Laws
Utah Consumer Privacy Act (UCPA): what you can and can't make companies do
Quick answer
Utah's Consumer Privacy Act gives you less than Colorado's or Virginia's law if your goal is deletion. It covers only companies with at least $25 million in annual revenue that also handle a lot of personal data, and its deletion right reaches only data you gave the company yourself, not data it bought about you. You can still ask for access, a copy, a correction or deletion, and opt out of sales and targeted ads; the company has 45 days to act, and complaints go to the Utah Division of Consumer Protection.
All privacy laws“A consumer has the right to delete the consumer's personal data that the consumer provided to the controller.”
- Applies in
- Utah
- In force since
- Companies must answer within
- Within 45 days of receiving your request the company must act and tell you what it did. It can extend once by 45 days if that's reasonably necessary and it tells you the length and the reason before the first 45 days end (Utah Code § 13-61-203). The clock doesn't run if the company reasonably suspects fraud and can't confirm who you are. The UCPA doesn't require an appeal process.
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: le.utah.gov, dcp.utah.gov
Last verified against the official page:
Utah residents. The law applies to companies that do business in Utah or target Utahns, have annual revenue of $25 million or more, and either handle the personal data of 100,000 or more Utahns a year, or make over half their gross revenue from selling personal data and handle data on 25,000 or more. Government bodies, tribes, colleges, nonprofits, HIPAA covered entities, air carriers and financial institutions covered by the Gramm-Leach-Bliley Act are exempt, and so is data covered by the Fair Credit Reporting Act, FERPA, the Driver's Privacy Protection Act and employment data.
Your rights
-
Confirm and access
Ask a company whether it processes your personal data, and see that data (Utah Code § 13-61-201(1)).
-
Delete
Have a company delete personal data you provided to it. Data it got from other sources isn't covered (Utah Code § 13-61-201(2)).
-
Get a portable copy
If the processing is automated, get a copy of the data you gave the company in a portable, readily usable format (Utah Code § 13-61-201(3)).
-
Correct
Ask the company to fix inaccurate personal data. This right was added in 2025 (Utah Code § 13-61-201(4)).
-
Opt out
Stop the company using your data for targeted advertising or selling it. There's no right to opt out of profiling (Utah Code § 13-61-201(5)).
-
Notice before sensitive data is used
Before processing sensitive data about you, a company must give you clear notice and a chance to opt out. Unlike Virginia, Colorado or Indiana, Utah doesn't require your consent first (Utah Code § 13-61-302(3)).
General information, not legal advice.
How to use it
- 1
Check that the company is covered
The UCPA only reaches companies with at least $25 million in annual revenue that also meet a data threshold. A small local business or a nonprofit is outside it.
- 2
Send a request the way the company asks
Use the request method the company sets out, usually in its privacy notice, and say which right you're using. A parent or legal guardian can send a request for a known child. For data a company bought about you, ask it to stop selling your data, since deletion only covers what you gave it.
- 3
Wait up to 45 days
The company has 45 days to act and tell you what it did, plus one 45-day extension if it tells you why. Your first request in a 12-month period is free; the company can charge for a second one in that period.
- 4
Ask the company to reconsider
Utah's law doesn't require an appeal process. If the company offers one, use it and keep a copy of every reply. If it doesn't, go straight to the next step.
- 5
Complain to the Division of Consumer Protection
The Utah Division of Consumer Protection takes UCPA complaints on its UCPA page and can refer a case to the Attorney General, who enforces the law. You can't sue a company under the UCPA yourself.
No answer in time? Complain to Utah Division of Consumer Protection (complaints) and Utah Attorney General (enforcement) .
Who has to follow the UCPA
Utah set the bar high. A company has to make at least $25 million a year and also handle the data of 100,000 or more Utahns, or handle data on 25,000 or more while making over half its revenue from selling personal data. Both tests apply, so a small data broker with modest revenue can fall outside the law entirely.
Why deletion is weak here
The deletion right covers only "personal data that the consumer provided to the controller". If a company bought your name and home address from somewhere else, the UCPA doesn't make it delete them. That's the big gap. Virginia's version also reaches data a company obtained about you, and so do Indiana's and Montana's.
What you can do about bought data is opt out of its sale and of targeted advertising. That stops the company passing it on, though the data stays on its servers.
Other gaps worth knowing: no right to opt out of profiling, no required appeal process, and no rule that companies honor Global Privacy Control. For sensitive data, Utah only requires notice and a chance to opt out, where Virginia and Colorado require your consent first.
Why a company can say no
Beyond the size test, the law leaves out government bodies and nonprofits. Colleges are out too, along with HIPAA covered entities and financial institutions covered by the Gramm-Leach-Bliley Act (GLBA). So is data covered by the Fair Credit Reporting Act (credit reports), FERPA (school records) and the Driver's Privacy Protection Act.
If a company says no, ask it to name the exemption, then complain to the Division if you think it's wrong. Our guide on what to do when a company won't delete your data covers other routes.
Where Serus fits
Utah's law won't make most data brokers delete what they bought about you, so a direct opt-out with each site is often the only route. Serus finds the data brokers and people-search sites that list you where you live, sends the opt-out requests for you. Then it checks if you get listed again. You can do it yourself too, one site at a time, for free.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Can I make a company delete data it bought about me under Utah law?
Not under the UCPA's deletion right, which only covers personal data you provided to the company. You can opt out of the sale of your data and of targeted advertising.
Do I get to appeal a denial?
The UCPA doesn't require companies to offer an appeal. Complaints go to the Utah Division of Consumer Protection.
Is there a fee?
Your first request in a 12-month period is free. A company can charge for later requests in that period, and can charge for or refuse requests that are excessive, harassing or manifestly unfounded.
Do companies in Utah have to honor Global Privacy Control?
No. The UCPA doesn't require companies to honor browser opt-out signals such as Global Privacy Control.
Can I sue under the UCPA?
No. A violation doesn't give you a right to sue. The Attorney General enforces the law after a referral from the Division, with a 30-day cure period and penalties of up to $7,500 per violation plus actual damages.
Sources
Something wrong or out of date? Tell us and we'll re-check it.