Utah (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Utah Consumer Privacy Act (UCPA) | Utah Code Title 13, Chapter 61 | In force | 31 December 2023 |
| Protection of Personal Information Act | Utah Code Title 13, Chapter 44 | In force | 1 January 2007 |
| Utah Commercial Email Act | Utah Code Title 13, Chapter 65 | In force | 3 May 2023 |
| Generative Artificial Intelligence, Consumer Disclosures and Enforcement | Utah Code Title 13, Chapter 77 | In force | 7 May 2025 |
| Artificial Intelligence Policy Act | Utah Code Title 13, Chapter 72 | In force | 1 May 2024 |
| Artificial Intelligence Applications Relating to Mental Health | Utah Code Title 13, Chapter 72a | In force | 7 May 2025 |
| Digital Voyeurism Prevention Act | Utah Code Title 13, Chapter 72b | Enacted, not yet in force | 1 January 2027 |
| Digital Content Provenance Standards Act | Utah Code Title 13, Chapter 72c | Enacted, not yet in force | 1 January 2027 |
| App Store Accountability Act | Utah Code Title 13, Chapter 76 | In force | 7 May 2025 |
| Utah Digital Choice Act | Utah Code Title 13, Chapter 81 | In force | 1 July 2026 |
| Utah Minor Protection in Social Media Act | Utah Code Title 13, Chapter 71 | In force | 1 October 2024 |
- Utah Consumer Privacy Act (UCPA): A right to correct was added from 1 July 2026. A new Part 5 on motor vehicle data starts on 1 January 2027.
- Protection of Personal Information Act: Data security and breach notification. In force from 1 January 2007 under § 7 of 2006 S.B. 69 (Laws of Utah 2006, ch. 343), which enacted it as chapter 13-42; it is now chapter 13-44.
- Artificial Intelligence Policy Act: Creates the Office of Artificial Intelligence Policy, a learning laboratory and regulatory mitigation agreements. Scheduled for repeal on 1 July 2027 (Utah Code 63I-2-213).
- Artificial Intelligence Applications Relating to Mental Health: Suppliers of mental health chatbots can’t sell or share Utah users’ health information or inputs (with narrow exceptions), must label ads and can’t use inputs to target them, and must say the chatbot is AI before use, after 7 days without use and when asked. Fines are up to $2,500 per violation.
- Digital Voyeurism Prevention Act: Enacted by Laws of Utah 2026, ch. 352. AI image services can’t distribute fake intimate images of an identifiable person without verified consent kept on record for 7 years, and people harmed can sue; a safe harbour protects services with published policies and safeguards. Covered platforms must remove reported images within 48 hours.
- Digital Content Provenance Standards Act: Generative AI providers with over 1 million monthly users must embed provenance disclosures in AI images, video and audio. Large online platforms (over 2 million monthly users) must detect and show provenance data and not strip it, and capture devices sold from 1 January 2028 must embed it. Fines are up to $2,500 per violation.
- App Store Accountability Act: After 2026 amendments, the developer duties and private lawsuits start on 6 May 2027. Only harmed minors or their parents can sue, for actual damages or $1,000 per violation, whichever is greater, and developers that rely in good faith on app store data have a safe harbour.
- Utah Digital Choice Act: Data portability and interoperability for social media services.
- Utah Minor Protection in Social Media Act: A federal court has barred enforcement of any part of it since 10 September 2024, and the appeal is pending (see children).
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses that operate in Utah or target its residents, have annual revenue of $25 million or more, and either process data of 100,000 or more consumers a year or get over half their revenue from selling data of 25,000 or more. Government, tribes, universities, non-profits, HIPAA covered entities and GLBA financial institutions are exempt. Employees and B2B contacts aren’t consumers. From 1 January 2027 it also covers car makers that collect data through vehicles.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61-S102_2024050120240501.html · le.utah.gov/xcode/Title13/Chapter61/C13-61-S102_2026050620270101.html · le.utah.gov/xcode/Title13/Chapter61/C13-61-S101_2026050620260506.html
Lawful bases
Section titled “Lawful bases”There are no GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, delete data the consumer provided, port data, correct it (since 1 July 2026), and opt out of targeted advertising and sale. There’s no profiling opt-out. Sensitive data needs clear notice and a chance to opt out, rather than opt-in consent; a known child’s data follows COPPA.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html · le.utah.gov/xcode/Title13/Chapter61/C13-61-S302_2022050420231231.html
Consent age for online services
Section titled “Consent age for online services”A child is under 13, and a known child’s data must be processed under COPPA, with verifiable parental consent. The UCPA has no teen opt-in rule for targeted advertising or sale.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61-S101_2026050620260506.html · le.utah.gov/xcode/Title13/Chapter61/C13-61-S302_2022050420231231.html
Children
Section titled “Children”The Minor Protection in Social Media Act requires age assurance and maximum-privacy defaults for minors’ accounts, but in September 2024 a federal court barred Utah from enforcing any part of it. The appeal (10th Cir. No. 24-4100) was argued on 20 November 2025, with no decision as of 5 November 2026. From 6 May 2027, the App Store Accountability Act requires app developers to check app store age categories and parental consent, use them only for safety and compliance, and not enforce terms against minors without that consent; harmed minors or parents can sue.
Sources: le.utah.gov/xcode/Title13/Chapter71/C13-71-S202_2024100120240501.html · govinfo.gov/content/pkg/USCOURTS-utd-2_23-cv-00911/pdf/USCOURTS-utd-2… · ca10.uscourts.gov/oralargument/search-results · ca10.uscourts.gov/opinion/search · le.utah.gov/xcode/Title13/Chapter76/C13-76-S202_2026031820260318.html · le.utah.gov/xcode/Title13/Chapter76/C13-76-S401_2026031820260318.html
Cookies and similar technologies
Section titled “Cookies and similar technologies”There’s no cookie-consent rule. Consumers can opt out of targeted advertising and sale, and a controller that does either must clearly explain how. The UCPA doesn’t require honouring a universal opt-out signal such as Global Privacy Control.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61-S302_2022050420231231.html · le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html
Electronic marketing
Section titled “Electronic marketing”On top of CAN-SPAM and the TCPA, Utah’s Commercial Email Act bars commercial email sent from or to Utah that misuses a third party’s domain, forges headers or has a misleading subject line; providers and recipients can sue for $1,000 per email ($100 with due diligence). Autodialed sales calls need consent or an existing relationship, calls to Utah numbers on the national Do Not Call Registry are banned, and calls from 9pm to 8am, on Sundays or on holidays need consent, with private suits for at least $500. Unless exempt, telemarketing sellers must register yearly and post a bond.
Sources: le.utah.gov/xcode/Title13/Chapter65/C13-65-S201_2024050120240501.html · le.utah.gov/xcode/Title13/Chapter65/C13-65-S202_2023050320230503.html · le.utah.gov/xcode/Title13/Chapter25a/C13-25a-S103_2022050420220504.html · le.utah.gov/xcode/Title13/Chapter25a/C13-25a-S107_2021050520210505.html · le.utah.gov/xcode/Title13/Chapter25a/C13-25a-S108_2020051220200512.html · le.utah.gov/xcode/Title13/Chapter26/C13-26-S102_2026050620260506.html
Breach notification
Section titled “Breach notification”After a breach, investigate promptly. If misuse for identity theft or fraud has happened or is likely, notify affected Utah residents in the most expedient time possible without unreasonable delay. If 500 or more residents are affected, also notify the Attorney General and the Utah Cyber Center, and the nationwide credit bureaus if 1,000 or more. Fines are up to $2,500 per consumer and $100,000 in total in most cases.
Sources: le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html · le.utah.gov/xcode/Title13/Chapter44/C13-44-S301_2025050720250507.html · le.utah.gov/~2006/bills/sbillenr/SB0069.pdf
Registration and fees
Section titled “Registration and fees”The UCPA requires no registration or fee.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.html
Data protection officer
Section titled “Data protection officer”There’s no requirement to appoint a data protection officer.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.html
International transfers
Section titled “International transfers”Utah law sets no restrictions on transferring personal data abroad; federal rules are in us-federal.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.html
Impact assessments
Section titled “Impact assessments”The UCPA doesn’t require data protection assessments.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.html
Automated decisions and AI
Section titled “Automated decisions and AI”The UCPA has no right to opt out of profiling. If a consumer clearly asks, a business using generative AI must say they’re talking to AI, and licensed professionals must disclose it upfront in high-risk interactions (clear disclosure throughout is a safe harbour); fines are up to $2,500 per violation. Since 7 May 2025, mental health chatbots must disclose they’re AI and protect users’ health data and inputs. From 1 January 2027, AI image services need consent for intimate images and large generative AI providers must embed provenance data. The AI Policy Act is repealed on 1 July 2027.
Sources: le.utah.gov/xcode/Title13/Chapter77/C13-77-S103_2025050720250507.html · le.utah.gov/xcode/Title13/Chapter77/C13-77-S104_2025050720250507.html · le.utah.gov/xcode/Title13/Chapter77/C13-77-S105_2025050720250507.html · le.utah.gov/xcode/Title13/Chapter72a/C13-72a-S201_2025050720250507.html · le.utah.gov/xcode/Title13/Chapter72a/C13-72a-S203_2025050720250507.html · le.utah.gov/xcode/Title13/Chapter72b/C13-72b-S201_2026050620270101.html · le.utah.gov/xcode/Title13/Chapter72c/C13-72c-S203_2026050620270101.html · le.utah.gov/xcode/Title13/Chapter72/C13-72-S201_2026050620260506.html
Penalties
Section titled “Penalties”The Division of Consumer Protection takes complaints and refers cases, and the Attorney General enforces alone. Before suing, the Attorney General must give 30 days’ notice to cure, and this right to cure doesn’t expire. Penalties are up to $7,500 per violation plus actual damages to consumers. There’s no private right of action.
Sources: le.utah.gov/xcode/Title13/Chapter61/C13-61-S402_2022050420231231.html · le.utah.gov/xcode/Title13/Chapter61/C13-61-S305_2022050420231231.html
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-ut.yaml.