Utah recently joined California, Colorado, and Virginia in passing a comprehensive privacy law. It goes into effect December 31, 2023 and shares similarities with other states’ laws. Businesses may be glad to learn that Utah takes a lighter touch in some key areas.
Applicability. Like Virginia and Colorado, Utah’s law applies to information about consumers, not employee or B2B information. It applies to businesses that (1) conduct business in Utah or produce products or services targeted to Utah residents, (2) have annual revenues of $25 million or more, and (3) either (a) process personal data of 100,000 or more Utah residents, or (b) derive more than 50 percent of their gross revenue “from the sale of personal data and [control or process] the personal data of 25,000 or more Utah consumers.” That the law includes both a financial and volume threshold is unique. As a result, the law may apply to fewer businesses than those that are, or will be, subject to other state laws. Similar to other states, Utah provides for a number of exceptions. For example, the law does not apply to government entities, nonprofits, and HIPAA-covered entities and business associates. It also does not apply to financial institutions subject to the Gramm-Leach-Bliley Act.
Individual Rights. Like other US laws and GDPR, Utah consumers will have certain rights under this law. This includes a right to access and deletion. It also includes a right to portability. There is no right to correction (as...
Letter calling for suspension of Oppenheimer and Ansara from council riddled with untruths, says Ernst Roets UCT witch-hunt built on false claims about Lex Libertas 16 October 2026 Pretoria – The t...