Utah Department of Technology Services (DTS) establishes accessibility standards for state agency websites and applications.
Utah Accessibility & Privacy Laws
Utah enacted the Utah Consumer Privacy Act (UCPA) in 2022, making it one of the early states with comprehensive consumer privacy legislation. Effective December 31, 2023, UCPA is considered more business-friendly than other state privacy laws while still providing meaningful consumer protections. Utah also maintains accessibility requirements for state government digital services.
→
Accessibility Standards
DTS Requirements
→
Privacy Law
UCPA - Effective Dec 2023
Business-friendly privacy law with higher thresholds and no private right of action, focused on transparency and consumer choice.
Utah Consumer Privacy Act (UCPA)
Utah's UCPA (SB 227) was signed into law on March 24, 2022, and became effective December 31, 2023. It is considered the most business-friendly comprehensive state privacy law, with narrower definitions and higher thresholds than California, Virginia, or Colorado.
Who Must Comply?
Businesses that conduct business in Utah or target Utah residents AND meet ALL of these criteria:
- Annual revenue of $25 million or more, AND
- Control or process personal data of 100,000+ Utah consumers annually, OR
- Derive over 50% of gross revenue from the sale of personal data and control or process data of 25,000+ consumers
Consumer Rights Under UCPA
| Right | Description |
|---|---|
| Right to Access | Confirm whether data is being processed and access that data |
| Right to Delete | Delete personal data provided by the consumer |
| Right to Portability | Obtain a copy of data in portable, readily usable format |
| Right to Opt Out of Sales | Opt out of sale of personal data |
| Right to Opt Out of Targeted Advertising | Opt out of processing for targeted advertising purposes |
Key Differences from Other State Laws
- No Right to Correct: UCPA does not include a consumer right to correct inaccurate data
- No Right to Appeal: Unlike other states, consumers cannot appeal denied requests
- Narrower Opt-Out: Opt-out applies only to sales and targeted advertising, not profiling
- Revenue Requirement: Both revenue AND data thresholds must be met
- No Data Protection Assessments: Businesses are not required to conduct data protection assessments
Sensitive Data
UCPA requires opt-in consent before processing sensitive personal data, including:
- Racial or ethnic origin
- Religious beliefs
- Sexual orientation
- Citizenship or immigration status
- Genetic or biometric data for identification
- Personal data from known children
- Precise geolocation data
Utah State Government Accessibility
Utah's Department of Technology Services (DTS) establishes accessibility policies and standards for state agencies. All Utah state government websites are expected to meet accessibility requirements under state policy and federal ADA obligations.
Covered Entities
- Utah state government agencies
- State contractors and IT vendors
- Public educational institutions
- Utah System of Higher Education
- Local government entities
Accessibility Standards
- WCAG 2.0 Level AA compliance as baseline standard
- Section 508 alignment for federally-funded programs
- DTS accessibility guidelines for state procurement
- Alternative formats required upon request
Enforcement
| Aspect | Details |
|---|---|
| Enforcing Authority | Utah Attorney General, Division of Consumer Protection (exclusive enforcement) |
| Cure Period | 30 days to cure violations |
| Penalties | Up to $7,500 per violation |
| Private Right of Action | No private right of action |
→
Business Obligations
- Publish clear privacy notice
- Implement reasonable data security practices
- Provide methods for consumer requests
- Respond to requests within 45 days
- Limit data collection to disclosed purposes
- Obtain consent for sensitive data
→
Key Agencies
- Utah Attorney General
- Division of Consumer Protection
- Department of Technology Services (DTS)
- Utah Antidiscrimination and Labor Division
Related Resources
- US Privacy Laws Overview
- State Privacy Law Comparison
- Business Privacy Obligations
- Consumer Privacy Rights
- ADA Title II Requirements
- All State Laws
- Contact Us
Need Help with Utah Compliance?
Utah's UCPA is now in effect with its unique business-friendly provisions. Contact our experts for guidance on navigating UCPA's specific requirements and ensuring both privacy and accessibility compliance.