Utah is now the Fourth State to Pass a Consumer Privacy Law

Utah passed the Consumer Privacy Act (“UCPA”) this month, which will take effect on December 31, 2023. With the passing of this new law, Utah becomes the fourth state to enact a consumer data privacy law. The UCPA requires a business to meet both a financial threshold as well as a data volume threshold and as such, will likely to apply to many fewer businesses than other states. The law applies to businesses that: (a) conduct business in Utah or produce products or services targeted to Utah residents; (b) have annual revenues of $25 million or more; and (c) either: (i) process personal data of 100,000 or more Utah residents; or (ii) derive more than 50 percent of their gross revenue from the sale of personal data and control or process the personal data of 25,000 or more Utah consumers. To the extent the business meets both of these of these thresholds, then they are a “Controller” of the data. The law exempts personal data generated within an employment, commercial, and business to business context.