Utah Consumer Privacy Act compliance
In Utah, only the ad trackers have to stop.
Utah’s privacy law asks for less than California’s. Visitors can opt out of targeted advertising and the sale of their data, and ConsentBit blocks the Marketing scripts behind that choice while analytics keeps working, which is all Utah’s law covers.
Key facts
Utah’s privacy law, lighter than California, Colorado, Connecticut and Virginia.
The Utah Consumer Privacy Act (UCPA) protects the personal data of Utah residents. It only applies to businesses with $25 million or more in annual revenue that also pass a data threshold, so smaller sites fall outside it. The Division of Consumer Protection takes complaints, and the Attorney General brings any action.
$7,500
per violation, and only if it isn’t fixed within 30 days.
Requirements
Five things Utah expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
Tell visitors what you collect and how to opt out
The banner explains that data is collected, as soon as visitors land.
Offer an opt-out of targeted advertising and sale
The banner shows a “Do Not Share My Personal Information” link, and you can edit the label.
Give notice and a chance to opt out before using sensitive data
Not covered by the banner. If you collect sensitive data, such as racial or ethnic origin or immigration status, give notice and a way to opt out where you collect it.
Act on the opt-out
Marketing scripts are blocked the moment a visitor opts out.
Keep a record of requests
Every opt-out is logged with the date and time, ready to export.
How it works
What a visitor sees, step by step
Nothing is blocked by default. The visitor decides whether the advertising trackers continue.
They land on your site
A notice explains that data is collected. Your scripts run as normal.
They click the opt-out link
“Do Not Share My Personal Information” opens the opt-out panel, with a single checkbox.
They opt out
Marketing scripts are blocked straight away. Analytics and Preferences keep running, because Utah’s opt-out doesn’t cover them.
Or their browser does it for them
Utah doesn’t require it, but ConsentBit still treats a Global Privacy Control signal as an opt-out.
Where Utah stops
Utah asks for less than the other states.
Utah’s law was written to be lighter on business. Knowing where it stops is as useful as knowing where it starts, especially if you already meet California’s rules.
Only the ad trackers stop
Utah is the one state where an opt-out doesn’t switch everything off. Here’s what runs by default, and what changes when a Utah visitor opts out.
Why analytics keeps running
Utah’s opt-out covers targeted advertising and the sale of personal data. It doesn’t give visitors a right to stop analytics or profiling, so ConsentBit follows the law rather than over-blocking.
A cure period that stays
Utah still gives businesses 30 days to fix a problem before any penalty, and that window has no expiry date. Colorado’s and Connecticut’s have already gone.
California blocks far more after an opt-out. See what CCPA requires →
Add a Utah-ready opt-out to your site, free.
Records
A record of every opt-out, ready if you’re asked
Every choice is recorded with when it was made and whether the visitor opted out. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
FAQ
Utah privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
Only if it makes $25 million or more a year and also either controls or processes the personal data of 100,000 or more Utah consumers in a year, or makes more than half its revenue from selling personal data while handling the data of 25,000 or more consumers. Utah is the only one of these state laws with a revenue floor, so many smaller sites fall outside it.
No. Utah doesn’t require websites to honor a browser opt-out signal, unlike California, Colorado and Connecticut. ConsentBit honors Global Privacy Control for Utah visitors anyway, so an opt-out behaves the same way wherever someone is.
Utah residents can confirm what a business holds, see it, delete data they provided, take a copy of it, and opt out of targeted advertising and the sale of their data. A right to correct inaccurate data was added on 1 July 2026. Utah has no opt-out for profiling.
Utah asks for notice and a chance to opt out, rather than the opt-in consent that Virginia, Colorado and Connecticut require. Sensitive data in Utah covers things like racial or ethnic origin, religious beliefs, sexual orientation, and citizenship or immigration status.
Up to $7,500 for each violation, plus actual damages to affected consumers. The Attorney General has to give 30 days’ written notice first, and no penalty follows if the business fixes the problem and confirms it in writing. Utah’s cure period has no expiry date.
No. The Division of Consumer Protection takes complaints and the Attorney General brings any action. The law gives consumers no private right of action.
Utah is lighter than Virginia, Colorado and Connecticut. It’s the only one with a revenue floor, the only one without a profiling opt-out, and the only one where sensitive data needs notice rather than consent. It also doesn’t require browser opt-out signals, and its 30-day cure period still applies. See what CCPA requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
RELATED READING
Keep reading
Cover Utah without over-blocking
Give visitors a clear opt-out, stop the advertising trackers behind it, and keep a record of every choice.
This page is a general overview of the Utah Consumer Privacy Act, not legal advice. Utah has other privacy rules that sit outside it, including separate laws on minors and social media.