USA – UTAH Trends and Developments Contributed by: Clifford Blair, Kirton McConkie
Utah Privacy Law in 2026: A Practical and Strategic Guide for Businesses Utah privacy law has developed rapidly in recent years, but the Utah Consumer Privacy Act remains the foundation of the state’s comprehensive privacy framework. At the same time, the Utah Legislature has enacted additional statutes addressing artificial intelligence (AI), cybersecurity, social media govern - ance, electronic data access and digital identity infra - structure. For organisations operating in Utah or serving Utah residents, privacy compliance is no longer a discrete legal project but an ongoing regulatory responsibil - ity touching marketing, product design, information security, vendor management and customer service. With the 2026 state legislative session ongoing, further changes to Utah’s privacy law should be expected. Utah’s Place in the US Privacy Landscape When the Utah Consumer Privacy Act was signed on 24 March 2022, Utah became just the fourth US state to enact comprehensive consumer privacy legislation, following California, Colorado and Virginia. The Act entered into force on 31 December 2023. Utah adopted a pragmatic structure from the outset. Enforcement authority rests with the attorney general rather than private litigants and the statute avoids broad rule-making authority. Applicability thresholds are designed to focus on medium and large organisa - tions. While the Utah Consumer Privacy Act shares many similarities with Colorado and Virginia law, compliance requires careful analysis for organisations operating in multiple jurisdictions, as there are differ - ences. Scope of Application: Revenue and Data Thresholds The Utah Consumer Privacy Act applies to for-profit entities conducting business in Utah or targeting Utah residents that meet both a revenue and data-process - ing threshold. The statute applies to organisations with annual revenue exceeding USD25 million that either: • control or process personal data of 100,000 or more Utah consumers during a calendar year; or
• control or process personal data of 25,000 or more Utah consumers and derive more than 50% of gross revenue from the sale of personal data. Utah’s USD25 million revenue threshold is absolute. If it is not met, the statute does not apply, regard - less of consumer volume. This differs from California and Colorado, where revenue is not always a gating requirement. Exemptions apply to governmental entities, institu - tions of higher education, non-profit organisations, indigenous tribes, and personal data regulated under federal statutes such as the Health Insurance Port - ability and Accountability Act of 1996, the Gramm- Leach-Bliley Act of 1999 and the Fair Credit Reporting Act of 1970. Organisations that are uncertain about the applicability of the Utah Consumer Privacy Act should document their analysis of revenue calcula - tions, consumer counts and monetisation practices. Personal Data and Sensitive Data Personal data under the Utah Consumer Privacy Act includes information linked or reasonably linkable to an identifiable individual. This definition captures common business data, including: • names and contact details; • account credentials; • online identifiers and device information; • transaction histories; and • location data. The Act also defines sensitive data, including informa - tion revealing: • racial or ethnic origin; • religious beliefs; • sexual orientation; • citizenship or immigration status; • health conditions; • genetic or biometric data; and • precise geolocation. Before processing sensitive data, controllers must provide clear notice and an opportunity to opt out. Organisations should evaluate marketing tools, ana -
621 CHAMBERS.COM
Powered by FlippingBook