Utah Consumer Privacy Act (UCPA)
The Utah Consumer Privacy Act (UCPA), effective December 31, 2023, gives Utah consumers rights to access, delete, and obtain a copy of their data, and to opt out of targeted advertising and the sale of personal data. It is widely seen as the most business-leaning of the US state laws — for example it does not provide a right to correct. Analytics tied to targeted advertising or sale is the main contact point. This is educational, not legal advice.
What this means
The UCPA applies to certain businesses processing the personal data of Utah residents above defined thresholds. It grants consumers rights to confirm and access their data, delete data they provided, obtain a portable copy, and opt out of targeted advertising and the sale of personal data. It uses a controller/processor framing similar to other US state laws and excludes data covered by some federal regimes.
How it differs and touches analytics
The UCPA is generally regarded as the most business-friendly state privacy law: it relies on opt-out rather than opt-in for most processing, does not grant a right to correct, and frames sensitive-data handling around an opportunity to opt out rather than prior consent. For analytics, the practical question is whether identifiers flow into targeted advertising or a sale; first-party measurement that stays in-house is far from those triggers. Specifics vary, so consult counsel.
- Access, delete, portability, and opt-out rights
- Opt-out of targeted advertising and sale
- No right to correct; business-leaning structure
How it appears in analytics and logs
If analytics shares Utah residents' personal data for targeted advertising or sale, the UCPA's opt-out rights apply to that processing.
Diagnostic use case
Check whether analytics feeds targeted advertising or sale of Utah residents' data, since the UCPA gives those residents an opt-out of both.
What WebmasterID can help detect
WebmasterID is first-party and does not share identifiers for targeted advertising or sale, the activities the UCPA's opt-out rights focus on.
Common mistakes
- Assuming the UCPA mirrors California's opt-in-heavy approach.
- Expecting a right to correct that the UCPA does not grant.
- Overlooking targeted-advertising opt-out for ad-linked analytics.
Privacy and accuracy notes
This page is educational, not legal advice. First-party, non-shared analytics keeps you away from the UCPA's targeted-advertising and sale opt-outs.
Related pages
- US state privacy laws overview
In the absence of a single federal privacy statute, several US states have enacted comprehensive consumer privacy laws with overlapping but non-identical rules. Most grant access, deletion, and correction rights and require opt-outs for targeted advertising and 'sale'. This page gives an educational overview of the common pattern and how it touches analytics.
- Do Not Sell or Share my personal information
Under California's CCPA as amended by the CPRA, consumers can direct a business not to sell or share their personal information, where 'sharing' specifically covers disclosure for cross-context behavioural advertising. Businesses must offer a clear opt-out and honour opt-out signals. This page explains the right and how analytics and ad tags can fall within 'sharing'.
- Texas Data Privacy and Security Act
The Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, gives Texas residents rights to access, correct, delete, and obtain a copy of their personal data, plus an opt-out of targeted advertising, sale, and certain profiling. Unusually it ties applicability to whether a business is a 'small business' (per the SBA) rather than a numeric record threshold. Ad-linked analytics is the main contact point. This is educational, not legal advice.
- Privacy-first analytics
First-party measurement avoids targeted-ad and sale triggers.
Sources and verification notes
- Utah Legislature — Consumer Privacy Act (Title 13, Chapter 61)Official statute text. Educational, not legal advice.
Last reviewed 2026-06-24. Facts are checked against primary/official sources where available; uncertain specifics are marked “Data not yet verified” rather than guessed.