcement authority.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Governor Spencer Cox signed the Utah Consumer Privacy Act (SB 227) into law on 24 March 2022, making Utah the fourth U.S. state to enact comprehensive consumer-privacy legislation, effective 31 December 2023.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/utah-governor-signs-utah-consumer-privacy-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA applies to controllers/processors conducting business in Utah or targeting Utah residents with at least $25 million in annual revenue that either control/process personal data of 100,000+ consumers, or derive over 50% of gross revenue from personal-data sales and control/process data of 25,000+ consumers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-passes-consumer-privacy-act/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA exempts governmental entities and their contractors, institutions of higher education, nonprofit corporations, HIPAA-covered entities/business associates, and GLBA-regulated financial institutions, and excludes employment-context data and data governed by several named federal statutes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA applies to any controller or processor that conducts business in Utah or produces a product or service targeted to Utah residents, irrespective of the entity's place of establishment.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "A functioning notice/opt-out framework exists but lacks opt-in consent for sensitive categories, which is the norm among most peer state laws.", "claims": [ { "statement": "Unlike the EU GDPR's enumerated lawful-basis model, the UCPA does not require a specific legal basis for general processing of personal data, relying instead on notice-and-opt-out rights for targeted advertising, sale, and sensitive-data processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Processing personal data of consumers known to be under age 13 requires verifiable parental consent consistent with COPPA; this is the only UCPA-regulated activity requiring affirmative opt-in consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA does not require opt-in consent for processing sensitive data; controllers must instead provide clear notice and an opportunity to opt out before processing sensitive data, a lighter standard than Iowa aside, most WPA-model peer states.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Utah's genetic-privacy framework requires notice and a right to opt out for genetic-data processing, treating genetic information as a distinct sensitive category alongside the UCPA's general sensitive-data provisions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/privacy-laws-ethics-and-the-conundrum-of-dna-2", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consistent with Colorado, Connecticut and Virginia, Utah's opt-out rights for sale/targeted-advertising extend to pseudonymous data, unlike Iowa's narrower approach which excludes pseudonymous data from opt-out coverage.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Core access/deletion/portability rights are confirmed in force, but the absence of correction and profiling opt-out rights represents a material gap relative to peer state laws.", "claims": [ { "statement": "The UCPA establishes new consumer rights including the right of access, deletion, and portability, and the right to opt out of targeted advertising or the sale of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/utah-governor-signs-utah-consumer-privacy-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Notably absent from the UCPA is a right to correct inaccuracies in personal data, distinguishing it from California, Virginia and Colorado's comprehensive privacy laws.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA provides consumers the right to opt out of processing for targeted advertising and sale of personal data, but the right to opt out of profiling is absent, and controllers are not required to recognize universal opt-out signals.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA establishes a consumer right to data portability.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/utah-governor-signs-utah-consumer-privacy-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers must act on and inform consumers of the outcome of a rights request within 45 days, extendable once for a further 45 days if reasonably necessary, and generally may not charge a fee for the initial request.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/utah-utah-consumer-privacy-act-%E2%80%93-what-you-need-know", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Security and breach-notification duties are confirmed and in force, but accountability tooling (DPIA, DPO, ROPA) that is standard among peer comprehensive privacy laws is absent from the UCPA.", "claims": [ { "statement": "The UCPA does not expressly provide for data protection or privacy impact assessment requirements.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/utah-ucpa-faqs", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "As with the CCPA, VCDPA and CPA, UCPA controllers must establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Utah lawmakers updated the Utah Protection of Personal Information Act and the Utah Technology Governance Act with amendments including data-breach notification requirements intended to coordinate state, local and federal cybersecurity efforts.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/b/utah-revises-data-breach-notification-privacy-law", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A 2019 amendment (SB 193) to Utah's breach-notification law permits civil penalties greater than $100,000 for breaches affecting 10,000 or more consumers and establishes five-year (civil) and ten-year (administrative) statutes of limitation for violations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/utah-governor-signs-data-breach-notification-amendment-bill-law", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No comprehensive cross-border transfer regime exists at the Utah state level; this is a legitimate 'no regime' finding rather than a research gap.", "claims": [ { "statement": "State comprehensive consumer-privacy statutes generally impose obligations that revolve around privacy notices, data minimization and purpose limitation, sensitive personal information, data protection assessments, and universal opt-out mechanisms, rather than cross-border transfer regulation.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-laws-overview", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "green", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Sectoral carve-outs are clearly and consistently documented across primary and secondary sources for the major federal overlays.", "claims": [ { "statement": "The UCPA exempts financial institutions and data subject to Title V of the Gramm-Leach-Bliley Act of 1999 from its scope.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/utah-ucpa-faqs", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA exempts HIPAA-covered entities and business associates, and excludes protected health information and related health-context data from its scope.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/utah-ucpa-faqs", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Data processed or maintained in the course of employment, including job applicant data, is exempt from UCPA coverage.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA excludes information subject to the federal Fair Credit Reporting Act from its material scope.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA exempts institutions of higher education and excludes data subject to the federal Family Educational Rights and Privacy Act (FERPA) from its scope.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Utah's Genetic Testing Privacy Act restricts insurers from requesting, requiring, or otherwise considering genetic test results of an asymptomatic individual or blood relative for underwriting purposes, subject to enumerated exceptions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "State of Utah / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/utah_genetic_testing.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Where a controller sells personal data to third parties or engages in targeted advertising, the UCPA requires clear and conspicuous disclosure of the means for consumers to opt out, functioning as Utah's principal mechanism for regulating tracking-based advertising in lieu of a dedicated ePrivacy-style consent regime.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/utah-utah-consumer-privacy-act-%E2%80%93-what-you-need-know", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "A functioning opt-out mechanism exists but is narrower than peer-state frameworks on signal recognition, dark patterns, and sale definition breadth.", "claims": [ { "statement": "Unlike the Colorado Privacy Act, controllers subject to the UCPA are not required to recognize universal opt-out signals as a method for consumers to exercise their opt-out rights.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA contains a VCDPA-like definition of 'sale' limited to exchanges of personal data for monetary consideration, narrower than the CCPA/CPA definitions covering monetary or other valuable consideration.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have the right to opt out of processing of personal data for targeted-advertising purposes under the UCPA, serving as Utah's principal statutory lever over direct-marketing-adjacent data use.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "AI-specific legislation exists and is in force, but ADM transparency, profiling opt-out, and dedicated biometric protections are largely absent.", "claims": [ { "statement": "Unlike the VCDPA and CPA, the right to opt out of profiling is absent from the UCPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Utah's Artificial Intelligence Policy Act (2024) takes a simpler approach than risk-based AI statutes by clarifying that existing consumer-protection laws apply to generative AI, focused on defining and prohibiting the most harmful uses of AI rather than mandating formal risk assessments.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-brings-gen-ai-into-consumer-protection-realm-with-bill-passage", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Biometric data is understood to fall within the UCPA's general 'sensitive data' category, subject to the Act's notice-and-opt-out (rather than opt-in consent) regime, in the absence of a dedicated Utah biometric-specific statute analogous to Illinois' BIPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Utah's Genetic Testing Privacy Act (Utah Code Title 26, Chapter 45) restricts insurer requests for, or consideration of, genetic test results of asymptomatic individuals or their blood relatives.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "State of Utah / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/utah_genetic_testing.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA does not apply to government entities or third parties under contract with a government entity acting on that entity's behalf, providing a blanket carve-out from the state's consumer-privacy framework for government-related processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "COPPA-aligned parental-consent baseline is solid, but the flagship minors' social-media protection is under active, unresolved federal litigation, materially weakening current enforceability.", "claims": [ { "statement": "Controllers processing the personal data of consumers known to be under the age of 13 are required to obtain verifiable parental consent and process such data in accordance with COPPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Utah repealed the Social Media Regulation Act in the face of technology-industry lawsuits and replaced it with the Minor Protection in Social Media Act (SB 194/HB 464), addressing algorithmic harms to minors; a federal district court partially enjoined the successor act's provisions in early September 2024 on First Amendment grounds.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/retrospective-2024-in-state-sectoral-privacy-law-and-ai-law", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Utah's replacement social-media law allows for a private right of action for minors whose mental health has been harmed by a social-media algorithm, one of the few private-right-of-action mechanisms in Utah's broader privacy/consumer-protection framework.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/b/utah-repeals-replaces-social-media-law", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA excludes data subject to FERPA and exempts institutions of higher education, leaving federal education-privacy law as the operative regime for education-sector data not otherwise covered by Utah-specific minors' legislation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-utah/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement powers and penalty ceilings are clearly defined and in force, but observable enforcement activity specific to Utah is low/opaque, and structural redress avenues for consumers (private right of action, collective redress) are largely foreclosed.", "claims": [ { "statement": "The Utah Attorney General must provide 30 days' written notice of alleged UCPA violations before initiating enforcement, and may seek an injunction and civil penalties of up to $7,500 per violation if the controller/processor fails to cure.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/utah-ucpa-faqs", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "As of 2024, most U.S. state comprehensive privacy laws remained in non-public 'right to cure' enforcement phases, with only two final public state-comprehensive-privacy enforcement actions recorded that year, both brought by California's Attorney General.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/retrospective-2024-in-comprehensive-state-data-privacy-law", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA does not allow a consumer to use a violation of the Act to support a claim under other Utah laws, limiting indirect collective-redress pathways.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/utah-becomes-fourth-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The UCPA does not provide consumers with a private right of action; the Utah Attorney General has exclusive authority to enforce its provisions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/utah-utah-consumer-privacy-act-%E2%80%93-what-you-need-know", "source_tier": null, "observed_at": "2026-08-06" } ] } ] }