Utah
For Utah, law name and abbreviation is Utah Consumer Privacy Act (UCPA); effective date is December 31, 2023; consumer volume threshold is during a calendar year, controls or processes personal data of 100,000 or more consumers; revenue-from-data-sales threshold is derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers; revenue floor is has annual revenue of $25,000,000 or more, recorded from its source on 2026-08-12.
- State
- Utah our reading
- Law name and abbreviation
- Utah Consumer Privacy Act (UCPA)
- Effective date
- December 31, 2023
- Consumer volume threshold
- during a calendar year, controls or processes personal data of 100,000 or more consumers verified
- Revenue-from-data-sales threshold
- derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers verified
- Revenue floor
- has annual revenue of $25,000,000 or more verified
- Threshold combination logic
- AND — requires annual revenue of $25,000,000 or more AND one of the volume thresholds verified
- Key exemptions
- Governmental entities; tribes; institutions of higher education; nonprofit corporations; HIPAA-covered entities and business associates
- Enforcement mechanism
- Attorney General; 30-day cure period; no private right of action
- Statute citation
- Utah Code §§ 13-61-101 to 13-61-404
- Notes
- Utah is the only state that requires BOTH a revenue threshold AND consumer volume — using AND logic rather than OR. A business must have $25M+ in annual revenue and also meet one of the two volume thresholds. This makes Utah's law the narrowest in scope among all state privacy laws.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
This chapter applies to any controller or processor who: (a) (i) conducts business in the state; or (ii) produces a product or service that is targeted to consumers who are residents of the state; (b) has annual revenue of $25,000,000 or more; and (c) satisfies one or more of the following thresholds: (i) during a calendar year, controls or processes personal data of 100,000 or more consumers; or (ii) derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.
— le.utah.gov, retrieved 2026-08-12
Source
- le.utah.govhttps://le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.pdf