What is UCPA?

The Utah Consumer Privacy Act (UCPA) is legislation protecting the data rights of Utah residents, introduced on March 24th, 2022. Distinctively, it centers on the sale of personal data and targeted advertising. Unlike other data privacy acts, UCPA's definition of "sale" revolves around exchanging data for money, omitting non-monetary exchanges. While it doesn't address data sharing like California's CPRA, the UCPA primarily uses an opt-out framework. Personal data can be collected and used for targeted ads without direct consent, except in children's cases where a guardian's approval is necessary. Businesses must also offer consumers an opt-out choice from data sales or targeted advertising.

UCPA's Scope

This Act targets both "controllers" and "processors" of data. A controller, as per UCPA, is an entity conducting business in Utah that sets the objectives and techniques for data processing, whether alone or jointly.

Non-Compliance Consequences

The Division of Consumer Protection is tasked with handling complaints and investigating breaches. Continued violations can attract legal actions from the attorney general, with penalties of up to $7,500.

Staying UCPA Compliant

The UCPA is part of an expanding suite of state data privacy laws, making cross-state operations complex for businesses. To remain compliant:

• Stay updated on related legal changes.
• Monitor legislative developments across states.
• Engage with legal experts to interpret new regulations and strategize compliance.

For more information, please refer to the original article.