iQ Cookie State Law Series
Cookie & Privacy Law in Utah
Educational purposes only — not legal advice. This guide is intended to help you understand Utah’s data privacy law as it relates to cookie consent and website compliance. Laws change, and your specific situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
Utah’s UCPA has been in effect since December 31, 2023, and it is widely considered the most business-friendly comprehensive privacy law in the country. A genuine $25 million revenue floor, combined with higher consumer-count thresholds and a noticeably smaller set of consumer rights, means fewer businesses fall in scope and those that do face lighter obligations than almost anywhere else in this series.
Utah does not have a separate cookie law. Cookie compliance flows from the UCPA itself — its opt-out and sensitive-data rules apply directly to cookies and tracking technology.
Who does it apply to?
The UCPA covers for-profit businesses that conduct business in Utah or target Utah residents, have at least $25 million in annual revenue, AND meet at least one of these thresholds:
Controls or processes personal data of 100,000 or more Utah consumers during a calendar year.
Controls or processes data of 25,000 or more consumers AND derives more than 50% of gross revenue from selling personal data.
Nonprofits, higher-education institutions, GLBA financial institutions, HIPAA-covered health records, and employment/B2B data are exempt.
Consumer rights
Utah residents whose data is covered by the UCPA have a deliberately smaller rights set than most peer states:
Confirmed omissions: no right to correct inaccurate data, and no right to opt out of profiling — deliberate departures from the Virginia-model template most other states follow. Businesses must respond within 45 days, extendable once by 45 more. There is no private right of action.
What makes Utah different
A real $25 million revenue floor. Most peer states use consumer-count thresholds alone. Utah requires that revenue floor on top of the usual consumer/sale-percentage tests, meaningfully shrinking the pool of covered businesses compared to California or Virginia-model states without one.
No right to correct. Utah is one of the few states in this series that never gave consumers a correction right at all — not removed later, simply never included in the original statute.
No profiling opt-out. Consumers can opt out of sale and targeted advertising, but there is no equivalent right for automated profiling with legal or similarly significant effects — a rights category present in most other states covered so far.
No GPC requirement. Utah is one of the seven comprehensive-privacy-law states that does not mandate recognition of Global Privacy Control or any universal opt-out mechanism.
Sensitive data uses notice-and-opt-out, not opt-in consent. Where most peer states require affirmative opt-in before processing sensitive data, Utah allows processing with clear notice and an opportunity to opt out — a lighter standard than the opt-in-first approach used elsewhere in this series.
Sensitive data & children
Processing sensitive data requires clear notice and an opportunity to opt out. Sensitive data includes:
The UCPA requires parental consent for processing known children’s data, generally aligning with COPPA standards for children under 13. Check current statute text for the full minors’ provisions, which are lighter than several peer states covered in this series.
What this means for your cookies
| Cookie / data type | Requirement | What to do |
|---|---|---|
| Sensitive data cookies (health, biometric, geolocation) | Notice + opt-out | Provide clear notice; honor opt-out requests — opt-in is not required. |
| Sale / targeted advertising cookies | Opt-out required | Provide a clear opt-out mechanism. |
| GPC / universal opt-out signals | Not required | No mandatory GPC recognition under this law. |
| Profiling cookies | No opt-out right | No statutory profiling opt-out to build for under the UCPA. |
| Any cookies — known children | Parental consent | COPPA-aligned consent for known children’s data. |
Enforcement
The Utah Attorney General and Division of Consumer Protection share enforcement authority, with penalties up to $7,500 per violation. The permanent 30-day cure period is one of the most durable in the series, reinforcing Utah’s reputation as the lightest-touch comprehensive privacy law currently in effect.
Your action checklist
Check the full threshold — revenue included. Even if you process data on 100,000+ Utah consumers, you are only in scope if you also clear $25 million in annual revenue.
Don’t over-build if Utah is your only exposure. If you operate only in Utah, you can skip building a correction workflow or profiling opt-out — but confirm that’s really your only exposure before skipping either.
Use notice-and-opt-out for sensitive data, not opt-in gating. Utah’s lighter standard means you don’t need affirmative consent before processing — just clear notice and a working opt-out.
Provide sale and targeted-ad opt-outs. These two rights remain mandatory even though several others were left out.
Update your privacy policy. Cover data categories, processing purposes, third-party recipients, and how to exercise the rights that do apply.
Review vendor contracts. Any processor handling Utah resident data must be covered by a written agreement specifying processing instructions and confidentiality obligations.
Remember: Utah rules are the floor, not the ceiling. If you operate in other states in this series, their broader rights sets still apply to those residents.
iQ Cookie scans your site for compliance gaps and deploys a lightweight US-built consent banner.
iQ Cookie State Law Series · Guide 21 of 25 · Next: Virginia →