← ALL REGULATIONS
Utah Consumer Privacy Act cookie rules, and who they apply to.
The Utah Consumer Privacy Act is one of the lightest US state laws. It applies only to businesses with at least $25 million in revenue that also meet a data threshold, and it requires a way to opt out of targeted advertising and sale rather than opt-in consent.
UCPA at a glanceOpt-out allowed
- Applies to
- Controllers with $25 million+ in annual revenue that process data of 100,000+ Utah residents, or 25,000+ while earning over half their revenue from selling it
- In force
- 31 December 2023
- Enforced by
- Utah Attorney General, with the Division of Consumer Protection
- Penalties
- Up to $7,500 per violation, after a 30-day period to cure
WHAT UCPA REQUIRES
What Utah asks of a site that uses advertising cookies.
THE RULEAn opt-out of targeted advertising and saleConsumers can opt out of targeted advertising and the sale of their personal data.
WITH KATLAIn US State Laws (CCPA) mode, the banner’s main button is "Do Not Sell or Share My Personal Information", and the marketing category is labelled as the sale or sharing of personal information. The wording follows California’s law; there is no Utah-specific label.
THE RULENotice and an opt-out for sensitive dataSensitive data needs clear notice and an opportunity to opt out, rather than opt-in consent.
WITH KATLAThe CCPA mode’s opt-out covers the sale and sharing category. A site that wants more can run GDPR mode, which asks before anything non-essential is set.
THE RULEA privacy noticeThe notice must say what is collected and why, what is shared, and how to opt out.
WITH KATLAKatla generates the cookie policy from the scan, with CCPA disclosures in CCPA mode. Utah-specific wording is not generated, so check the notice against the Act.
THE RULEOpt-out signals are not requiredUtah does not require honouring opt-out preference signals such as Global Privacy Control.
WITH KATLAKatla honours them anyway. Katla honours Global Privacy Control: a visitor whose browser sends it is recorded as opted out, unless they have already made a choice.
UCPA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Who does the Utah Consumer Privacy Act apply to?
- Controllers with at least $25 million in annual revenue that also process the personal data of 100,000 Utah residents a year, or of 25,000 while earning more than half their revenue from selling it.
- Does Utah require honouring Global Privacy Control?
- No. Utah’s Act does not require honouring opt-out preference signals.
- Is there a cure period?
- Yes. The Attorney General must give notice and 30 days to cure before taking action.
- Can consumers sue?
- No. There is no private right of action; the Attorney General enforces the Act.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.