In 2022 the state of Utah introduced the Utah Consumer Privacy Act (“UCPA”), making Utah the fourth state to enact comprehensive consumer privacy legislation. The scope of the UCPA is narrower compared to other state privacy laws, due to several threshold requirements.
The UCPA gives consumers 4 rights:
- Right to access.
- Right to delete.
- Right to data portability
- Right to opt-out of the processing of the consumer’s personal data for the purposes of targeted advertising; or the sale of personal data.
In the UCPA the following definition of “sale” is being used: “the exchange of personal data for monetary consideration by a controller to a third party. If personal data is sold to a third party or used for targeted advertising, the controller must “clearly and conspicuously disclose” the means for consumers to exercise their opt-out rights.
Controllers are obligated to respond to a consumer’s request within 45 days. When reasonably necessary, a controller may extend the response period by an additional 45 days, provided they “inform the consumer of the extension, including the length of the extension (and reasons for it),” within the initial 45-day response period. Controllers subject to the UCPA are not required to recognize universal opt-out signals as a method for consumers to exercise their opt-out rights.
The law does not grant Utah consumers the right to correct inaccuracies in their personal data.
