UCPA requirements
Utah's law, effective December 31, 2023, is the most business-friendly of the state statutes. It applies only to controllers with at least $25 million in annual revenue that also meet a consumer-volume threshold, and it allows sensitive data processing after notice and an opportunity to opt out rather than requiring opt-in consent. Consumers may opt out of targeted advertising and the sale of personal data. There is no requirement to honor browser-level opt-out signals and no private right of action. The Division of Consumer Protection investigates and refers matters to the Attorney General, with a permanent 30-day cure period and penalties of up to $7,500 per violation. Even under this lighter regime, the disclosure in the privacy notice has to match what the tags on the site actually do.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.