# Utah — US state consumer data privacy laws: applicability thresholds by state

For Utah, law name and abbreviation is Utah Consumer Privacy Act (UCPA); effective date is December 31, 2023; consumer volume threshold is during a calendar year, controls or processes personal data of 100,000 or more consumers; revenue-from-data-sales threshold is derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers; revenue floor is has annual revenue of $25,000,000 or more, recorded from its source on 2026-08-12.

- **State:** Utah _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Utah Consumer Privacy Act (UCPA)
- **Effective date:** December 31, 2023
- **Consumer volume threshold:** during a calendar year, controls or processes personal data of 100,000 or more consumers _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers _(verified: appears in the quote below)_
- **Revenue floor:** has annual revenue of $25,000,000 or more _(verified: appears in the quote below)_
- **Threshold combination logic:** AND — requires annual revenue of $25,000,000 or more AND one of the volume thresholds _(verified: appears in the quote below)_
- **Key exemptions:** Governmental entities; tribes; institutions of higher education; nonprofit corporations; HIPAA-covered entities and business associates
- **Enforcement mechanism:** Attorney General; 30-day cure period; no private right of action
- **Statute citation:** Utah Code §§ 13-61-101 to 13-61-404
- **Notes:** Utah is the only state that requires BOTH a revenue threshold AND consumer volume — using AND logic rather than OR. A business must have $25M+ in annual revenue and also meet one of the two volume thresholds. This makes Utah's law the narrowest in scope among all state privacy laws.

## What the source says

> This chapter applies to any controller or processor who: (a) (i) conducts business in the state; or (ii) produces a product or service that is targeted to consumers who are residents of the state; (b) has annual revenue of $25,000,000 or more; and (c) satisfies one or more of the following thresholds: (i) during a calendar year, controls or processes personal data of 100,000 or more consumers; or (ii) derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.

## Source

- https://le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.pdf

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).